Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 22:04
Behavioral task
behavioral1
Sample
ec17329d258377cd1ed2b191f49a7af1_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec17329d258377cd1ed2b191f49a7af1_JaffaCakes118.pdf
Resource
win10v2004-20231215-en
General
-
Target
ec17329d258377cd1ed2b191f49a7af1_JaffaCakes118.pdf
-
Size
83KB
-
MD5
ec17329d258377cd1ed2b191f49a7af1
-
SHA1
8fb48877358eff78c00a2ba8a226364a9604069d
-
SHA256
2dda72a93734ed31b1c2796644dcb47f3ce0971b99f5c8db8d4144dab3067f1f
-
SHA512
b3419959d4a51b303461655ebe4973544afe6740bf2269ca6a4d3919cf82c279cc56575dffc40a2c9116b685f775cde80e025c611053079512b976fc76670df0
-
SSDEEP
1536:B4tuuxgwSqBEUqWWcUOjQSi9ekHuJp6dZeNK4veWHpOvTWzHW4gHCOYzUH2Au:agneEUqWAYziokHm8Lekdv2gipzUH6
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2780 AcroRd32.exe 2780 AcroRd32.exe 2780 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ec17329d258377cd1ed2b191f49a7af1_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2780
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58a05908894cc790106a6e918bdc56b47
SHA16229483fcd653240440c28fa81fc76da477063a6
SHA256a7d8621455b07198a1cfc440ba81a4efe864a5950817d9fba6ae9233d272dce3
SHA5126090c7807c2b59e36e0433eed4f31deb5df6c97d5f0bc49bf35b3035eed3ad1eb346658b710efb7cea96c7e9ee7c74ab97f06c2f3d2b098caab0e545d4ab7b91