Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 04:16
Behavioral task
behavioral1
Sample
0d78baa860b9e34d6b492a410ebed3c6_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0d78baa860b9e34d6b492a410ebed3c6_JaffaCakes118.pdf
Resource
win10v2004-20240419-en
General
-
Target
0d78baa860b9e34d6b492a410ebed3c6_JaffaCakes118.pdf
-
Size
30KB
-
MD5
0d78baa860b9e34d6b492a410ebed3c6
-
SHA1
b2a101386654079396b0f29dfdb277843e47e7cf
-
SHA256
4151ae4fb7066e52687d4c3fcf4b6417378a1991563e387a338c93aa8f65e013
-
SHA512
4d047eb76d0f134267ee32566c08a9343dc63fb4ad6fe6304156079eb6aea55acbedaabd757d161a65139a09f89cca305b2a7d5c4bd9889a23ea5c93e7769c09
-
SSDEEP
768:MXuMZmwgCLWarMmCkUxRzGI7/FQyAOHF6F+UKS5O+cSW:MXFZmGWSMmCkUPL7/FfRHoMUKS5cSW
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2896 AcroRd32.exe 2896 AcroRd32.exe 2896 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d78baa860b9e34d6b492a410ebed3c6_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d00dbe8a3d9c8c3185af7d0532b27231
SHA183891b7d173c818b2093127d29f846b70decbcc4
SHA2564f48b31e35a98c8fb8260255730c99f786c4a36307ab272883daf3112112a2c2
SHA512d1533c82ef568a23547cd1bf38b091472ede95481984108d0d6cb77d6b7b787d146e0dbd56a92e06fff28d5511de6aa3494294e52f03102a082771c83597f743