Analysis
- user interaction
yes - max time kernel
8s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/06/2026, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TrustedCMD.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
TrustedCMD.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target TrustedCMD.exe
- Size 107KB
- Sample260622-lp4cfsbt4s
- SHA256 4182ee8eb8bc9aa8517d9305ffe424b396d1ed758d33df02a9ce2aec46d8c13d
- MD5 f0768b5d89e0cdbe41a4aff2545fe659
- SHA1 5cfb21126913a6a92ba7a917fbf0af35bea307ef
- SHA512 31ebb3c359444f66c450902b6dc413f15a776743b9227874d481041cf9574645f18b81a90cad9d1d23ff662488f23e0e61c03f2a2be1c78b38bbae582ea5a748
- SSDEEP 1536:jHHncBJKJvjT++Foj5nJBbGPcHtZ3yhTh4hcnBwEIh3K67upQjV4cGrnydmTMhMq:jH8BJ+vPoVnJBR3kol
- TLSH T128B3C5D077D51C99EA65627C59F682327B7CF9E08523DB1F5120B2321E22EC02DDA73A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4568 created 4136 4568 TrustedCMD.exe 89 - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4568 TrustedCMD.exe Token: SeAuditPrivilege 4568 TrustedCMD.exe Token: SeBackupPrivilege 4568 TrustedCMD.exe Token: SeChangeNotifyPrivilege 4568 TrustedCMD.exe Token: SeCreateGlobalPrivilege 4568 TrustedCMD.exe Token: SeCreatePagefilePrivilege 4568 TrustedCMD.exe Token: SeCreatePermanentPrivilege 4568 TrustedCMD.exe Token: 35 4568 TrustedCMD.exe Token: SeDebugPrivilege 4568 TrustedCMD.exe Token: SeImpersonatePrivilege 4568 TrustedCMD.exe Token: SeIncBasePriorityPrivilege 4568 TrustedCMD.exe Token: SeIncreaseQuotaPrivilege 4568 TrustedCMD.exe Token: 33 4568 TrustedCMD.exe Token: SeLoadDriverPrivilege 4568 TrustedCMD.exe Token: SeLockMemoryPrivilege 4568 TrustedCMD.exe Token: SeManageVolumePrivilege 4568 TrustedCMD.exe Token: SeProfSingleProcessPrivilege 4568 TrustedCMD.exe Token: SeRestorePrivilege 4568 TrustedCMD.exe Token: SeSecurityPrivilege 4568 TrustedCMD.exe Token: SeShutdownPrivilege 4568 TrustedCMD.exe Token: SeSystemEnvironmentPrivilege 4568 TrustedCMD.exe Token: SeSystemProfilePrivilege 4568 TrustedCMD.exe Token: SeSystemtimePrivilege 4568 TrustedCMD.exe Token: SeTakeOwnershipPrivilege 4568 TrustedCMD.exe Token: SeTcbPrivilege 4568 TrustedCMD.exe Token: 34 4568 TrustedCMD.exe Token: SeUndockPrivilege 4568 TrustedCMD.exe Token: 36 4568 TrustedCMD.exe Token: SeAssignPrimaryTokenPrivilege 4568 TrustedCMD.exe Token: SeAuditPrivilege 4568 TrustedCMD.exe Token: SeBackupPrivilege 4568 TrustedCMD.exe Token: SeChangeNotifyPrivilege 4568 TrustedCMD.exe Token: SeCreateGlobalPrivilege 4568 TrustedCMD.exe Token: SeCreatePagefilePrivilege 4568 TrustedCMD.exe Token: SeCreatePermanentPrivilege 4568 TrustedCMD.exe Token: 35 4568 TrustedCMD.exe Token: SeDebugPrivilege 4568 TrustedCMD.exe Token: SeImpersonatePrivilege 4568 TrustedCMD.exe Token: SeIncBasePriorityPrivilege 4568 TrustedCMD.exe Token: SeIncreaseQuotaPrivilege 4568 TrustedCMD.exe Token: 33 4568 TrustedCMD.exe Token: SeLoadDriverPrivilege 4568 TrustedCMD.exe Token: SeLockMemoryPrivilege 4568 TrustedCMD.exe Token: SeManageVolumePrivilege 4568 TrustedCMD.exe Token: SeProfSingleProcessPrivilege 4568 TrustedCMD.exe Token: SeRestorePrivilege 4568 TrustedCMD.exe Token: SeSecurityPrivilege 4568 TrustedCMD.exe Token: SeShutdownPrivilege 4568 TrustedCMD.exe Token: SeSystemEnvironmentPrivilege 4568 TrustedCMD.exe Token: SeSystemProfilePrivilege 4568 TrustedCMD.exe Token: SeSystemtimePrivilege 4568 TrustedCMD.exe Token: SeTakeOwnershipPrivilege 4568 TrustedCMD.exe Token: SeTcbPrivilege 4568 TrustedCMD.exe Token: 34 4568 TrustedCMD.exe Token: SeUndockPrivilege 4568 TrustedCMD.exe Token: 36 4568 TrustedCMD.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1768 4568 TrustedCMD.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrustedCMD.exe"C:\Users\Admin\AppData\Local\Temp\TrustedCMD.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4136
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵PID:1768
-