Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 21:39

General

  • Target

    0c8eae9093df4d1c394c8ef6ed8d8ec6_JaffaCakes118.pdf

  • Size

    81KB

  • MD5

    0c8eae9093df4d1c394c8ef6ed8d8ec6

  • SHA1

    1d7881fd7b1ab838adfb563e5159e9b535e8aab9

  • SHA256

    56490d4e0730d0cefc11b04f36e1d511f89d4e0a633746dc80fe1d5147750dbc

  • SHA512

    d2cd985ca0198f77a75c9dbdf185b4f601f11eea42e025452f20bf92aa4c0d5ee01fe8c1233c158c0aeac02a859e8b896c1fa89bc7538791c917c360258de4b4

  • SSDEEP

    1536:v4OXLnhXFDB7aQXzdY58+YYBvYwxC1oaD5GduPUrMxW8pO73W4d1vsGK:QObnZFhJXzaauqwxcdg0UrMo7pzC

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0c8eae9093df4d1c394c8ef6ed8d8ec6_JaffaCakes118.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    7f5c791f7c2e39c6d951251506ac57a2

    SHA1

    707ff4495641b87c25ca5f8d3bbed5ab9a95295d

    SHA256

    2875415cb000ab52f4b6ee3e226919f66575a24ab2e8a085c4ab68dea4de5d57

    SHA512

    befa4dccfd417781d4f200b8f7f42d96d5ae0c1d8c6f129b240a1bacc83c2fc94e9402797324d3827e51f64029a6fee7306763cfeb5b253c6a2cc50a1d03cf70