Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 07:40
Behavioral task
behavioral1
Sample
fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf
-
Size
42KB
-
MD5
fbd057c43bb4a917e4e879102cb6fef2
-
SHA1
4f7ec9c4bcbf29ac710e52af867d30fdff3c0a17
-
SHA256
390e775163faaec33da7c2fd55f7c5dbf25612fb31ea2f75e8574872caea454d
-
SHA512
e22ca2b302afbf90904d37a6640b8c09419447ba64220b38dd3943a60cff0d09a4ac9a8294de377a214144e6c81b93ef2c79cec80bc8dfcf685846d3174fb3bc
-
SSDEEP
768:wpgGzpDRpvb+K0OCrCaPyNyixLwt+fP5mx1g7erkBKqEuHxGlMB41iOwFi3Xx:jGFtpjDLI1NoBKdAxGmB41bwM3Xx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2936 AcroRd32.exe 2936 AcroRd32.exe 2936 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD523dde294acbf08f5dc48e2a908a3b859
SHA1fe1a119394bd6ac4a16f7a4e557db84e77b882c7
SHA25644b19c96599de84c51679d1bf3d7bb236a7eaa5acac5e59857691e069c8be55a
SHA5120368ea883abd806b500ae9ad471384eeb037f60082dacbe21a4f18e123d4b742e46f99863e9b41ac5b2cca3c908dbb05452e0b14e38b86d7162c184b2a5c4ae5