Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 05:42
Behavioral task
behavioral1
Sample
6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
6 signatures
150 seconds
General
-
Target
6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf
-
Size
60KB
-
MD5
6658dffe05fa248fcbf3509c57ff8649
-
SHA1
717b27b541d109aeba0449c87bf7aa7e354f39c2
-
SHA256
1ad2fd9d3b6631553ce4da5395d615b02a438215c1f0416dd7815dffb5bb1e4f
-
SHA512
f7ae09cd337e27bf7caa6a5e90cabc9e7043cee86a44636d918db86a490443b0ca8adb605b796662a94b489ef527952ad90655e5f2b5bd541f4a1717a5e54245
-
SSDEEP
384:bONbedw+DJ5LOXtwaX5LYPOi4hxdbBimPJ017ZlW+X/hEkgXf2EDEPj4iNlQoqqV:1
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2568 3040 WerFault.exe 29 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3040 AcroRd32.exe 3040 AcroRd32.exe 3040 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2568 3040 AcroRd32.exe 30 PID 3040 wrote to memory of 2568 3040 AcroRd32.exe 30 PID 3040 wrote to memory of 2568 3040 AcroRd32.exe 30 PID 3040 wrote to memory of 2568 3040 AcroRd32.exe 30
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 7562⤵
- Program crash
PID:2568
-