Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 05:42
Behavioral task
behavioral1
Sample
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf
-
Size
48KB
-
MD5
cc61c679173dd1d86424bafbf4c6a6e8
-
SHA1
9c3c27baaddca9e0e9ad5dea51b7c535ac41b494
-
SHA256
cef1009ed5c3807cf18d6f38afe6a0ad5041609f3b421803c8f7b02d22cbeec6
-
SHA512
fc369eeed5af129f2fb102b8b63a290dcd8ee80f05f7fd2975e4e3d0982949d0d231b9ba02ca5312f68269f65999ad817820f42df932a34b66987918efead33b
-
SSDEEP
768:+R0hIMsFKFuULw18uT3ZmA6ikhx0PK0PSTbltRvORiq2oNQGuH6BJ2rY:rhI/TFxTJzSSUTRvORi6aGYCsY
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 AcroRd32.exe 3044 AcroRd32.exe 3044 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cc61c679173dd1d86424bafbf4c6a6e8_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5dfb969522eae19a0bf6aa18575a6d03c
SHA1dc4cbee2b20642e3cadca547dc10253cbd8962a3
SHA256f2de367fbf8e86f62a1a32137df2f25116b5879209a0df2ae3182697108800c9
SHA512cebde4b53fe6543ca90987585ec0fb093aaf8785c137e64a0a5e83a8ffd00f32b3787669c512c0da9dc775f735dcb78d6f8e8270fa15e2766dfa256021c57f63