Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 16:43
Behavioral task
behavioral1
Sample
4282a3ed3ac3c7be41227b1f3ac25d7d_JaffaCakes118.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4282a3ed3ac3c7be41227b1f3ac25d7d_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
General
-
Target
4282a3ed3ac3c7be41227b1f3ac25d7d_JaffaCakes118.pdf
-
Size
82KB
-
MD5
4282a3ed3ac3c7be41227b1f3ac25d7d
-
SHA1
d113fbe0fc8fda52ec6d9b07424940386a4ce124
-
SHA256
691333f5ca672b5cbe53812c9ce92e5095a312e479a7c057cb82b01b9ccc91da
-
SHA512
81e973dee1f174ba1292752e5ac90dfe0699f45df8048ee154b1fb1263f02962acb0e65f69336ac4b2015abd7e1b9e60776046e7dd8a842acdc9d17a3cc3a7c6
-
SSDEEP
1536:1e3Tz3mzDixReuNLNAXvHRdEw/+/JEDo+jRJU+WHpOvjazm0jbKWCnmhSubew:gn7jDLG/HRdb/+/J0HUOvOzmqbSul
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1436 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1436 AcroRd32.exe 1436 AcroRd32.exe 1436 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4282a3ed3ac3c7be41227b1f3ac25d7d_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1436
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD559d00aee8064aa7a5efed73006b5aa7f
SHA1db2ee21d37e5f7e009643db95f7d5f84551bfb9f
SHA256d74b1809db28d0d4cc44e44f6240d032d066c9047a1184215cf4c268dabf4d85
SHA5121e393d2ea3d1bb1a1a2c0ed527fe6c5d10da15005e445a64bfeb73ddff5e018d32a5459c162b232e80c335446f137cfd94f837e0b30d29e90e6938eb899c9b75