Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 18:53
Behavioral task
behavioral1
Sample
818a0f50a56e0f3534b5a46e81ec7b70_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
818a0f50a56e0f3534b5a46e81ec7b70_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
818a0f50a56e0f3534b5a46e81ec7b70_JaffaCakes118.pdf
-
Size
43KB
-
MD5
818a0f50a56e0f3534b5a46e81ec7b70
-
SHA1
5ad4fc6e306ba9d6d5c76a1d10dce06f61b5a849
-
SHA256
9bac130c82e9b382d0ddc2aa7c35da00e9d1d4fe53923d00526a048b589beeb6
-
SHA512
f57455b579e15762e573387d71c28638799e44db65d07290cc6f0397f83858ac6f7972c4869556fa6c6e60165e89b7745abd97aac488cb8614bb3dc014197a09
-
SSDEEP
768:ygGzpDLvq09DdlGEo5lZg4HmFMozuhl5+aZUUKlkEwZr2HUc+6pigOHr7HO3DXM6:vGF/vRRoXiYmRzuPtCl+6pigOHr7HO3V
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1988 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1988 AcroRd32.exe 1988 AcroRd32.exe 1988 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\818a0f50a56e0f3534b5a46e81ec7b70_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1988
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59cae21d41ba8b3bc5e9eb0b1f3872532
SHA151fb4eb8cf1fa7ff56dd9595ffd22641f204eb57
SHA256e92c1e58452d6b114e7f7e45d0b496f58e3d13e689cf11a973b92e2ea0fc7c89
SHA5122d475d1842ea701b564df69dd5fc97872f1f5a4f6310503778e1a2e6582b999caff3a3f7e69b6a17a6ada0c49af12a9325e91f032ca11f0dfcb08b3e3135cada