Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 10:31
Behavioral task
behavioral1
Sample
fa1b5880846c282eabe24a58e16d8774_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa1b5880846c282eabe24a58e16d8774_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fa1b5880846c282eabe24a58e16d8774_JaffaCakes118.pdf
-
Size
36KB
-
MD5
fa1b5880846c282eabe24a58e16d8774
-
SHA1
bc7af647155d78e42a5d4dbc57d34981999abd0b
-
SHA256
4cf2518f6bcacbfeb7bf7ecdb8248fc37da31ba20926171d92dc74dabee30e78
-
SHA512
db4dd0109da0014c6d75a79fe87f6642ff3919354019cf94936c53ae104fda0dfe45cfad109122b780c340b1afd0497c275a588ac0293a0bb558ddb5a81ca786
-
SSDEEP
384:UdAY3r6c23VKyWiDuvNv459e4A4qkId1cZ98JJjDJBz6ru0tBTAcCUSMdzSWJbWk:KAh39JKvwdA4qtIaVDJBmp9r1cMFNf
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2164 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2164 AcroRd32.exe 2164 AcroRd32.exe 2164 AcroRd32.exe 2164 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa1b5880846c282eabe24a58e16d8774_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2164
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD516e7ea477a1e9a3f6f5dfe30973ee1d5
SHA1ebab89867141a6f848ed1d7fa645c49417f19ffb
SHA2566bd48f92c7b2539e5a14b54caa4b78dcf940491d129cc28c18c5d6ba0f850905
SHA5121cef932a9f6c049e88904a5c4b1ad55e2475789f634edf9cdc9dfda37a1e1516fc894e241a50439482dbb500ea2f981a85a68038cbc38c242de1116026a90b52