Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

0311.xls

windows7-x64

10

0311.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0311.xls

  • Size

    217KB

  • Sample

    221103-qzlydadahl

  • MD5

    f6895e2267fc5ef1a31fd5dd4495fd5b

  • SHA1

    ea86e973131a134c64150bb2a61440926f6e32a8

  • SHA256

    5e885180e31c3690ed6761b181919f985140bd173e35a444ea67450ce587dc15

  • SHA512

    97fd3bd4dfb31f75a5c4dfdc28dfcb7ed394d1b653153a69f0f73c50aec4aa866721ad48425665081c2cbde28be7014d6619a1ab360db8362545dcedfe153dcf

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmL:bbGUMVWlbL

Score
10/10
emotetbankermacropersistencetrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://aprendeconmireia.com/images/wBu/
xlm40.dropper

http://updailymail.com/cgi-bin/gBYmfqRi2utIS2n/
xlm40.dropper

https://akuntansi.itny.ac.id/asset/9aVFvYeaSKOhGBSLx/
xlm40.dropper

http://swiftwebbox.com/cgi-bin/vNqoMtQilpysJYRwtGu/

Targets

    • Target

      0311.xls

    • Size

      217KB

    • MD5

      f6895e2267fc5ef1a31fd5dd4495fd5b

    • SHA1

      ea86e973131a134c64150bb2a61440926f6e32a8

    • SHA256

      5e885180e31c3690ed6761b181919f985140bd173e35a444ea67450ce587dc15

    • SHA512

      97fd3bd4dfb31f75a5c4dfdc28dfcb7ed394d1b653153a69f0f73c50aec4aa866721ad48425665081c2cbde28be7014d6619a1ab360db8362545dcedfe153dcf

    • SSDEEP

      6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmL:bbGUMVWlbL

    Score
    10/10
    emotetbankertrojanpersistence

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks