Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:23
Behavioral task
behavioral1
Sample
48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
6 signatures
150 seconds
General
-
Target
48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf
-
Size
4KB
-
MD5
48978a78b999a803ca794f02f3bf22ac
-
SHA1
1b3e3f545038575c85f13cd2c1816e8872905b8c
-
SHA256
3d098273531877f6bac89d07c1a5041f052c4371fce28588d25bf7825bc33c76
-
SHA512
31c029d2dd23c0552f13e15514a24ea7aac839d840eb46308e84414938c2b4da2195361da269b1304cecdcc5277b0f2c970e84223efc1aaa916ba4462ea9d8b7
-
SSDEEP
48:kwc393agTagNzgxJ9OWDO7zlfo3qk6Lb3xy51BfD/5de03WGd1ryi5QjSi5uQ66B:kwcwJZ8pdk6v3Y/e03p+wDTI14Rr+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2844 2232 WerFault.exe 30 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2232 AcroRd32.exe 2232 AcroRd32.exe 2232 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2844 2232 AcroRd32.exe 31 PID 2232 wrote to memory of 2844 2232 AcroRd32.exe 31 PID 2232 wrote to memory of 2844 2232 AcroRd32.exe 31 PID 2232 wrote to memory of 2844 2232 AcroRd32.exe 31
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 7642⤵
- Program crash
PID:2844
-