Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 18:58
Behavioral task
behavioral1
Sample
faf505383ed61e01e7a3463b52c535cc_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
faf505383ed61e01e7a3463b52c535cc_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
faf505383ed61e01e7a3463b52c535cc_JaffaCakes118.pdf
-
Size
93KB
-
MD5
faf505383ed61e01e7a3463b52c535cc
-
SHA1
bce71048844627f6af0ffd226e73fe457edd8132
-
SHA256
a47c637e87f5c132169936fe09fe249546eabc3f7329c8bb04e14b3e36a34c96
-
SHA512
446a0999dd244728d5bbd76d2197de02313ea5282c16e9c9fabbabd176a5e6e75e19ee48e98c33a5fee6d7e189325ab61a74cee11fec1b6e3d48a8c7089d8205
-
SSDEEP
1536:VggVxrcsxtPLA6p4l6AjIFwI4QASU4MqYD5aPYtGUWOXTs3WspOS7Nm:pT4MtPLT4MAjmKTYKEPczjs6So
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2880 AcroRd32.exe 2880 AcroRd32.exe 2880 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\faf505383ed61e01e7a3463b52c535cc_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2880
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5000f6f3eee6c709c3f24c8877f020034
SHA1b9f82da783663fd1a9ec2b0332d88db49ecb93ca
SHA256e89d96ff2a1308373cb4f28f1da7918ab8aaca4f1c3d897fe3dc26ee5a96ffeb
SHA5123929e78517616e290d0d754d86323dd7b9e619aecc4044de9a4c68e40c235205b81f4a43dd29e5732b7d166d2565fea0b66661c8497bdd65d4a5b21b8a4e46c6