Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 18:23
Behavioral task
behavioral1
Sample
e81e03e12e83ef0c81ac184f6e8486bb_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e81e03e12e83ef0c81ac184f6e8486bb_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
e81e03e12e83ef0c81ac184f6e8486bb_JaffaCakes118.pdf
-
Size
95KB
-
MD5
e81e03e12e83ef0c81ac184f6e8486bb
-
SHA1
6c72392c0972e9a3272cd7289c0e4af96ac435d5
-
SHA256
7ac6ece548cda8bacd421acaa87f7797187aaaedebd74fa492fcf3fdf51780f2
-
SHA512
74f8eb52f008ce71470d84766a4afd4c6e26796f110674d389c48fa63b47efeb8422b72f6f191c5684524e92fa52dd54fccbba99f144502f903a6d6e9a9fb568
-
SSDEEP
1536:15rwyB2vWhkddaEKtZfeAa03eUNO0LKiolvQrfDVW8pOGEWMMAwVIf8CfF0VJXYx:Xr50Tdd3SZu0OUzKVlGf0G5IfVfF0VJu
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1676 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1676 AcroRd32.exe 1676 AcroRd32.exe 1676 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e81e03e12e83ef0c81ac184f6e8486bb_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1676
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55894a0fb7a8e4a48896f14441b2113cd
SHA1e62135b97c8df5417a6942bf46f3ffe6456e737b
SHA256ae609b28fe62618b612f10184d4369be1c8c7e317c28e5dea83768872485f27c
SHA5128fc36c224084406e86ebd266af470c1ef06fac60b444fa28edf833924f7aa7497cf4fbf2208b3c45bf594c8ea1eef7588e8dcdd57a5f365286eea90ed34b2f36