Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/06/2024, 17:14
Behavioral task
behavioral1
Sample
bd738a212665f464a725fdb0657b8b8c_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd738a212665f464a725fdb0657b8b8c_JaffaCakes118.pdf
Resource
win10v2004-20240611-en
General
-
Target
bd738a212665f464a725fdb0657b8b8c_JaffaCakes118.pdf
-
Size
34KB
-
MD5
bd738a212665f464a725fdb0657b8b8c
-
SHA1
ebf43acf7f5e272b70d45128eb3973f0dcc03622
-
SHA256
4593005f26fc379ba40375d51a9b8bf837e9edae21af63c11833d55245b6eced
-
SHA512
2c90fc6a85ca5476aef075097a9c1b3dac2d8d6b2aba102a47f450e381936e9ad2e3bf0b13e80eb69c7bf00bd50e846e74098c4592cc55b80ab062bf7a253a31
-
SSDEEP
768:IgGzpDup5xhiC2CMNoe1OGcbErhq4JEMP9W9xAudHPLH/7OqRPTaZ:FGFKpfbU/GmW9zdHPzXbaZ
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2964 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2964 AcroRd32.exe 2964 AcroRd32.exe 2964 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd738a212665f464a725fdb0657b8b8c_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2964
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD576e1323c0058fed177d812fefe12a2ec
SHA1988f6ed1ef5a95fa8165a05ba37e8cf535e8e567
SHA2565972520b54836bb96cd3020294aedf6f5a086c42cbcc73c1ef63bc04dd890069
SHA512c9587fafecf315fa14fce910164126bb566e5a8b728267d944837e0c601fd2ccaa4c3a0c4c86e989bc5b32287a4a75a1f2d2da30b8b08338779aa37b2be0ac4f