Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 22:22
Behavioral task
behavioral1
Sample
470856a69241bbdc9a647ca9ff100a22_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
470856a69241bbdc9a647ca9ff100a22_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
General
-
Target
470856a69241bbdc9a647ca9ff100a22_JaffaCakes118.pdf
-
Size
65KB
-
MD5
470856a69241bbdc9a647ca9ff100a22
-
SHA1
27f26b98d0242bc1108f32e315d3db95209f9cfe
-
SHA256
4e96d3251b180a4e1bc3a7b1012d3179c6519f87c61da434bbec8c6bab2f1254
-
SHA512
2af1bb41ca7f791f220bfdfa9616aa681f39bc9ba536a1be740d6c2a09273801970b121abb2212f14812e41cd0d12dfd32265f8b949342fa336350116a1fafbc
-
SSDEEP
1536:ZEySGNOFT1QmqbIKj7zJ6pQ49OddR1RlzaM9Ttd6:iRTTKj3QpQ49OPRVzaM9K
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2520 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2520 AcroRd32.exe 2520 AcroRd32.exe 2520 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\470856a69241bbdc9a647ca9ff100a22_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD529bc0c8d0b2ad3b86d938d2af20281cc
SHA12d3fda893e159aa74686e62ae07fdef5099b5109
SHA2563e2adf04119fd75703313a38b9ec6369585ac7b9c90b92b28eeee9d778d73728
SHA512cc7e5604f21a61d1bfbee9bbc73c727724fef9b5a49f0e2d2ea61ee0c2c3f3120a285bf40f79adf6e3b82cbb8351b91864a7e64fd54c6f7df73cc37e2f52a796