Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 20:00
Behavioral task
behavioral1
Sample
7a5836335223e931988581c455758d32_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7a5836335223e931988581c455758d32_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
7a5836335223e931988581c455758d32_JaffaCakes118.pdf
-
Size
184KB
-
MD5
7a5836335223e931988581c455758d32
-
SHA1
cbc6d32bb039bcf57f62df1fec7fab07b8c11c7e
-
SHA256
f68dbc00412a3a494a846683221e3905c8ece84c5aaad0d1139d78905e3872bb
-
SHA512
f519c7ba51dfd162a6c8a6f19ca1f2530eb96382aa10fd01fcc9d656c54438643c35a509d81d73309a18c231ef72aa0c6a798439b406bd988dbd523c9e1b726a
-
SSDEEP
3072:v2irbxzGAFYDMxud7fKg3dXVmbOn5uo6KjnyCslTvJ4Ti9feyNwaHS7:v2MKlWQ7Sg3d4bONRslT3RY
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1772 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1772 AcroRd32.exe 1772 AcroRd32.exe 1772 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7a5836335223e931988581c455758d32_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1772
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e2770fd960d1d3bd74bb7287ac3f0229
SHA1fe2c966685e72a4918286165e29ac3f8dea1ec59
SHA25674807770a217183fb8e648f92ca9e1f5ac64e4680f9acd6619299e87205e4950
SHA5128e51b3b2be42c78f1d749638f99e12e6034d64cea7858cb0f3d70ee1abf509dc63b6dc35a5106d57ab0ca3096a89b05da732d9e9458053944d4bdebc0e1e13d6