Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
VTRL_2.2.0_x64_en-US.msi
-
Size
2.7MB
-
Sample
240908-mslr9atgmh
-
MD5
0880ea12cf5019b9d77468f26c821287
-
SHA1
72423233ce8f79c5b617e74628f6bfd0f4124784
-
SHA256
60fa7769e0f7ec2e05388158aa8d3153f1f6b444344674e4e5920484c9cfa19e
-
SHA512
03e87622969d391593f650b67ee5d0e7a6f45a3aabcdfe940f768d0215ea088b040aabb3c0dda69688dc77074ff49f4539fe044bb7ca542f95bbffa5e13d421f
-
SSDEEP
49152:EqEFyU1462jmoP7CGBPmS9TVjnUHNW9fksWvZgkj4m:EeU1l277vPmSTVjtBkvv8m
Static task
static1
Behavioral task
behavioral1
Sample
VTRL_2.2.0_x64_en-US.msi
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
VTRL_2.2.0_x64_en-US.msi
-
Size
2.7MB
-
MD5
0880ea12cf5019b9d77468f26c821287
-
SHA1
72423233ce8f79c5b617e74628f6bfd0f4124784
-
SHA256
60fa7769e0f7ec2e05388158aa8d3153f1f6b444344674e4e5920484c9cfa19e
-
SHA512
03e87622969d391593f650b67ee5d0e7a6f45a3aabcdfe940f768d0215ea088b040aabb3c0dda69688dc77074ff49f4539fe044bb7ca542f95bbffa5e13d421f
-
SSDEEP
49152:EqEFyU1462jmoP7CGBPmS9TVjnUHNW9fksWvZgkj4m:EeU1l277vPmSTVjtBkvv8m
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Privilege Escalation
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1