Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 02:13
Behavioral task
behavioral1
Sample
455159dedc03e69ed6dc0b38666013ee_JaffaCakes118.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
455159dedc03e69ed6dc0b38666013ee_JaffaCakes118.pdf
Resource
win10v2004-20241007-en
General
-
Target
455159dedc03e69ed6dc0b38666013ee_JaffaCakes118.pdf
-
Size
64KB
-
MD5
455159dedc03e69ed6dc0b38666013ee
-
SHA1
bc6d0c2bd9d099a25222f1d5c2b3a949d885534d
-
SHA256
ed829a3a03abae162dab814037f01b059f27a8fb4727b0264ce9ce73cf5dcf24
-
SHA512
5c167123eea19f92865484d014680c8d53b0ae04399b6ce86b08b6f941b0b53e6ba041c1d515b37d761e3699624068143f1d5769d91aa336996e7b32f587557c
-
SSDEEP
1536:3y2FShIb7r+lHez+Hg7Z1gdtFeRX5QYCNoM:rFShIr++MIZ1gd/iFC9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2344 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2344 AcroRd32.exe 2344 AcroRd32.exe 2344 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\455159dedc03e69ed6dc0b38666013ee_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a8b6d3952f9af65fd593a88cff47f428
SHA1a18bc8fdb6009fe02ca1d324cea8a45b8a4ad603
SHA25635778e9203d024764d9b2b90f27f7cd1a1539a3f9a66fd0abb44548501c84aef
SHA512e534dc528dca123217f001a73515307031204bd067d5908fbd54616b4f6309468425b99260a725b5fe8dbd91fefe1cfe23f8d035643feb5a1d8db53ab0ca5276