Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 21:29
Behavioral task
behavioral1
Sample
f69cee81f7bc2f1cee60cb44c9ae5f75_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f69cee81f7bc2f1cee60cb44c9ae5f75_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
f69cee81f7bc2f1cee60cb44c9ae5f75_JaffaCakes118.pdf
-
Size
33KB
-
MD5
f69cee81f7bc2f1cee60cb44c9ae5f75
-
SHA1
7b3757286b79cebca5f385e573423e0cc89289bc
-
SHA256
eac70681ed539332cf3694f869479b1ddfd5365f5661dca64e5909a2146c229e
-
SHA512
f2764f1c874c9a3d70bbc3356a66f168ac80e564ce36f9a65c1a7226ad842fbb0c35df155c0c8b0cee68d4f332ada48f44b2f95e054e03dabe9d4f3c45b9ca6f
-
SSDEEP
384:IWBjSzQINrAZssrLRcF91mlUIS4VhqzdovMeCUSZfWwNY6HSmfOuXDB4+oLCUSi9:PBoAZssrifIS+hqzdov/WX1fBDBZqL
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1540 AcroRd32.exe 1540 AcroRd32.exe 1540 AcroRd32.exe 1540 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f69cee81f7bc2f1cee60cb44c9ae5f75_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56898f278d3fb07a106c506342fb6c0a6
SHA10af1be7279bb4f12feefb31d09a424039c9bf6d9
SHA256297a545560138724c7181d66aef00efed518a29967280eaa745ca9d039cfd25e
SHA512662e14a8de6dfd5203133cede029e84940022e8949aa19c86d499641a91beb9c9ccd5995ddc8b10f71c4072145c8657feca3e8adcb9d45add69ff9d2f9531ca5