Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 01:17
Behavioral task
behavioral1
Sample
ac5f09cb7cdaef248a5a0af6cdc0f224_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac5f09cb7cdaef248a5a0af6cdc0f224_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
ac5f09cb7cdaef248a5a0af6cdc0f224_JaffaCakes118.pdf
-
Size
46KB
-
MD5
ac5f09cb7cdaef248a5a0af6cdc0f224
-
SHA1
fe430b40dc3886494df9517f974c670062d0bb5d
-
SHA256
78b757dc3e8a4ec12cd99d5c0a1d1aa8f6b4ee2abe0b9c2d846feacd3107c4b8
-
SHA512
a0ce8bb7217be1433563b3f99337e8fb2af07c0bf5aeb083a8544dcdf909e2155395a9d53df960c46ed710830608a6a5dff1eb63a1fd3dc9d548fe92ce1465bb
-
SSDEEP
768:vXuMZmwgCLWarIE5HpxuHdaa+GOc8Rai3Gte9B5coYwstFCHnnp17X+GLQj3h:vXFZmGWShjuHdaa+GOc8Rai3GE9BjPsp
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2156 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2156 AcroRd32.exe 2156 AcroRd32.exe 2156 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ac5f09cb7cdaef248a5a0af6cdc0f224_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD519e9f63b086ccadf9d3906aed0238fe5
SHA1c358a40a20868dc4f0eb5c2b8b39fb61dfc10607
SHA256745526f2b7ccd61f6d468603cff0073e03f4623a4c09ba98ee96920986fb1407
SHA5129cde2511994a618b5f1490f1034cb32d177c6590c6e3b6b5040cb6161c1970a0108cf4886fdb03e24627ea002f026a64c44089c9dbba785dda8448f07545c7d9