Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Payment Advice-RefA22D4YdWsbE56.xla.xlsx

  • Size

    1.1MB

  • Sample

    241106-szrjzatbmp

  • MD5

    93019ec4bf2082a11f1324fb0f69f6bb

  • SHA1

    0b8890cb852598a7fbd51c77d99de803a6b694fa

  • SHA256

    b9a1aa0417bb7c55a9320c9c6919bf56559bb6cb8064ff087e23bf54e66caf55

  • SHA512

    138ea5ccbf18782bdbe4995008268129825bbf4c82a1ae93afd02f874ce047cbc07482f432919ef536000c5e1bafd3b0c9727f04aa038be0ec881f71456942de

  • SSDEEP

    24576:/yaZxvseowaDIOpUqvBw2L5Lxxg3mJ/Qga9NmAvOJZ:/T0DIOLvBwC5Lrg3mJIg4O

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

exe.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

Targets

    • Target

      Payment Advice-RefA22D4YdWsbE56.xla.xlsx

    • Size

      1.1MB

    • MD5

      93019ec4bf2082a11f1324fb0f69f6bb

    • SHA1

      0b8890cb852598a7fbd51c77d99de803a6b694fa

    • SHA256

      b9a1aa0417bb7c55a9320c9c6919bf56559bb6cb8064ff087e23bf54e66caf55

    • SHA512

      138ea5ccbf18782bdbe4995008268129825bbf4c82a1ae93afd02f874ce047cbc07482f432919ef536000c5e1bafd3b0c9727f04aa038be0ec881f71456942de

    • SSDEEP

      24576:/yaZxvseowaDIOpUqvBw2L5Lxxg3mJ/Qga9NmAvOJZ:/T0DIOLvBwC5Lrg3mJIg4O

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Evasion via Device Credential Deployment

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks