Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 14:39
Behavioral task
behavioral1
Sample
ff82e895928e99e94fd414c7c76784cc_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ff82e895928e99e94fd414c7c76784cc_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
ff82e895928e99e94fd414c7c76784cc_JaffaCakes118.pdf
-
Size
79KB
-
MD5
ff82e895928e99e94fd414c7c76784cc
-
SHA1
b1ae3dcc52564e58b67cb0fb9486a3804de19b00
-
SHA256
d419a185bcac281d4c6e7b5994e3e22c41a34161824a134ed838bf93cdf8d168
-
SHA512
1b28c5945538c233fee5a37dd1e3b06e11a1bd98d842f1c53947f35bb5e104087a3c1cd1117dceb903dc56714832e2a81035d718cbf41932c39720ac089a6a0d
-
SSDEEP
1536:FBhrwseaQrX17yoAyWZ69LkPmApGlT8ZUZ57tQX7y/NefWb3NwfWmpOS+a+a5J0:jhUXp7vchmApGlT8g57tG7y0+dw4S+SI
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 756 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 756 AcroRd32.exe 756 AcroRd32.exe 756 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff82e895928e99e94fd414c7c76784cc_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD587f269811596927c81ad17a13a46b3f3
SHA185f9ba3dc767a8dac654735f350ab8f177cd080b
SHA256e3baf5bcedf18d650369b22051af339db8b292911dee1b8c84b3a96de6becc0c
SHA512d26b3eaa7745577e1ffe6918d33feb67fc99a59103b51e91f4c2de029ac2ded60186b229c6e5f5f12a964adfeed7e5a1d65c2c8b534937da83a6ba8e177f93cf