Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 15:32
Behavioral task
behavioral1
Sample
ff98eef0619b4893b48da1d704680924_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ff98eef0619b4893b48da1d704680924_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
ff98eef0619b4893b48da1d704680924_JaffaCakes118.pdf
-
Size
80KB
-
MD5
ff98eef0619b4893b48da1d704680924
-
SHA1
151d331982f368817e56b1c0b8b0043b2c690edb
-
SHA256
bf38dffb1dd61a011e6e6ff88064054ceee47770396e77eec455243377df1007
-
SHA512
bbf424dbaf4aa175568689373e94f574158ddf64838239cb5915c89af9216854b3b8da9f8c5a448442623545709c86480ab75382615537f1a0678c693f401146
-
SSDEEP
1536:22Ah7pC2R7uy4eE2G78mVgNWcf0zi8wEj5Ik6ZHVzvD4h/+1GWbkfAUTJCLCMFWd:DUp7aqmRhyV/4Q4TJJMwLRSG
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2416 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2416 AcroRd32.exe 2416 AcroRd32.exe 2416 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff98eef0619b4893b48da1d704680924_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD583d14926d5ccd3f28878044b8dfb579e
SHA113d2e315600110c00e06016c622b4d331de04c8e
SHA25672efe1ce6e2e369f3596212ae32396a70fcccfbf2def4adb8c315434ffc1c5a8
SHA512e909c74b7151d193aa9040fe75010588097333a2347ca35bf3614c42587fedcf4ab0879be3bc8aacf616042249d8b57562736bfba394a2663e8617d244a62cfc