Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 22:34
Behavioral task
behavioral1
Sample
f2143d870a28ff18629155a0291b7fbf_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2143d870a28ff18629155a0291b7fbf_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
f2143d870a28ff18629155a0291b7fbf_JaffaCakes118.pdf
-
Size
42KB
-
MD5
f2143d870a28ff18629155a0291b7fbf
-
SHA1
affedf41c0339a7f072155a4e95eef0d4bb42391
-
SHA256
59ea67bd9825473ee472d9be83ad867af8f349f030d00009bbfbde23914a8ef0
-
SHA512
d1d581172eadd920266cfb3f2950c1da245ece43602c5544b770cf6b423eca9e5e1e94cbaf39e5184b74edf460a2c03c28f7dc371228d60231129d9259ff9ee4
-
SSDEEP
768:htV7YMYGU9Sr8FxHe+5ooc7yE4VtWDT94uSuUny/PdrJ:htVf/U9A/77yEktw4HubrJ
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1908 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1908 AcroRd32.exe 1908 AcroRd32.exe 1908 AcroRd32.exe 1908 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f2143d870a28ff18629155a0291b7fbf_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1908
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b04ed87b944edfb0e4ecd8fb0c5e57d2
SHA1a9909e3dcf2b747fbe978345724abe2427bc82db
SHA2562b1527fc0f254bc9a57f6056e957f2b15ea621f8d19ed156cc6cf7cb8dad12e0
SHA512f281ff4954d4a6193f22b6e5f368f03c42e19e5c702be2ecaca8246084b10aab1201b07145048b5b60a15e0bc2a9c165dc810985c67f8a5a1ae9b315a0b2093b