Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 22:37

General

  • Target

    c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf

  • Size

    404KB

  • MD5

    fa7cac432d4bde90f6ed0f67f2d27ca0

  • SHA1

    1c6e1405500ad967cfdf0342ba618f14726d3307

  • SHA256

    c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8

  • SHA512

    2c51489311d50ee7b95c82ddd6e75afdc9715b5399c66a32edf62fff2e84f6d4766f8846f937706d6c5418b0c745ce4c98b278f90e43901568641236fcb7b5f1

  • SSDEEP

    12288:p5LLd4QdwWsTX4i4PHpAQbeV40Vh5bhcrCBiH:7d1dlsj4p/CQw40V35I

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    25644875fa3a2f114d1be166920d58b9

    SHA1

    ff0960809ea41639c815cf8e0e8e2790cb2dfdce

    SHA256

    108e6fb180c6a9ae0fc51b5b79721e2044e593e8134cbeed5296243da165e600

    SHA512

    ee1b955a92931ceb6cee4cd52c2c782899d13ef1eaf220c642e4be0d8100d2b70485558f2f88fac50741d3aadbeaf77f7db7222e93b7b9e2cee7e0b1a17f8559