Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 18:12
Behavioral task
behavioral1
Sample
f87fe85d36468e68be96d895331f8962_JaffaCakes118.pdf
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f87fe85d36468e68be96d895331f8962_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
f87fe85d36468e68be96d895331f8962_JaffaCakes118.pdf
-
Size
97KB
-
MD5
f87fe85d36468e68be96d895331f8962
-
SHA1
45ef68ba033cb8dfee188b01f5d6c430f9a6d26e
-
SHA256
0313ef9b158554f893f808093a8145785d22dbebe44ecfd249871f79c1ac458f
-
SHA512
0be8a4bbee13ac69a2bc1ced2219094dd52ebb58268e2a93916819fe16ed7bd2f956a3c27b11635eeda5c36b06bed96f9f550d3825e6e436f296bc6ef2dccaa3
-
SSDEEP
1536:pKlkD2WJ3kaIPymDVFos3aNfoGZIWypOlLLQFbBxBWGYEsNGpIxH47vQST:4Y2iIrDVFosKZJZJlLcFroDQwHmvB
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1192 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1192 AcroRd32.exe 1192 AcroRd32.exe 1192 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f87fe85d36468e68be96d895331f8962_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1192
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f5522d2e1b26afdb80bebe687d08e9f3
SHA113885aa49650bd7c11305e67d769a1969a440dca
SHA2560af15094c688cb9a1926d8367142161724b1bc692dc5e3a1d5e54df7bc568719
SHA512521bf253ba4bbd990b705db0b3ba3134137ed72de504dbb4d786fbcb2b77a88a6d814347c079c0207d8ad5f01b6ea27dc7758020e67d5a71631133fd6104ca73