Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 08:45
Behavioral task
behavioral1
Sample
74ecacab7913d6b41e0ce4725ff24030_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
74ecacab7913d6b41e0ce4725ff24030_JaffaCakes118.pdf
Resource
win10v2004-20240426-en
General
-
Target
74ecacab7913d6b41e0ce4725ff24030_JaffaCakes118.pdf
-
Size
42KB
-
MD5
74ecacab7913d6b41e0ce4725ff24030
-
SHA1
7529d9e24ff2d29507c825e45ebf36cca7fe8aca
-
SHA256
6f6210a06660d729cc7797acb6492fb49cfc53cc75bc4c10715c87eed0ffb7bb
-
SHA512
90d06ecb08096ab077cc3a3517eb35dbc6d05c9f7620e4aabf8da9a6ed50bf8aba02c86c8372e048cad04ff2ab85599ca161876e0e8c6531281dc848b1a18066
-
SSDEEP
768:/oHDksOf3R+8mXAd0bWLttRYwMvDnZYsWTd/Yl/lyIehK9TBRIXCPTHkLyOk3q1a:/KoI8Aa0bwP6wMbiBTd/Yl/lyIehK9TV
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1196 AcroRd32.exe 1196 AcroRd32.exe 1196 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\74ecacab7913d6b41e0ce4725ff24030_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1196
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bcd24cf7b8cb23834aa55239bd909d6f
SHA10c91b3b09b66faf7ef763072af6198850fee536d
SHA2562111ade0de601429ec00e123ded579f504b917de1aeb39e806247cd862152cb8
SHA5125cdbb5f9e468ade67c9e0fd07314754a5994d80a0c7d7cc33e48dc66046bdbb191eca1066654960af746c1937c6a455fd88fcaad8bfc244615f9dc3ac866199a