Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 10:00
Behavioral task
behavioral1
Sample
02ff82758a762f061136371b3a795228_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02ff82758a762f061136371b3a795228_JaffaCakes118.pdf
Resource
win10v2004-20240426-en
General
-
Target
02ff82758a762f061136371b3a795228_JaffaCakes118.pdf
-
Size
36KB
-
MD5
02ff82758a762f061136371b3a795228
-
SHA1
8afb2114da2c404ecb6e3ef7f7c8c569980c88ba
-
SHA256
b05a935ebe5426f3765512557ca8be68e0b382e147fcc843ba58d4a21a75c145
-
SHA512
ae163980549cd983349a1e1ffbf47c9eea49bad7628ad7748cd7c5754cb61a2cb9f0c86771c38202422603fe2966e4ddc0ae697e177a3c20a2e743d2a13cf22b
-
SSDEEP
768:OXuMZmwgCLWar2tMe3y+45vIlfPS6/3BUF/U7nWtf:OXFZmGWSeMIy+uQl3S6PBZnWtf
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2868 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2868 AcroRd32.exe 2868 AcroRd32.exe 2868 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02ff82758a762f061136371b3a795228_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2868
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51e9764bd3e7dfe05429b3476e6a92889
SHA1e1bbf3ed3a8d60e4a2f371d52c399660fc82a079
SHA256ffcb8623e30f7ddbf4902934afcedd3e2a93f79ab35e9b1f0eb15151d73b3fe2
SHA512322ea78842c53b99e59e35cc45cd36828b1d22ee6dc6536e3875e9dd5a51b25c92c85b0022ac17d48cc399affba22755337ec5f5cf797a1ae173af93cc0357c1