Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 07:27
Behavioral task
behavioral1
Sample
16baa02891571676f8dced1ec73d915d_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16baa02891571676f8dced1ec73d915d_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
16baa02891571676f8dced1ec73d915d_JaffaCakes118.pdf
-
Size
7KB
-
MD5
16baa02891571676f8dced1ec73d915d
-
SHA1
2135a4ab09bca3bcdb2fa2812c451335c2aae31d
-
SHA256
b4a36f9a17c19fe4161a6d25090c66131cc4d2d2f4af872d11c62f1d90e114b1
-
SHA512
9c8d06024f27b9035e3a1deb03344a6737ea25a455e8a73390a2e31629c68cd22dc24dc9e8fa3c941b89070b5cb8bcdf072f3a68298014d955f77192bcb14754
-
SSDEEP
192:TiwvLZi8R4/py1FG3CR/u2pfNJVGPR9j2:Ti61R4/c1FG3ClpfNJc2
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2808 2892 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2892 AcroRd32.exe 2892 AcroRd32.exe 2892 AcroRd32.exe 2892 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2808 2892 AcroRd32.exe 30 PID 2892 wrote to memory of 2808 2892 AcroRd32.exe 30 PID 2892 wrote to memory of 2808 2892 AcroRd32.exe 30 PID 2892 wrote to memory of 2808 2892 AcroRd32.exe 30
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\16baa02891571676f8dced1ec73d915d_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 7562⤵
- Program crash
PID:2808
-