Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 05:57

General

  • Target

    fdebc80d92bad6b6001595fa389df182_JaffaCakes118.pdf

  • Size

    36KB

  • MD5

    fdebc80d92bad6b6001595fa389df182

  • SHA1

    4e350f55443cd03be9dc2cf2143315b444d78ce8

  • SHA256

    470be69ad268a1829753275fe6462ab75f37a2fc64b97c2e1d240a6b5bdcc098

  • SHA512

    65757cd078cf0b72e89aca0a03369a31d49edfbdfc386faccb4a6cc6b727eefa7a49901a741e5ef40f8659f222c88e7206e8c7c289d535527cb43a99e221afb8

  • SSDEEP

    768:cXuMZmwgCLWarRE5HpxFrZsSDk9nKuIaY/yMP/OZ29pHRp+EJeqE:cXFZmGWSyjFrZsSDk9nKuIavfZ29dRcN

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fdebc80d92bad6b6001595fa389df182_JaffaCakes118.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    7cd8b6c572f8fb572fa89ccb404ed35d

    SHA1

    96ff994e4a588bef8218517111474397a0755226

    SHA256

    5d6254f2156b1ef7e5a5a2d7eb650f87ce70d9d52cc53fb9f4968708123130dc

    SHA512

    8077278eced2145f4dcd6f57e65a1c799bd3ce669c6838a464bca3405e6722b3a28aeed77d2d19bd0c4da2bdb4640a4c7baeecec0991128aad4c58bc5038f85a