Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 04:44
Behavioral task
behavioral1
Sample
6d5eab827f79e4b1c0cbd5a29bcc9080_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6d5eab827f79e4b1c0cbd5a29bcc9080_JaffaCakes118.pdf
Resource
win10v2004-20240426-en
General
-
Target
6d5eab827f79e4b1c0cbd5a29bcc9080_JaffaCakes118.pdf
-
Size
59KB
-
MD5
6d5eab827f79e4b1c0cbd5a29bcc9080
-
SHA1
48b9e1234aacd4a714a2b97357d5a8f24c09128f
-
SHA256
06a4e794feee4b4d9a3ad219f759610381f7b4440dc70ba185bd05b70fe8e752
-
SHA512
a3a22da2739f88bc0f121b7f517af386fedb5c9c72bd944115773103133b067c619d3480a9c10941f225fead82391cebb94f9a34bacf54ce0c7eeb8d445a531c
-
SSDEEP
768:9gGzpDqXKkV1PqudXvskPv1oRh4n+hgHayYa+X5KhiyyAoJ9LvLxwZP0x90cg+U7:+GFm6Y1PquhhtuBLqZ8x9zRp261vyRj
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2168 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2168 AcroRd32.exe 2168 AcroRd32.exe 2168 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6d5eab827f79e4b1c0cbd5a29bcc9080_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2168
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56f483fb73d192591b920c43a889bf435
SHA1a3b340aed5b65a45da0e72061870108a133094c0
SHA2564c2b598a5c50be5d1a8a8d8c41be596a68102e4fd165d5cd1825c6f2303ffb95
SHA5125a40075fe2875515b2a37eb002c99634883cbb863238ee475b1c28d42d8cd55592717683c48193014e19f79dda7eba7f4f9e77909f16fd1ddccb0397cdacbd72