Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 20:46
Behavioral task
behavioral1
Sample
30fb243ac7b86268485f5e4e0ab2c459_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
30fb243ac7b86268485f5e4e0ab2c459_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
30fb243ac7b86268485f5e4e0ab2c459_JaffaCakes118.pdf
-
Size
45KB
-
MD5
30fb243ac7b86268485f5e4e0ab2c459
-
SHA1
23482e9ce947a6578e7a98765e337415457678a6
-
SHA256
7413600422666324ffd9d6850a229beb0c2d660cc3f97767e58303c285ff20cb
-
SHA512
4718823f343d796b0a8b70e9bb934f4041e3d8cb8c1502bf4fac0e09aa1161b92b40377aab9ef56524494dadb037bc19773f8932b85a2ef13efe62b2b47b064a
-
SSDEEP
768:ugGzpDfpHB1VnSCj2ycZkWSpUgYutY6g4gPr7Rqji6NPEln6+v3WFsGQL8CZjD:LGFLpLyycGWSpUGtYX4Qlhlf3WWv8CZ/
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1640 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1640 AcroRd32.exe 1640 AcroRd32.exe 1640 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\30fb243ac7b86268485f5e4e0ab2c459_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1640
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5befa2db41d58e0c5b1598522a3203e09
SHA170a03d865be70b7c9e5ff849cc6bc1bea5f716d4
SHA256f778906b4150412264184358a3ef65f44810ad703dcbf4146c4b40dc972f61d0
SHA512164101bc465297e79e52b43da743980376f1b8deb7d545cd7d72ebe76b3960427aef312fc65445de1fb4386cc6f2f21d0c46282811b3fd1c0ffbb6dc8290b704