Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 12:02
Behavioral task
behavioral1
Sample
e9f2075110235e1c319a28a07d347b10_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e9f2075110235e1c319a28a07d347b10_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
e9f2075110235e1c319a28a07d347b10_JaffaCakes118.pdf
-
Size
153KB
-
MD5
e9f2075110235e1c319a28a07d347b10
-
SHA1
4abaa94dc5419a7b7574e305b699531f58692b87
-
SHA256
79eaa0032ea716ea7e22d0c12ca991ba0b0e32630b52d2803a72da7fe0c2a483
-
SHA512
4d64978d44ef239b7c8f727d9a046ed8698f10b47cba6fc6bd8c63a1ce93cb930a4845bd2b7fcfe2ca4dcfdf4b6725f447c8e16f95909081c66f39d1108e69c2
-
SSDEEP
3072:7XQ+zeBeihh/90vfWqSzxQRBIBwVEO7gnPFY9XV3XHk5Z+9L60JlbY:7A7eihhl0vfEzxQRBFvaPCRPhJlc
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2172 AcroRd32.exe 2172 AcroRd32.exe 2172 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e9f2075110235e1c319a28a07d347b10_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50f8d5ea72dd3a720f5dcaf294ae381c8
SHA156cf69dab3c745b1ad2ea392a97d4986cf7aa7fc
SHA25607df7f510db07517b912ab0e7cf0a5cdb0913f6be4dd8c533af26d8367fa2bb3
SHA5121e7a65a92ad2f7353659d6646dc4e07a78e380662d0ac1ff33af0b04c59987fa792b0ad2709526222ce0cfc145dfee1a1297ce05b53a256cf4f22bd38705395d