Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:49
Behavioral task
behavioral1
Sample
JaffaCakes118_f9fa2d6b4d145c46d8a49cd91ea871c5.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f9fa2d6b4d145c46d8a49cd91ea871c5.pdf
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f9fa2d6b4d145c46d8a49cd91ea871c5.pdf
-
Size
72KB
-
MD5
f9fa2d6b4d145c46d8a49cd91ea871c5
-
SHA1
eeac1483c9b8742927dcc72d4c6dbd5bf34bf70e
-
SHA256
2eacadb20ff88a8cf5765e830204f8ad9d7a64d50a3dd6a832ad8a84a267a3b1
-
SHA512
e3e7bdfa6728563bc1086255e5e6783db580fece26ecc12feb8e5b9a6191463df6abbfdc54d3e9ca4a5b6ef0a49a28af5653199abde4f25d6fc6552fe7f53d22
-
SSDEEP
1536:M235hoLAALWAKuW5h0dRagTRWLJdhCOWft0N9CQ7WApO6vUz:nJMDWAEORptwdhCv6RK60
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2060 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2060 AcroRd32.exe 2060 AcroRd32.exe 2060 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9fa2d6b4d145c46d8a49cd91ea871c5.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5424a8b77f1e8ceee855cdc35238a1d3d
SHA19272157b8578fc5eede27ba28a9ec316d7d670dd
SHA256d09b66336d6b0a94d135de787a07fb4c76a58d9ebc3e6101af320bc2390c81e2
SHA5127576595f847b51b291bcb84097b69f5600c841029dc25a60daf6daea99e27019a4302f439846dc7c709dc9659f67d60742c90ac948626d2c4ed90ca6cb810c0d