Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 11:01
Behavioral task
behavioral1
Sample
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf
-
Size
91KB
-
MD5
fc9c0ac706b56a8d7645e457d9eee0f9
-
SHA1
c27e1ba7e3997dcef97dc4a8d33bc609762713b6
-
SHA256
3ba5d83fbf2565248980bd8ba66bd001b91fdcf0c49df97251b8eb679160b53e
-
SHA512
b6a0761a9515a0e962b87355bddfa175985d13aa82f219d264a36b54bed550fc9160bbe537f1c2a141d39d1c380ae4d5d054441427fa49894e2de612174f134e
-
SSDEEP
1536:1R9XVaSZ2QDPP16AkDUZWgpj/bW/vg/kVVJjdNXWd/8GTzBtyojKlT7U2wyHhTEU:X9XHUQTkDU79bI4/8RNA8GTzDyn42wy/
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2208 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2208 AcroRd32.exe 2208 AcroRd32.exe 2208 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fc9c0ac706b56a8d7645e457d9eee0f9_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5456e9ab9b378c2360de34de0a7ecb864
SHA1898b281cd87858a542dc9fb1e8af92f93bd1f3b4
SHA256fff910e2f0ad28df39e8bde5bf9ab42f226ca445d511beac4738317b8438096d
SHA51262b3a1ab8027a3123f263e0e33d6c1f8a326886d658a4695559e1ae5c2b832f31a29a1c63dff844ab4d12b43e648832f765e0ca2f874f4ed3ab249fc88befdee