Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 16:59
Behavioral task
behavioral1
Sample
eb8e01af11b3eca579376d62152e86d1_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
eb8e01af11b3eca579376d62152e86d1_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
eb8e01af11b3eca579376d62152e86d1_JaffaCakes118.pdf
-
Size
86KB
-
MD5
eb8e01af11b3eca579376d62152e86d1
-
SHA1
60a65eeb505452d109e0cb6244e17967a8509b30
-
SHA256
1c9e6c91a45dd42519a240a845ccb5832110f01b8d43a44f8dc09a647df40654
-
SHA512
6568c51db1623a24389eabd671692c0c0ff8d3c1e23d2a252a69b7dfd6e45b05655a35c4f7510a9d7d0016641ae7cb3400e656f955dfd0bc6d0ec603f4f56a79
-
SSDEEP
1536:UVj0Y0vBDkMkEcAYMayug7lzzukGqUe4VoHBqF2qQC2NMJWaudC4lvFPTeoxHWUE:KwY0JDklEcArayuUlzzukGxVSBqk/VCF
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2856 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2856 AcroRd32.exe 2856 AcroRd32.exe 2856 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eb8e01af11b3eca579376d62152e86d1_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2856
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD588ef9832b11eace7e0d8d9e6ce22d4ae
SHA1bfaef8ea33c07ea8bcbd8d1c329612d07de17962
SHA256983aafd4931745a1403db303fe748914761099b180ab1e8c9ba01a763a5ecf2a
SHA5126114874073945242ddcb3156f7a6826b820f4ce31e16840388825ed83c639ca16690b937b29897b03a208efdcebf3706cde5c6a8bd70e56bcce3d56ea2f36b58