Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 17:22
Behavioral task
behavioral1
Sample
72b28e5f455fe5cb43f74bec2e028d0d_JaffaCakes118.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
72b28e5f455fe5cb43f74bec2e028d0d_JaffaCakes118.pdf
Resource
win10v2004-20240426-en
General
-
Target
72b28e5f455fe5cb43f74bec2e028d0d_JaffaCakes118.pdf
-
Size
45KB
-
MD5
72b28e5f455fe5cb43f74bec2e028d0d
-
SHA1
eb4badbd69116e40b858f7ba56464e175216ad12
-
SHA256
26c573e7901caa943c0c404593a6a6348b86a76c972c2c6d6516b7dbd98a5c56
-
SHA512
46c8abe5dedce349deed786cd0341b622a32aeea6309ba838c6649f1b53083154b451f6713e66725e476dfc32107a2e08ccc37413138c0d478a5a3276907b65c
-
SSDEEP
768:4gGzpD9GvrunBUGswP2NZtRN5ZZlYDaEGNIpK0keEbNgXyYjGHsOtb:VGF5KN5ZnY9Guc0keoNgljGHsOtb
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1264 AcroRd32.exe 1264 AcroRd32.exe 1264 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\72b28e5f455fe5cb43f74bec2e028d0d_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1264
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5abab7379bf5c1bfaa4d69c18ea8b1b98
SHA10bbeb25dda478de85582d61578a9ae19fb9f12a9
SHA25639c94dd7a60657c27610b9d6cd615aa252dfca1259b2e882f1ffbe0fbffb32c0
SHA51242c6700dc830aae57bf2c63bc15ad10da37d2162b033d34991f1449c4b64adfd82447565303333c1aede6350aac8892576584d238d8fe5138c576192fd13faf1