b3928d8949ed3677fbf41176dbb64da3d640da7fc6b4fb70d693efc2f066d9ea

Analysis

user interaction
yes
max time kernel
298s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tri.exe
Size 184KB
Sample261024-2299jaew9m
SHA256 b3928d8949ed3677fbf41176dbb64da3d640da7fc6b4fb70d693efc2f066d9ea
MD5 07f5683bc77bb5aa29678871cc49916c
SHA1 e9cb0638434013fef06e8f14d0e8a904e0e1c4bf
SHA512 ded4dfb96640775dfd650aaf0d89f695d03eec10872dd2d11fb34275539964a14f90e8102cdfac6eef6d5b29db8e2811c2f1b410da8dc7c3522ad837f1d289ef
SSDEEP 3072:w+oWkYaa/oj1dmIKWxGY6b6pnLhApaMDDDD0LLLLLLLLLLLLLLLLLLLLLLLLLLL/:DTtgj1dPGGaRSFWyRrHOpPFRkPx
TLSH
T10B044B17D16398FCC82BD17492AAA6B3A631B4551230BAFF2BD4CB301F02F51B719E59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tri.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	tri.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 32 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive10	tri.exe
File opened (read-only)	\??\PhysicalDrive11	tri.exe
File opened (read-only)	\??\PhysicalDrive15	tri.exe
File opened (read-only)	\??\PhysicalDrive17	tri.exe
File opened (read-only)	\??\PhysicalDrive2	tri.exe
File opened (read-only)	\??\PhysicalDrive8	tri.exe
File opened (read-only)	\??\PhysicalDrive22	tri.exe
File opened (read-only)	\??\PhysicalDrive25	tri.exe
File opened (read-only)	\??\PhysicalDrive12	tri.exe
File opened (read-only)	\??\PhysicalDrive0	tri.exe
File opened (read-only)	\??\PhysicalDrive14	tri.exe
File opened (read-only)	\??\PhysicalDrive23	tri.exe
File opened (read-only)	\??\PhysicalDrive27	tri.exe
File opened (read-only)	\??\PhysicalDrive28	tri.exe
File opened (read-only)	\??\PhysicalDrive13	tri.exe
File opened (read-only)	\??\PhysicalDrive6	tri.exe
File opened (read-only)	\??\PhysicalDrive9	tri.exe
File opened (read-only)	\??\PhysicalDrive29	tri.exe
File opened (read-only)	\??\PhysicalDrive31	tri.exe
File opened (read-only)	\??\PhysicalDrive3	tri.exe
File opened (read-only)	\??\PhysicalDrive21	tri.exe
File opened (read-only)	\??\PhysicalDrive4	tri.exe
File opened (read-only)	\??\PhysicalDrive16	tri.exe
File opened (read-only)	\??\PhysicalDrive19	tri.exe
File opened (read-only)	\??\PhysicalDrive30	tri.exe
File opened (read-only)	\??\PhysicalDrive7	tri.exe
File opened (read-only)	\??\PhysicalDrive18	tri.exe
File opened (read-only)	\??\PhysicalDrive20	tri.exe
File opened (read-only)	\??\PhysicalDrive26	tri.exe
File opened (read-only)	\??\PhysicalDrive24	tri.exe
File opened (read-only)	\??\PhysicalDrive1	tri.exe
File opened (read-only)	\??\PhysicalDrive5	tri.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tri.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tri.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4728	tri.exe
4728	tri.exe
4728	tri.exe
4728	tri.exe
4728	tri.exe
4728	tri.exe
4728	tri.exe
4728	tri.exe

C:\Users\Admin\AppData\Local\Temp\tri.exe
"C:\Users\Admin\AppData\Local\Temp\tri.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4728