Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 09:27

General

  • Target

    2ead28630f603a2c9090a43cc281e086_JaffaCakes118.pdf

  • Size

    57KB

  • MD5

    2ead28630f603a2c9090a43cc281e086

  • SHA1

    147c31921233068a594138eba171215b80db44a9

  • SHA256

    4a637fe835fc07ba840d1c2172dc01163a323eeec23e2d9cbc5feea63013b60f

  • SHA512

    136ac5c7c3f2f56ecab86962a4eec023cb811dc7a00ac35b936579358744f184846c64e4c701ee9ad0f08cb49f9e750fe83f6ce50cdcb8811cfda17dcef2d3b9

  • SSDEEP

    768:yM+sUxrBsuFhMn8eYSgvAix6Sqt5FAmzHiq8rLjh+BopNC8qF6JDNjmZ6+fdhT9:yhsUxrx7iSqtzLiV3JNC8Y6Jk6eP9

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ead28630f603a2c9090a43cc281e086_JaffaCakes118.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    93a3511a93f2e6857f815be1a5dfb9b5

    SHA1

    1bcfc513de561e396d148b13aede6393ef16563f

    SHA256

    8d5db25fac482397416d26a4c2ba83adc919edae6e82a46f80c50871ca1732a0

    SHA512

    f4b59a264ba7c3364877ce1c1a862dcb8e79bea90e483a3569de7af845b4a341250d89e3e59f3c5a17656cd50c6acd40b895205c03a0f3c522a67db39fed4d3d