Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 01:35
Behavioral task
behavioral1
Sample
82a984f8c30b4f8bd37aef9190bd217f_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
82a984f8c30b4f8bd37aef9190bd217f_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
82a984f8c30b4f8bd37aef9190bd217f_JaffaCakes118.pdf
-
Size
43KB
-
MD5
82a984f8c30b4f8bd37aef9190bd217f
-
SHA1
e8de640f50cb3e6f2c716d8dbda403298b281d36
-
SHA256
40bec42697be68d626aac0d2890ee1594d87a75500eab2442611dc47a181b07b
-
SHA512
36f204b64754b470629d856bbec94b8105288b2f56757daa5e7a48ff9cf4e4772d2ea057ae5f044dd8ef51bb6b73c88e855b8785ccaa89cda45349626dca4d80
-
SSDEEP
768:HgGzpDjp4FHWFvPvlVr4PSabNf3m7/ijirLzIiOFVdd+fBwBWVz0JVT1n3Jxd2Vn:AGFHpv7K+LzIIfBnMTdJxd2Vn
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1656 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1656 AcroRd32.exe 1656 AcroRd32.exe 1656 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\82a984f8c30b4f8bd37aef9190bd217f_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f59e3e723c7677dd2ca3be65640ad793
SHA1aa75b6780281964ae48b92d4e7c4ee8a12e0a8f0
SHA25606c53a5c76405d339d67f51ea9ae0ff4976def0f2f27747591ad3db6ec2cb762
SHA512c2f4fe2758ca2c687c42d63284c2998af0f0ce1dad97e7005f54cc59e67d65f30cbcddf0dd3c9a2f605d69fd9bf0f5a6f9fdbdc02455369fd8af630c94cd19f8