Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 21:21
Behavioral task
behavioral1
Sample
5b88de65f1e37c3d4969d47d551f9568_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5b88de65f1e37c3d4969d47d551f9568_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
5b88de65f1e37c3d4969d47d551f9568_JaffaCakes118.pdf
-
Size
42KB
-
MD5
5b88de65f1e37c3d4969d47d551f9568
-
SHA1
d0e08dd7a40c04d3b5d8ce058d16b50fcddd2778
-
SHA256
2b4ab13b812989644c819d37823e688c993eca532d917beef3f5a6636f34df18
-
SHA512
efdaecd12b9dfea0a81a715229e250aae991e117ad4e4e6f7c8d693df726c97ae4b5da8494098a30d2dd666fa844c11a661d5ed6455f4e051f901985abb3f986
-
SSDEEP
768:agGzpDhqBxvvU1HQGmgb4YtLxRYnrMqs/MuzJ/3mn3aVX/Ayr3U2Tg7mD4L:HGF9qBegs/Z3mq1AyrE2TgKD4L
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1368 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1368 AcroRd32.exe 1368 AcroRd32.exe 1368 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5b88de65f1e37c3d4969d47d551f9568_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1368
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53ff1c302d1c722e8e6c53ed85b4cc878
SHA12a4db05ad3bc25656994e02ff944f2c74e91d36c
SHA256335b70f14ab340e44d5ccb49030e5c03424f8fc429763c18f4aff114ecfdf67c
SHA51204d9b50c4beb2a4b17fbd04834ac11456a916b60e4262080bb8792af50ff79d116712b23db9b8c2e0417f9b99dc23f587d6ff76e80c28898ae930fe0cac58571