Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 06:25
Behavioral task
behavioral1
Sample
dd7f5e829bc3b6159d5795858e811189_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd7f5e829bc3b6159d5795858e811189_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
dd7f5e829bc3b6159d5795858e811189_JaffaCakes118.pdf
-
Size
93KB
-
MD5
dd7f5e829bc3b6159d5795858e811189
-
SHA1
b9aafae09cb1d40e2f151d90a2acd626126a484c
-
SHA256
f8743849888b563c8fac413f021695ed52fe6455bfcdd2ddf6e42275d7394065
-
SHA512
c4af5836324166dd2fa7fcf9f9b95f3f6421290a0145ac47ed57e1d527fd93f62e69c34b2a7165d1d2c7a2c805aa05ce3a09cbedba05f1a62ba2b8985c5049df
-
SSDEEP
1536:CF2HZoHYp2cBB2RZG90VHT5wQ58Uipvyv30DtqRkQ+ysWcpOmk6vYYKHiWo4esN3:I2HZlVbqVHT5wQ58Ui91tq+xy3m7vVqd
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2096 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2096 AcroRd32.exe 2096 AcroRd32.exe 2096 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dd7f5e829bc3b6159d5795858e811189_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57046fd8aa743c4b8d9f85be88ffffacf
SHA172222984dbb19a350f898b9effed925354ce81f4
SHA2563cad8ac82c818bb8a50ae7537e0816dbc6656b074b8d613425f17644229acf9f
SHA512df6b81a448550df662fba36a42d07078179d86f8b53da0cb393f70c1cfe86a40b270389eae081179594fcd736ffc515c39bf6054e036949362316f235eec7069