Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 00:52
Behavioral task
behavioral1
Sample
e8d5048cd1c6da4c21e2110f9b9b4f97_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e8d5048cd1c6da4c21e2110f9b9b4f97_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
e8d5048cd1c6da4c21e2110f9b9b4f97_JaffaCakes118.pdf
-
Size
85KB
-
MD5
e8d5048cd1c6da4c21e2110f9b9b4f97
-
SHA1
2b917ebc546be2f97fc9880ce69feccf92290745
-
SHA256
3acd8d9b2e5f53a3491145bdef7fb6f067aecaff597f9e9fb12c57087074526c
-
SHA512
71e0a483ad0eb0c6a4decb07362cc54c857b8725498a273416aa915211104a893b87009cb8c87d29177d9aec8757589d2d7a31126004e13688a40e5d74a193af
-
SSDEEP
1536:3qfppuNc2NWVGxgZoyzEa6eGtwtJQjDax6OZdORJVAss/RBWOpOwruqhP1WXKDxG:oivanSWqDax6sORjATR+wruW5wF
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2864 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2864 AcroRd32.exe 2864 AcroRd32.exe 2864 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e8d5048cd1c6da4c21e2110f9b9b4f97_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2864
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e67e3fe203b484e04a66c1ea47568f7f
SHA1058f5ba12b2b57eae031b8c1d77bb75726675ad7
SHA2564b79a397428d511abf2bd0aa5deb24b62e15f3d0e284f4ff4863c2bc67417848
SHA5120032a9a0ca483301c5096f9141e6b191acf18733a6f0aab8b63eb157b55d4a494ca3231ccdcf3330d18e2558ee29b9665d6987868b5db96671d46dc84862b28f