Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 07:55
Behavioral task
behavioral1
Sample
e98321c16551caa3e214e281d2125e98_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e98321c16551caa3e214e281d2125e98_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
e98321c16551caa3e214e281d2125e98_JaffaCakes118.pdf
-
Size
85KB
-
MD5
e98321c16551caa3e214e281d2125e98
-
SHA1
9bab9420c64b77a10aedde1713f974c64ca4ea56
-
SHA256
a95c0cad6aa00988362ec1ba738e12a11a0871aba2adce24209611de541a47f1
-
SHA512
26da35d4ff2e5d78ab4e905926f28c59aaf1e0a3493edff39e64fea8a0693e486ecef0d6913aa35c9b65045c5b98d4c881a14307099fb2d34e472a8ad1aa56b2
-
SSDEEP
1536:94pDSpn2u1O9jvfnS39QDLWOBpp1By8dGliQ+bBWNMPC+UxzMWmE1hSsocGMsxPX:V29jvfUuCOBply8cIQ+bBvK+UxzXW97B
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1736 AcroRd32.exe 1736 AcroRd32.exe 1736 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e98321c16551caa3e214e281d2125e98_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54f25def34d75befd52cc7828909ab630
SHA1170c9ffb739e84b75085d058b28cc4c4ecd41625
SHA2565d8f2e72d9043d75bd942f9c2e6e4b4c2c331e5d12bbaaecc0fe90c71d595971
SHA5122eedae0cb23dda4c1d5c2e57361643e99cb77263da386d7f0036479490566ceb88beef553e6577570945da02f7eddbceac5e30bb11a009abd3459f944164818e