Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 08:32
Behavioral task
behavioral1
Sample
fedf4d62a82a56549ac510c38347391d_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fedf4d62a82a56549ac510c38347391d_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
fedf4d62a82a56549ac510c38347391d_JaffaCakes118.pdf
-
Size
42KB
-
MD5
fedf4d62a82a56549ac510c38347391d
-
SHA1
2752890128e75d2f8e32de5e2b339974a1d20b99
-
SHA256
4252befc010e5809f1353b765ec184f39e5c2617f54156c1db065cc3a8361726
-
SHA512
995a1ee471e8584f23b647490b6f6cfcdba53e0c900aeaa700dd0f263162ed9dcef4072439508b8c6c903322de95e93d745036571dd3d9571b76813a66b3dffe
-
SSDEEP
768:QcXieyBSjGbteqDcG9xKoS9HW/YHeBtQw+lwtaVdViyCmxDPS0Juw:/X77ybwcoeYHeB2OYVdViyWkuw
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1876 AcroRd32.exe 1876 AcroRd32.exe 1876 AcroRd32.exe 1876 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fedf4d62a82a56549ac510c38347391d_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1876
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD536aa63bc5d2bccb5f4a3a31d27797419
SHA17f67f007e9e47aecd85256cbd4c538fbed7303eb
SHA256b9f2c1e978a265139fb674f330bec1689f66e1e69f16824649c97125ad00290a
SHA51211641a77240e16c9b3be6359b379ecd9300a79241feef3bf4d1cd8e85cb78bbc87ce5eaabb324c1990227089282f20da259a6678875338d747b8b6fa63d7c1bf