Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 08:07
Behavioral task
behavioral1
Sample
2b963e04db4fa626b300ecbbbbdba042_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b963e04db4fa626b300ecbbbbdba042_JaffaCakes118.pdf
Resource
win10v2004-20240704-en
General
-
Target
2b963e04db4fa626b300ecbbbbdba042_JaffaCakes118.pdf
-
Size
81KB
-
MD5
2b963e04db4fa626b300ecbbbbdba042
-
SHA1
9331655215af07fa1d1d3ac1e74781122e6e9c32
-
SHA256
f2fbae845f483376b471f0975157827d141103f84c9ba1be5f5290606c857585
-
SHA512
0580ddd3752713953916944332d5bf91ada6c133f82fb1be824aab3577612adbfcb8e6599c3aa474f9080f226013cb4dd60afc59b54703ec1e158dbafd5afb95
-
SSDEEP
1536:HpmL6Er6vrYqNrt2xb6M7KeIrSu1oo3OCWEQZYEq3kPcgCkqWwpOSu9J:mJ6drt2RxKeIrSu1oo3OxYEq3kUgCkdn
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2512 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2512 AcroRd32.exe 2512 AcroRd32.exe 2512 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b963e04db4fa626b300ecbbbbdba042_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b979d0469855181ebb6759e5fd7758a9
SHA133d592a0bc0c289f2e4e573cae7e5001492be987
SHA25656052a8cc401d19f61312dcb804d0e02d7c666a5d52675488f34386b64964e31
SHA512d73569cc6ed4cd80101fbe16d6da43e964b73cea3e54490b7a2963d3ef78d0d3cc5528c53adda20724042fa5c68ec10f8a4928c896846b7e3f0ec2dfaf4b482c