Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 00:30
Behavioral task
behavioral1
Sample
bfc21e31347cf14e5b6b3afa53a1032f_JaffaCakes118.pdf
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bfc21e31347cf14e5b6b3afa53a1032f_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
bfc21e31347cf14e5b6b3afa53a1032f_JaffaCakes118.pdf
-
Size
77KB
-
MD5
bfc21e31347cf14e5b6b3afa53a1032f
-
SHA1
73d7f9456099ae4e0d3d82ecf896514c7f418821
-
SHA256
3144cbda6f99ac69e7ba514e0cefb585465cb07f2d1b98dada642097c9c68c5e
-
SHA512
318c044156aacf1419589132e0a1066de5d42a93b783d6375062b716ec4e30793a86ad247854ed265594dfe30ac20c0e504a654339cef4b7b125ffe362b9ecee
-
SSDEEP
1536:WgDMx86mXbD4bQaTxl8AtmLw3aRNI5h7Tp+WRM4lVEu4ZWbpONQKxk3Hy:RMx9W+dtmU3akh7dYsGu4bNXki
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2268 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2268 AcroRd32.exe 2268 AcroRd32.exe 2268 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bfc21e31347cf14e5b6b3afa53a1032f_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5624f2ef899e971bdeb7283dae780f6c9
SHA1480e4ab33d5049146e7a2bda41a7c06a099f5687
SHA25648c6d969c5876c62a9d6e81973fb14f1ff3082914e307f8d91920ed0d0c77dc2
SHA51297a6454a60fdd584eb6a771e4335643506e780ab33c5ba0ff7e081cf90422854e33dbf7ddd229682a485d4aa07c95eeec9b8906ffbe4288d8e629b737753a15e