Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 02:03
Behavioral task
behavioral1
Sample
b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf
-
Size
84KB
-
MD5
b9f0c6b270f953fbbfdda121b405e648
-
SHA1
3e1c18241b864a854197602b8be53f3902446962
-
SHA256
2b09e186f856f2486b69d3c9f3ad16e2ed52686fbc9c88743cf76d50e473c19f
-
SHA512
83b3bb2bf2ece00861646da1058a08a1c29bc31727961e52400393af00bfd446341bc7491b6f3032d8cef1cc167e4948feadb4a890b35d5b28a84b0803ac8815
-
SSDEEP
1536:hbJxbisWacQPeim9bvPVDFD+l9yF8Z4+PSPXz3zW5bq4WB2+qDZW6pOu2iLCGi4+:FbhcQGHLIGc4SAzsehe6u2sCf4RM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD596c9046783fbda19cbc3c152f43e1374
SHA1aa906dba11397e6cfbd6ccbfc7a17be782dcc45b
SHA2567d6102c3e0eab9b89ba2c28d9474cb9ba1af598031bbbed0e50a87551f27b875
SHA5126f16531d214a94355694efbc010388a9de05747fecb691d285a31f233759c2fb5d4f1f8d2c58298433b5a0555dcce6864f6bf222e3e16c958443a3b3a332d462