Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 23:26
Behavioral task
behavioral1
Sample
9c4a87095daf2a95c288a5ab73e6d824_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9c4a87095daf2a95c288a5ab73e6d824_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
9c4a87095daf2a95c288a5ab73e6d824_JaffaCakes118.pdf
-
Size
165KB
-
MD5
9c4a87095daf2a95c288a5ab73e6d824
-
SHA1
e172d7a88a08bb307d5bca2182c8ad29ea761478
-
SHA256
6b3888d8fe8256cef9a452cc4f22a37efa806679d462febe469d2f8a24b4dd2e
-
SHA512
33e6dbcd41ea38e12be742f5cc9d88e01b622294e579f2f335eae475c93d881755190aa074e90288fa47f6bf1dbf5f2b5db6fb518b106da43cb1d81861e2de94
-
SSDEEP
3072:Bys76ZWVtOOWRsjjuPTT78sZxE/edCP4cjBdv3kbZFIjFv2uVBiVaxtXbVJSZlB5:g47OkGPTEsZxboPLdPuZFevdCkXe
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1664 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1664 AcroRd32.exe 1664 AcroRd32.exe 1664 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9c4a87095daf2a95c288a5ab73e6d824_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD524c42ebb0de8d3df8e6d4bbf490636a2
SHA1db76c4a2426576506605a51ed34719a4d006b9f4
SHA256c11d563857f5c4bc3082f04f3fa4dde3bd376600fdfb97df481a0403caa7349b
SHA51263a51f59cf65c08872e6c79a1bd188d81debfbd5367343df2f1664ecd075f4d7747ef8a4a1f5cd9da0075c354bf7e64cb9aeca528e6c587196ae7b4217a3a539