Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 14:15
Behavioral task
behavioral1
Sample
9af1e4da48014f369ea1c4e2dced4324_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9af1e4da48014f369ea1c4e2dced4324_JaffaCakes118.pdf
Resource
win10v2004-20240426-en
General
-
Target
9af1e4da48014f369ea1c4e2dced4324_JaffaCakes118.pdf
-
Size
55KB
-
MD5
9af1e4da48014f369ea1c4e2dced4324
-
SHA1
cb7f5c82ec455e1d4961cdea8e70c4179c407d9b
-
SHA256
f1056cbad957a0f36e404e1b8078c3367c15736d12c4279aec4292470e36bb3a
-
SHA512
9b678643b53248ec7ec99e58a99e6f6c4467752c55bebac30408b73643155943f0dcbfdabad46920f266c066774d62416238b7ba1f8b4038ee27acc1c7c91c94
-
SSDEEP
1536:G5x819sVqJegla4t+G0cawb1zqvHXj8VoWhIPdXD6PrO:kx88XgQg+G0gVuz8VovPdXH
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 844 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 844 AcroRd32.exe 844 AcroRd32.exe 844 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9af1e4da48014f369ea1c4e2dced4324_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:844
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD576b20a00276189637a3ce1ffd731e962
SHA1cb038599943431733dbada4bdd66bffa638918a1
SHA256d8d536ce50e080dbedc3feab4a94cef4c3b4b48e00371ce9fa666c72defb6024
SHA51253be1defd088d31b4f122742147f1956a8b6ffa7afe4abcb2986f829e25d646eb572054f921a033eed58391f5c14d327ba182c114d6b5de9e26184bf9f9617e4