Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 07:40

General

  • Target

    fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf

  • Size

    42KB

  • MD5

    fbd057c43bb4a917e4e879102cb6fef2

  • SHA1

    4f7ec9c4bcbf29ac710e52af867d30fdff3c0a17

  • SHA256

    390e775163faaec33da7c2fd55f7c5dbf25612fb31ea2f75e8574872caea454d

  • SHA512

    e22ca2b302afbf90904d37a6640b8c09419447ba64220b38dd3943a60cff0d09a4ac9a8294de377a214144e6c81b93ef2c79cec80bc8dfcf685846d3174fb3bc

  • SSDEEP

    768:wpgGzpDRpvb+K0OCrCaPyNyixLwt+fP5mx1g7erkBKqEuHxGlMB41iOwFi3Xx:jGFtpjDLI1NoBKdAxGmB41bwM3Xx

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fbd057c43bb4a917e4e879102cb6fef2_JaffaCakes118.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    23dde294acbf08f5dc48e2a908a3b859

    SHA1

    fe1a119394bd6ac4a16f7a4e557db84e77b882c7

    SHA256

    44b19c96599de84c51679d1bf3d7bb236a7eaa5acac5e59857691e069c8be55a

    SHA512

    0368ea883abd806b500ae9ad471384eeb037f60082dacbe21a4f18e123d4b742e46f99863e9b41ac5b2cca3c908dbb05452e0b14e38b86d7162c184b2a5c4ae5