Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 18:39
Behavioral task
behavioral1
Sample
683bb5dd15781cdd39199a21d42127ba_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
683bb5dd15781cdd39199a21d42127ba_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
683bb5dd15781cdd39199a21d42127ba_JaffaCakes118.pdf
-
Size
39KB
-
MD5
683bb5dd15781cdd39199a21d42127ba
-
SHA1
a1afa7cf48c5dacb7f44ac9c5a0afd0ab4f528f0
-
SHA256
abf7c4738c3f2c28181d0c794cf810775a1b4a350631b3aa53b03210ffea7305
-
SHA512
870213f08a0d166be50e4ef99d9c09bda1e2359badc8342b871571938fb7ff47dcd8086ed1c867a59e2acc4c8e4da69af59747554559101ea92ad8207f8585e8
-
SSDEEP
768:sgGzpDoba++hdAt8YXjk8B+1omTsKVE5l4v7cLjOFJerD+jlgKNSPWV27LYKrnVf:pGFErAgKV+lkHerajlgKtVM9nVf
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2528 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2528 AcroRd32.exe 2528 AcroRd32.exe 2528 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\683bb5dd15781cdd39199a21d42127ba_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55e08b14d83fe5c1868573aa10d04e6e5
SHA1abddcc30e95512e6c12ae08f33cc8e04a95b714b
SHA256bc62c022252fe44b8e2e04e0ef036bd4b8a40faaf8abe014d4a2db7ca8e98877
SHA512365308c7a65619417ec5c80eec08c31853b9a8da52ed220833e6090318e5db6f70411d9889c9217d1a9ff378ff2e569dfbed4508693646c042ce2b4632eae32b