Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 06:39
Behavioral task
behavioral1
Sample
f07e92fb0461961cf64d1ac4c0739d6a_JaffaCakes118.pdf
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f07e92fb0461961cf64d1ac4c0739d6a_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
f07e92fb0461961cf64d1ac4c0739d6a_JaffaCakes118.pdf
-
Size
73KB
-
MD5
f07e92fb0461961cf64d1ac4c0739d6a
-
SHA1
c534ce302459c753ad36dfd2d9c3e33a3af2d22e
-
SHA256
55d8572192c6df0ba64f1c1494cab118af898cafd6984418ca282640bf876119
-
SHA512
5718a8ab45359bee8154a75bc2e1bf2dfac56991a37521dcd27b8e521474a9d229b29f92b9996724b28aa482277a19fe475504b4051ba70fadb516e66c880e4c
-
SSDEEP
1536:QCfCMySbiBoxahtaTqCDWVNKR8TdMKNeW6pOu2TUR3Wi+nf4e0no+Q:HKMyaiBoxaaxDcNKROdMKBu2TURdaf4W
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2980 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2980 AcroRd32.exe 2980 AcroRd32.exe 2980 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f07e92fb0461961cf64d1ac4c0739d6a_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2980
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5dd6c3f16241e5a74482e8ec9359521b5
SHA1b248026c58e98d2d2aec5bd14b9de5ccb60941b6
SHA256eae633773330547443438b918d6d6a68ae97de1e2fb956b93af4eaa161348ac4
SHA512409bf82337aa82cd0237b05d360e5e1ea3fc92456f08c64657bdfc776428c2858f4400a2d42d3bea219be4fc92ca9a7c559bf24c2f077a20fb260dfc678ac00b