Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 14:59
Behavioral task
behavioral1
Sample
46b2350ea7a7dd2941673f6ef2573ad6_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
46b2350ea7a7dd2941673f6ef2573ad6_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
46b2350ea7a7dd2941673f6ef2573ad6_JaffaCakes118.pdf
-
Size
30KB
-
MD5
46b2350ea7a7dd2941673f6ef2573ad6
-
SHA1
bb5cc38d414e47c7a005550a7ab7eb022bcb0bd3
-
SHA256
b41a01a16b1d1319bc6bdbdfbe9fa5e86ca7204fa618b35d03076f766f471369
-
SHA512
d6505336912e1fddc12f93120bb04677789ee17f206aa7b1b2b516883f0dde9ed5d6f945e4f3fa680f79547db7c8d39872330e4351181530f636df61007b9171
-
SSDEEP
384:3/QON8MUG6Qgw0JZCTzz02YFnarX5WDcBy0KsjP42Lbfv30bZ2amQg/RCUSvLeg6:3XuMZmwgCLWarRk2Lzv21JwIymO9
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe 2524 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\46b2350ea7a7dd2941673f6ef2573ad6_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD552421b13c82623f74610a2fb54349067
SHA1c68a9b317e37ed18991d6807d164507aae8814f1
SHA2569bac57385f53e0d812cfe690b82080134cb204ff305e36ae33c9e1a8460c319f
SHA512debd4b986252920a40ad1172a1ca8cad6b4b9c47b4a0b3f09be1e396a86a2e099b0d896e57f74f905fd3602d67a5a9d861e4d79cfc53458b1043615ad67f9156