Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 03:05
Behavioral task
behavioral1
Sample
c90b7fb038afdf8bdd2d4dc70bc68581_JaffaCakes118.pdf
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
c90b7fb038afdf8bdd2d4dc70bc68581_JaffaCakes118.pdf
Resource
win10v2004-20240319-en
General
-
Target
c90b7fb038afdf8bdd2d4dc70bc68581_JaffaCakes118.pdf
-
Size
75KB
-
MD5
c90b7fb038afdf8bdd2d4dc70bc68581
-
SHA1
d9da977630e0663dfbe07eb28415d5a0374520b7
-
SHA256
e48b7dcbf2750e5207d59b0921833abe9d854cd642a1fa659f088166cca500be
-
SHA512
53dc15bb60d9bedc1cb880c417156c69f3396e684046781ae0defa3c1226f4e7b07d9f5030d8f2811efc5b822e6909011516d650265a14281557fe641b524874
-
SSDEEP
1536:o34Alhx56Pa15ZCLlu9D24dal0yGysYQjz2xQUIC6xXIKNyhsrg:LSJfCLg9DLQtsbze6D4xhR
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1932 AcroRd32.exe 1932 AcroRd32.exe 1932 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c90b7fb038afdf8bdd2d4dc70bc68581_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD594c5a57dd1ef50cb06ecf5b53152e0ac
SHA107c3ae3f0e33d2ea355041fa5ab33b84d96d907b
SHA2560fdceb4461c701930d1f949442e5293c6e076de3ad364883d964ab1403df5beb
SHA5125e7cc33571d7284331d117130b7c99b6a26721253a1238c5515c03c9e1ae1bbbc5b79d28b84973525f9cf6fa5fbbe8c99806afb45ba7da8aa3fc325ed42e8df9