Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 05:21
Behavioral task
behavioral1
Sample
9747b9a4dbca5c0acc7e4a356379ecb5_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9747b9a4dbca5c0acc7e4a356379ecb5_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
9747b9a4dbca5c0acc7e4a356379ecb5_JaffaCakes118.pdf
-
Size
45KB
-
MD5
9747b9a4dbca5c0acc7e4a356379ecb5
-
SHA1
0255b72d38ef326dfba57c37a748ab0a4cd17eee
-
SHA256
77cbc5551f3b32f3e1e1b83e64fa2c30125918f76f7986f96ebfb419c1f0d1ac
-
SHA512
528060a6d8d54d7538923a3cfb2866fe32ddf0ddc4b6da6d3742a0641b75f7c922f3cb2d368a83ddadaa325aa69e2cf2dbf8799add6457fdf71bf1168ea7c33a
-
SSDEEP
768:N4s+DN4XTqAWRh+2HJ+b+1D/KLlE++zCZukJDRRxEbIpN9L28YpK9NBWaHE5RXuj:N4yXTq3Rh+2HJ+b+1D/KLlfZuEVEbIDB
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2648 AcroRd32.exe 2648 AcroRd32.exe 2648 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9747b9a4dbca5c0acc7e4a356379ecb5_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2648
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bf995475dca700d940c880ee8431e509
SHA1baebd51c8c8a1c010fce99d44510077b6fc4f8c8
SHA256fa641c657692a2fe2efefaecf7860e92c17c86c579ff4b9eb7b27d590e45ffac
SHA5128586eeede9d0570ed4ee3db53d7dfcd4cefee4136b9554f2cb4140f990cb0af7020b11dec62d5431e026274539d09332d90afe5a318d7192c4a9ce7cd7fcbe1a