Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 21:09
Behavioral task
behavioral1
Sample
fda75f07c61da9b60f749a027f84f324_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fda75f07c61da9b60f749a027f84f324_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fda75f07c61da9b60f749a027f84f324_JaffaCakes118.pdf
-
Size
90KB
-
MD5
fda75f07c61da9b60f749a027f84f324
-
SHA1
9119702c793e22242d021eacfb8fc5b3d6b1e1ae
-
SHA256
17a1a89a36cbf4820170cdecc20e94db93ce8e0bee286c90ef643745c4205321
-
SHA512
254e0119f4455a68b025c6a75ec33a3d9519cda406eb40b91c1d5ece9da1978668f0c055781d9bf76ab1772f3685f671cc74afb2d890a10613c416fd1e92831b
-
SSDEEP
1536:qW6m4Gltsa+yGBDazoQnkbxAB6GQttXkeYnzLj8kXNRt6O0QQpWihz8nkgtz9tWE:B6hCtF+L4zoctAG+tZgVd6OGpAtz90Ri
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe 2524 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fda75f07c61da9b60f749a027f84f324_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e4e0136a93d97bbc39153083df1d88d7
SHA1f6361279c7ce427dd9e63cd26dd039cd6282ea94
SHA2562713e3a145d0681ba1bdde949049b79de7879b076d35fb68474a6656c5924243
SHA512d70d908efcf65b6ff2f240b1304e54145f0eb7991af7eb4b84fc10d153f524df15900dc42739101ea6239b9df1777da49a834a8cf9f6b28ca1bd13600c337b3c