Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 13:57
Behavioral task
behavioral1
Sample
f6292c399f2b1bb1d73081e88d0f037f_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6292c399f2b1bb1d73081e88d0f037f_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
f6292c399f2b1bb1d73081e88d0f037f_JaffaCakes118.pdf
-
Size
106KB
-
MD5
f6292c399f2b1bb1d73081e88d0f037f
-
SHA1
a9a0f16e5482604f7a48a95c8336c22a83bffac3
-
SHA256
a56560043eca847149a00b6f6a69fada3509ba80cb80a40cf63bd827891c6cb8
-
SHA512
19e0d78dea228ce9001e71d55b35dddb2a02b9489146753a70ca7130263427b874e2b2d7719753d785b5ea47c68eed1bf3a42c1f6cb0cb960c337ae2d17fa3a0
-
SSDEEP
384:bONbedw+lJ5oXraeZQh6c9S/pdG5EW9tad0L2e0at0aU7mLo6clyqeRu+UWmdtMT:J
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1784 2060 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2060 AcroRd32.exe 2060 AcroRd32.exe 2060 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1784 2060 AcroRd32.exe 30 PID 2060 wrote to memory of 1784 2060 AcroRd32.exe 30 PID 2060 wrote to memory of 1784 2060 AcroRd32.exe 30 PID 2060 wrote to memory of 1784 2060 AcroRd32.exe 30
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f6292c399f2b1bb1d73081e88d0f037f_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 7602⤵
- Program crash
PID:1784
-