Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 16:43
Behavioral task
behavioral1
Sample
231513a764e68b5036ca64fb9e6aa7d7_JaffaCakes118.pdf
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
231513a764e68b5036ca64fb9e6aa7d7_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
General
-
Target
231513a764e68b5036ca64fb9e6aa7d7_JaffaCakes118.pdf
-
Size
76KB
-
MD5
231513a764e68b5036ca64fb9e6aa7d7
-
SHA1
80c99ba0f132917ecd51179b73dbc9d32b1e9a75
-
SHA256
cbc85843c34ad6f935ef815ea1f642a67faec03d80b1f608b3b3c2777494e185
-
SHA512
a08ef51f887ef0e199e915c1894a74fe840de1553412662eb50f52549e487cb2f6168cc94d2b043bfee6cc5c12d447d077f1a4ea6b82324267f0c1c141f7d92a
-
SSDEEP
1536:XNkRN8Q9RiAYrDu9q/jXtqLdURellawIn1WGpOK+vyuuWhSSrqE4kNf5K6:dELrYrK9ZpUR0WnqK+6u3ZrXx
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1732 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1732 AcroRd32.exe 1732 AcroRd32.exe 1732 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\231513a764e68b5036ca64fb9e6aa7d7_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d171532368cf5023bfb8364e9fabdbd2
SHA16fcaa2d7200ae9a28a8b25f34a53f57e5f2809bf
SHA2564f3af7395119a1569f8461dba6a2b4c78a014b3210e01a6be7f5d6f2ed917dc9
SHA512fe6c15d16100313ac53d5115b55b793845cf137f0621cf6dc4309c84cb6b827e111a99a1f2440ff229a8c0d1543b498fc36fcf287210d755b97105c709ca771b