Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 08:46
Behavioral task
behavioral1
Sample
2412af23a4ed241a822c1d90e85902e4_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2412af23a4ed241a822c1d90e85902e4_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
2412af23a4ed241a822c1d90e85902e4_JaffaCakes118.pdf
-
Size
356KB
-
MD5
2412af23a4ed241a822c1d90e85902e4
-
SHA1
f57acb5e7d97b6c4dc0c18ec9dfda120e857ae1c
-
SHA256
d68760803ad83de7e55ec582d9f8d0688c023507129b9d451fdadc8aef6fdf1c
-
SHA512
54699936b01bb09b50e561459126098d1f449373a4905e64bc0e3cd27872d4ec1f5b73464ed4be18d0000cbc629d89f6227486df29209124d0f84c98db28eccf
-
SSDEEP
6144:zRcm0NCYOBbH1+kl74XMllMzMZjSp/70lCl6BDlbxdfY7Ki0vycMiEOwN:MNCYOBDAklzr/SR70l7Dlt1SxBOk
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3028 AcroRd32.exe 3028 AcroRd32.exe 3028 AcroRd32.exe 3028 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2412af23a4ed241a822c1d90e85902e4_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3028
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5eca3edd950ed2d440cb6872f043d510b
SHA1f547f1cfecfc7f7429d5fbb8bcc884437f03d1e8
SHA2567c2a49b816b01d8d92e8a8d289314ec636d4bcb4bc0d5269028bb8be236863de
SHA512028f798f8b87bbdd85be6bfa44d2fd87268fe5c39cd4d7b8f0655e7db81c3ae115cfd18168b36332ea24374582a67ddd699a8eaf071039a013536ee328506ddf