Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:53
Behavioral task
behavioral1
Sample
2e9811a56492f52fefc5b5c46f62ac0a_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e9811a56492f52fefc5b5c46f62ac0a_JaffaCakes118.pdf
Resource
win10v2004-20240704-en
General
-
Target
2e9811a56492f52fefc5b5c46f62ac0a_JaffaCakes118.pdf
-
Size
85KB
-
MD5
2e9811a56492f52fefc5b5c46f62ac0a
-
SHA1
2e774b35a11a11866b601f54425badc00f362e4c
-
SHA256
6f037b6c87753bf821b1bc4e94b81c6a2a56593ae7f27c8f6c7fa376ba6c6de0
-
SHA512
af8f2b9db676a84e10276749bad688d3f33e8c18be85df50673fdc96ba6e9b601264cc7beab20c422fdda8d418a5eb0826ec0ace8f5edab175180295616585a2
-
SSDEEP
1536:dK8fFZKRFrLO0OIx1GoC+7iNoTJ2LiVWKjWapOtQTjaWDpFruTBAWMr:oIyRIs73dTJ9VMtQTjnFcBAf
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e9811a56492f52fefc5b5c46f62ac0a_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1648
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54bc7c2167d18ca0cb5285b78cab14f4c
SHA12c8d9a1bd6f1f3e92440a844523f9c67cb6edbdb
SHA25600a99175cd2234edbe30ffb247dcef60785859d7e6a850deaeff371f56fb29cb
SHA512b635b6456f42730186926d5854bf06cfe1815f637f43fde9c6fe988294eba6f5d0a27ed326a73df2b7d039c10cc000c3ea47c7d353a014192d189143ad2e0b39