Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 22:42
Behavioral task
behavioral1
Sample
36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
6 signatures
150 seconds
General
-
Target
36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf
-
Size
15KB
-
MD5
36b0d5df899ef8596f5c68c494e7e2fb
-
SHA1
7cc9c182d30715da5388f5d442d3002bb57abad6
-
SHA256
a2384d5683d1b9b7bd44c5fce809966c020b60faf6c03aa4c5be15974eba0bca
-
SHA512
a8dde7fe2520f44f69d9289f0eb2243df66941f5a54fd03cb9c8e92965ce18d30bef11b2c2cea7a7d9603b554e809351bad959ceaac1027c350065df0b332db3
-
SSDEEP
192:4ONyCeewIjJizsONJwm3IbKo8TJsA++cGz1lhrnJkZXKSYdC67L0SahOgEv:4ONyCeewIjJizR43UTvvkZXKqQgEv
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1832 2524 WerFault.exe 29 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe 2524 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1832 2524 AcroRd32.exe 30 PID 2524 wrote to memory of 1832 2524 AcroRd32.exe 30 PID 2524 wrote to memory of 1832 2524 AcroRd32.exe 30 PID 2524 wrote to memory of 1832 2524 AcroRd32.exe 30
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 7522⤵
- Program crash
PID:1832
-