Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 05:41
Behavioral task
behavioral1
Sample
06f175a62ef44aed3e4a132b396657af_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
06f175a62ef44aed3e4a132b396657af_JaffaCakes118.pdf
Resource
win10v2004-20240419-en
General
-
Target
06f175a62ef44aed3e4a132b396657af_JaffaCakes118.pdf
-
Size
44KB
-
MD5
06f175a62ef44aed3e4a132b396657af
-
SHA1
fba8f5726f6b8a2c020cf1e61f60ce1f50ddee86
-
SHA256
33ccbb783958e27c3c5ba4bcdad1c701805995120af319b836eaf35035eaa52f
-
SHA512
91ee4bd95def6d748a570ba069e0c79d5ae6cad43b356a9834b7c768610a0ad89b108ea6fde50224741be7d4fd2501257e198299427517ca7bd888d10c46d72b
-
SSDEEP
768:9gGzpDyBVksi8XxPfqRqN+rYwiYWZTxQHFtlJvr6P1yjpGt48D4s:+GFmNYDtD6PY1Gq8D4s
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2080 AcroRd32.exe 2080 AcroRd32.exe 2080 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\06f175a62ef44aed3e4a132b396657af_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53be9e05ea7a8137386241dd2fb9a6e89
SHA13dfb2e59daacb12b65494475e71a3483ff82463b
SHA256788d7bc624dad00f36f3b04928ee9b9579dbd7934351833ffc102103540b1a87
SHA512a36502b5a5d812e927a18331b6b5711c65a0799f35bbe9f20785d85ec5bcc1114f1aaefd79d4d1ac9dc9cd6890960f4d0e2d1adac74369e5749aaf4ca35a1a60