Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 12:32
Behavioral task
behavioral1
Sample
eb1247cfe8e40e0a8beb4d323a651e8d_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb1247cfe8e40e0a8beb4d323a651e8d_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
eb1247cfe8e40e0a8beb4d323a651e8d_JaffaCakes118.pdf
-
Size
88KB
-
MD5
eb1247cfe8e40e0a8beb4d323a651e8d
-
SHA1
42d736454ed7ed91859a00d869c974ebbe199da4
-
SHA256
bef8c007f1f6c50746ccee77fb7659fb370fb8a7d458752f013042c6ed718b3e
-
SHA512
29c70fe68288c70560c4164b4ff6591c824dd73172ace6261f93d6d4568ceb3423dc1ab719978dcb1d67e2b05593d412f8c7249a8b5af81fd6b6b07a9b14cdfb
-
SSDEEP
1536:dARRwZHyxCjZOoJUBvyPrEXZnCNN57eW4xvcWLJdsWcWQpOCUXSCx8TqoP:HYxCjYnvyPrEpnCQsWbCUXjxkn
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2160 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2160 AcroRd32.exe 2160 AcroRd32.exe 2160 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eb1247cfe8e40e0a8beb4d323a651e8d_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2160
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5127703069a37b7ba0fc15e2408c7fffc
SHA12b74d7cfec650bec43e574423a565869ef87a45c
SHA25639491da7b7089420f31d14c1fcb7da68b430f8d3d00915d475e5f4b99c9a6487
SHA51282c4b74bf4e3f9c20a4697e7940d8bdd1bc4e4af9bd54784f503e993fd8916417c6d419af8d26fbf49855a82cd085ff028a3a7c4161f86fc890d9c85560697dd