Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Payment Advice-RefA22D4YdWsbE56.xla.xlsx
-
Size
1.1MB
-
Sample
241106-szrjzatbmp
-
MD5
93019ec4bf2082a11f1324fb0f69f6bb
-
SHA1
0b8890cb852598a7fbd51c77d99de803a6b694fa
-
SHA256
b9a1aa0417bb7c55a9320c9c6919bf56559bb6cb8064ff087e23bf54e66caf55
-
SHA512
138ea5ccbf18782bdbe4995008268129825bbf4c82a1ae93afd02f874ce047cbc07482f432919ef536000c5e1bafd3b0c9727f04aa038be0ec881f71456942de
-
SSDEEP
24576:/yaZxvseowaDIOpUqvBw2L5Lxxg3mJ/Qga9NmAvOJZ:/T0DIOLvBwC5Lrg3mJIg4O
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice-RefA22D4YdWsbE56.xla.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Payment Advice-RefA22D4YdWsbE56.xla.xls
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0
https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0
Targets
-
-
Target
Payment Advice-RefA22D4YdWsbE56.xla.xlsx
-
Size
1.1MB
-
MD5
93019ec4bf2082a11f1324fb0f69f6bb
-
SHA1
0b8890cb852598a7fbd51c77d99de803a6b694fa
-
SHA256
b9a1aa0417bb7c55a9320c9c6919bf56559bb6cb8064ff087e23bf54e66caf55
-
SHA512
138ea5ccbf18782bdbe4995008268129825bbf4c82a1ae93afd02f874ce047cbc07482f432919ef536000c5e1bafd3b0c9727f04aa038be0ec881f71456942de
-
SSDEEP
24576:/yaZxvseowaDIOpUqvBw2L5Lxxg3mJ/Qga9NmAvOJZ:/T0DIOLvBwC5Lrg3mJIg4O
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Evasion via Device Credential Deployment
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-