Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 16:16
Behavioral task
behavioral1
Sample
aaa1f902c26f807e2ca6e044603f00df_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
aaa1f902c26f807e2ca6e044603f00df_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
aaa1f902c26f807e2ca6e044603f00df_JaffaCakes118.pdf
-
Size
37KB
-
MD5
aaa1f902c26f807e2ca6e044603f00df
-
SHA1
786ecb646861e4f7b3e24001ff24f332e07d854f
-
SHA256
307ba6399d6bcf04766e00f2038b40904eb72278a943045fb5d9e2e0e06f6cd7
-
SHA512
7a61ecb5dda6ad262a83ab2ff7d7054ce8ad18cdf5797584da94a43aa5d1f0ebf3f0b5615a609467c1a43ed0f40b40d8d0a8cbd96d53fee8b7cea512c91d2eeb
-
SSDEEP
768:NXuMZmwgCLWarLE5HpxYScYv9jmkyPjq5VuNdXMcjGT+wCpEsxDqL5XEXoo1jtVU:NXFZmGWSEjYScYv9jmkyPjq5VuNdX5iz
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1688 AcroRd32.exe 1688 AcroRd32.exe 1688 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aaa1f902c26f807e2ca6e044603f00df_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1688
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a950bdf797900f7ea35f9a1668872887
SHA112b40d18075cfe04790cbc584442f9e99c7fdbfc
SHA25613b9d2b2dcc07fe1438be9966b9ffb2dc168cbdf4d97cdd1bf6aa4e56b67b896
SHA51261037441691994c5a0d8d45ae2714c9e9367ed855a7daab43231854b24337a12e58158023dc14f6e7f8f99c7f6a1cdf159e29087277d5cff40cc8d4e5f8413da