Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 16:45
Behavioral task
behavioral1
Sample
d93020d177f6ef7748d56b5a668659ba_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d93020d177f6ef7748d56b5a668659ba_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
d93020d177f6ef7748d56b5a668659ba_JaffaCakes118.pdf
-
Size
76KB
-
MD5
d93020d177f6ef7748d56b5a668659ba
-
SHA1
8db94fddaac82ad8ac1b9679f3e284746cc79c89
-
SHA256
ddb43b84ed681166fbdd87400eb3ec723bf0f0024faed67112b439814cb7c0de
-
SHA512
816c13e87663f3c279d2f6438ba6321d7d33216d39b329f211db656ee5466e85a1cefafa2786503f6fdd52ea20b08be345cca2f1245dafc4121d7cf27925c21e
-
SSDEEP
1536:bTXVS3qEIywOO5DChsUZAcnPa/s+WkNpOP2kYoiqWOtbfAo:vZtywOO4hsoAcPa/2P2NoiYVr
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1660 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1660 AcroRd32.exe 1660 AcroRd32.exe 1660 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d93020d177f6ef7748d56b5a668659ba_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1660
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD527dfa37d40ba8eef597842af2b7464cd
SHA1cf84eb490d0c6ed2c181e6f5b9ded0458451f941
SHA256922abfdfe34696286a303c5787d7080860f855a63518822b63a56d73cef02868
SHA5129eab3455b204dd1d423ea2513f11a34a86fd1f66ba954e3ee3190e4685699a90bbf321158373cd980348f2a48d8d03cebe1e854a2eb65fe57c5b3236948aeb29