Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 22:36
Behavioral task
behavioral1
Sample
ee8f075ffdc1e77a414a472ef66ccc40_JaffaCakes118.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ee8f075ffdc1e77a414a472ef66ccc40_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
ee8f075ffdc1e77a414a472ef66ccc40_JaffaCakes118.pdf
-
Size
46KB
-
MD5
ee8f075ffdc1e77a414a472ef66ccc40
-
SHA1
cfafb384f5d010de179ece2019ede54b7dcae813
-
SHA256
4c6936108c10b73a94d1f762587ab5d4445f3ff4885b3147cdc40358acf281b2
-
SHA512
34ea820f89830ca08d0d4048afc609e8f19689ff87eeaebf521e7c10a41ef40393444dc569f176bab7c757c302c7f86a6aab5ad7b0c0b0dab26fbbd8011f1a19
-
SSDEEP
768:lgGzpDWw6grnNpWtgLxr9xt4QSZaENSmP8ipo2ZmVr0HBP9b0F3OE5Ho:2GFK6LWZFNSmPCimeHBlA4E5Ho
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2276 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2276 AcroRd32.exe 2276 AcroRd32.exe 2276 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ee8f075ffdc1e77a414a472ef66ccc40_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e3ee78f4e06c2d942d90f7293756c1a4
SHA16bf975390e14ca52c52bd34bff9b994bad91c261
SHA25664415047ec025c3926e92a0546e72fde1a032b10a441610d770f237a16814118
SHA512787b13785c6103e533db4bb1c3544efa6769eee7acba32de34dbbbbb91deb005eef31cbb053ef6a81dd96237153ff37a2a09aa93871c89eb027ed6dcc9de06d1