Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 10:55
Behavioral task
behavioral1
Sample
AS SC-5143 - EPP 28528 - AS EN - TRUBIN - AG - 13022024171631 (1).pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
AS SC-5143 - EPP 28528 - AS EN - TRUBIN - AG - 13022024171631 (1).pdf
Resource
win10v2004-20240226-en
General
-
Target
AS SC-5143 - EPP 28528 - AS EN - TRUBIN - AG - 13022024171631 (1).pdf
-
Size
383KB
-
MD5
6fb1ef3672158c60e75fb63baafa32d8
-
SHA1
8f3389ee6ff277e4dbe78841247b6859bbf7b83e
-
SHA256
99586589e07860e0e5208ae79ecbd2aeb78e9ca30116d4b1701066f62f1ed020
-
SHA512
75807a9d8a435757af0963ba84aae09014c1f4af15d1999a49473d7a949a3fdfc1692695cd8490f0c36e11152ee21d330efd225fcfe1b29bd029cc7f3cc909ad
-
SSDEEP
6144:IUl2kNKfg/sXShQtfc/fzV6vWk1aTP7GN0BSU2:5l2LXShMsfzMOkITPK02
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1644 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1644 AcroRd32.exe 1644 AcroRd32.exe 1644 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AS SC-5143 - EPP 28528 - AS EN - TRUBIN - AG - 13022024171631 (1).pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1644
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c5392f5ea5f0e3d2832d034e421f667a
SHA17065a2b1d4d652121e3f1ba08be8360b3b644470
SHA256d369d3289e678194314cc199211ff347f5bd1db9355abaa8b0d06e6482908b41
SHA512dc2a654a218b07ed549a8a465ee7e463a20c7adb4164df15e554cc8d3ca903a1b0fa8710dbda53f0b343f9ec141c1839e87224f3ed62fc87bf9e434fcaa5a93e