Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 12:32
Behavioral task
behavioral1
Sample
fcc6cdf0806ad670696ed8a578cd3384_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fcc6cdf0806ad670696ed8a578cd3384_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fcc6cdf0806ad670696ed8a578cd3384_JaffaCakes118.pdf
-
Size
80KB
-
MD5
fcc6cdf0806ad670696ed8a578cd3384
-
SHA1
0bcd11532827f0713e2ee287bcd88c5866f8702e
-
SHA256
c5d5eac7f3c1cb240569bfdf9df0375a78b8151be002c6e80cc0d15ce02ee850
-
SHA512
e765a741fdb66d36b819f21caa3efd84b3843eb600dd155f39e71234e99f64850b3062fd8f1d33df175fe8d71a678a92561a98b34f147b6d30e07489f5bb9056
-
SSDEEP
1536:bNUuEtoiR/xxhiweJPNqFa/RACCHK8iUEUHly6hBsD49TKJbWRLUKZ5lC3DzAqWI:5UuOjPxhinqCCqtUEwb9KJgwqlCHAx7o
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2872 AcroRd32.exe 2872 AcroRd32.exe 2872 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fcc6cdf0806ad670696ed8a578cd3384_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54e230d5861dfff468554cfb95279a530
SHA1727664002af51db6e79a41fc35ceaf9ed06cd97b
SHA25696e01d3fb796a038e1bd183046df88ab6ae81513e98df57768a993034b336e4e
SHA512003f5c60d8a344c24eaf5a99ebbacad8728e10472be62a8c9203eb1d9ca41a0067c21afe37ebd88226a588185cdf063ba4df98d41b8b42f90b33f2d509c41bff