Analysis
- user interaction
yes - max time kernel
23s - max time network
22s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trident_loader (1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
trident_loader (1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
General
- Target trident_loader (1).exe
- Size 2.2MB
- Sample260929-rt4fxasbmd
- SHA256 7753f999e7a4d9d05622014ab0aa615bb13ee209fc1aad5297030fea998517dc
- MD5 25d8b46ee2d1c6dc6584d607e523e41d
- SHA1 3947f04a64a79aacb7715a37666788ad02fbb5e6
- SHA512 aa646be597a664f85a247f089f561fe5c10db94943c5ca54c7ac9dcfbaad99ba417445a5405737df3fcd65ad93bad67d787502db1f69f5fe77353e99895faf21
- SSDEEP 49152:FSSMJf/TsxIQZcZj2tgHleAeuQYmHfTKFikKxHCYDw+nYyU1mR:FJM1/YXcZj+gH8rHrKF12HCAwOZU1mR
- TLSH T13EB523C6B5DA0EF5E019B578C2732445E34D3171DEE256127A1CAF5EBECB82380FA681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 2412 trident_loader (1).exe 2412 trident_loader (1).exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2412 trident_loader (1).exe 2412 trident_loader (1).exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2412 trident_loader (1).exe 2412 trident_loader (1).exe 2412 trident_loader (1).exe 2412 trident_loader (1).exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 trident_loader (1).exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2412 trident_loader (1).exe Token: SeDebugPrivilege 2972 taskmgr.exe Token: SeSystemProfilePrivilege 2972 taskmgr.exe Token: SeCreateGlobalPrivilege 2972 taskmgr.exe Token: SeDebugPrivilege 2412 trident_loader (1).exe - Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe 2972 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2412 trident_loader (1).exe 2972 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trident_loader (1).exe"C:\Users\Admin\AppData\Local\Temp\trident_loader (1).exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2412
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2972