Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 13:12
Behavioral task
behavioral1
Sample
e29e9201fd4bfd3ee0bda4c39c769d0a_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e29e9201fd4bfd3ee0bda4c39c769d0a_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
e29e9201fd4bfd3ee0bda4c39c769d0a_JaffaCakes118.pdf
-
Size
82KB
-
MD5
e29e9201fd4bfd3ee0bda4c39c769d0a
-
SHA1
56881576aa2f7b564a4297eb65aafbaec71247cc
-
SHA256
9bcbe2abf5b4e57262b978e505eddb23b4efec54a0ce50cfd1a5d53fdbcf3ab1
-
SHA512
15c560105031c3f57006fdfab7cd3461b9e260cb34833f37cd690645de4b41e30ea9769d16e63f7f9295cbd833958cecd36beac7b9eed29db7284952bf643d3c
-
SSDEEP
1536:L7SC5wfmU/RBaRMnm1XQSJAXdGFQFkCciKf8YrsUYiDvQqsl5qoWapOtQHWDlAld:fSCUp/RBKMnmJJAUS6Ccff8Yr9YSvQpB
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1928 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1928 AcroRd32.exe 1928 AcroRd32.exe 1928 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e29e9201fd4bfd3ee0bda4c39c769d0a_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1928
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d1e7c4ed2172ee7068e560b70efe281c
SHA1011ef7942e5a921b26ce62a98f03ef47323d653a
SHA25673f8f9126b06beba9cdb0228bbd894da4bafd1dd79c91d377cd8431ed61b8c35
SHA5124ae2c60916a69ff10e61b69c66251c9cd8b4c7cab3f3bd2644de4b9dde1665be0b32e698b5a816219fd5ed5bd246e872363a013e458b1679e60ec6d7fd857ad5