Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 16:05
Behavioral task
behavioral1
Sample
fca86e26c200e7ddf741e5ccaa1f7fb9_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fca86e26c200e7ddf741e5ccaa1f7fb9_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
fca86e26c200e7ddf741e5ccaa1f7fb9_JaffaCakes118.pdf
-
Size
107KB
-
MD5
fca86e26c200e7ddf741e5ccaa1f7fb9
-
SHA1
7ea71d1e364aa0b0bff7c5b1ab73a316bd6a389d
-
SHA256
3f060c72bd6085a19c950669c65ad1125c3f9a578ac26e57817751709aead821
-
SHA512
a399f89c70747fdbaec02f0cb889001a04347a1d5b039271a4020a9638aacd7671bb7b99fd8a2477ce5f4e133226012cab670d6606527f2e06a187b8255045f8
-
SSDEEP
1536:hdA0sjldF4n5JQ5ewIJP9eujnFGBzxodpnRICWIirhcWJbp27W3jZ9ZphW0pOdHM:AVlUcI/eujg/u9RIiirhZp20Z9ZpUds
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1016 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1016 AcroRd32.exe 1016 AcroRd32.exe 1016 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fca86e26c200e7ddf741e5ccaa1f7fb9_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57344c72dc9a1d87b13457af778dcc0cb
SHA10c303444a2924293b0ac293c92064df760daec18
SHA25659f2cbab6e6dfb9121c324e6ecdb4b9a1035904d5c3dd88208daac6d29dd87bb
SHA512c2c949961085c7d6d7aac0453f8402b78ac8fcb442bee971a2f6cc04a84ec7090b0698ae4af10e1158987c8e1ac6c2daea13beca89db73edd008744a1ecad80b