Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 09:16
Behavioral task
behavioral1
Sample
e11594e31168af7e46527241c809f24c_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e11594e31168af7e46527241c809f24c_JaffaCakes118.pdf
Resource
win10v2004-20231215-en
General
-
Target
e11594e31168af7e46527241c809f24c_JaffaCakes118.pdf
-
Size
81KB
-
MD5
e11594e31168af7e46527241c809f24c
-
SHA1
223266a43596348027fe661876fcbb7edabe3b3b
-
SHA256
0220693d3be61f0a78286be8cf37f0cd3e4b2b4e62d23fc8cf778b44cb47090f
-
SHA512
b36fdd957148cf6182264413f6323e2815aac5b62efdc6b79ce3a3755eba8bf8f4f28c9a63e91bc5ef9870f5f0e0bd465249243fabca9d63f49d6d387ee6bf72
-
SSDEEP
1536:KfH2/g7oJk9RBp+dTbCzlmncTskWvBPOPuunrW2pO2sbhn:LIoip+dTbOQnP1WWung26
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1276 AcroRd32.exe 1276 AcroRd32.exe 1276 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e11594e31168af7e46527241c809f24c_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1276
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5762f88e8ff784aed363aae91bd717575
SHA1a5891547c0f46c2f06cf8e0f49807ebd56a2cae3
SHA25641ee68bb524a9b33d67ca7fa83e78e3401f78dddb618c8401f8deeb294e66578
SHA512e2a08d8e9923cb56da297680531bf8122710d0bc56da82ed25725ae12c35468f319f5d79080508d509a02f2b57ae1694c5b378eea46fb1eb76093ffc0650f1f2