Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
https://hoteltoscanaplaza.com.co/booking/tool/1xx.txt
https://hoteltoscanaplaza.com.co/booking/tool/1type.txt
https://hoteltoscanaplaza.com.co/booking/tool/1tron.vbs.pdf
https://hoteltoscanaplaza.com.co/booking/tool/1Execute.txt
https://hoteltoscanaplaza.com.co/booking/tool/1Framework.txt
https://hoteltoscanaplaza.com.co/booking/tool/1invoke.txt
https://hoteltoscanaplaza.com.co/booking/tool/1load.txt
https://hoteltoscanaplaza.com.co/booking/tool/1method.txt
https://hoteltoscanaplaza.com.co/booking/tool/1msg.txt
https://hoteltoscanaplaza.com.co/booking/tool/1runpe.txt
https://hoteltoscanaplaza.com.co/booking/tool/1tron.bat.pdf
https://hoteltoscanaplaza.com.co/booking/tool/1tron.ps1.pdf
Targets
-
-
Target
http://amerian-financeiro.papudoproducoes.com/accounts/195363/messages/11/clicks/30515/19?envelope_id=7
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-