Analysis
- user interaction
yes - max time kernel
298s - max time network
266s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 23:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tri.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
tri.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target tri.exe
- Size 184KB
- Sample261024-2299jaew9m
- SHA256 b3928d8949ed3677fbf41176dbb64da3d640da7fc6b4fb70d693efc2f066d9ea
- MD5 07f5683bc77bb5aa29678871cc49916c
- SHA1 e9cb0638434013fef06e8f14d0e8a904e0e1c4bf
- SHA512 ded4dfb96640775dfd650aaf0d89f695d03eec10872dd2d11fb34275539964a14f90e8102cdfac6eef6d5b29db8e2811c2f1b410da8dc7c3522ad837f1d289ef
- SSDEEP 3072:w+oWkYaa/oj1dmIKWxGY6b6pnLhApaMDDDD0LLLLLLLLLLLLLLLLLLLLLLLLLLL/:DTtgj1dPGGaRSFWyRrHOpPFRkPx
- TLSH T10B044B17D16398FCC82BD17492AAA6B3A631B4551230BAFF2BD4CB301F02F51B719E59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tri.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: tri.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 32 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive24 tri.exe File opened (read-only) \??\PhysicalDrive26 tri.exe File opened (read-only) \??\PhysicalDrive29 tri.exe File opened (read-only) \??\PhysicalDrive7 tri.exe File opened (read-only) \??\PhysicalDrive14 tri.exe File opened (read-only) \??\PhysicalDrive25 tri.exe File opened (read-only) \??\PhysicalDrive0 tri.exe File opened (read-only) \??\PhysicalDrive1 tri.exe File opened (read-only) \??\PhysicalDrive27 tri.exe File opened (read-only) \??\PhysicalDrive2 tri.exe File opened (read-only) \??\PhysicalDrive3 tri.exe File opened (read-only) \??\PhysicalDrive5 tri.exe File opened (read-only) \??\PhysicalDrive9 tri.exe File opened (read-only) \??\PhysicalDrive11 tri.exe File opened (read-only) \??\PhysicalDrive18 tri.exe File opened (read-only) \??\PhysicalDrive31 tri.exe File opened (read-only) \??\PhysicalDrive6 tri.exe File opened (read-only) \??\PhysicalDrive19 tri.exe File opened (read-only) \??\PhysicalDrive21 tri.exe File opened (read-only) \??\PhysicalDrive12 tri.exe File opened (read-only) \??\PhysicalDrive13 tri.exe File opened (read-only) \??\PhysicalDrive17 tri.exe File opened (read-only) \??\PhysicalDrive20 tri.exe File opened (read-only) \??\PhysicalDrive8 tri.exe File opened (read-only) \??\PhysicalDrive16 tri.exe File opened (read-only) \??\PhysicalDrive22 tri.exe File opened (read-only) \??\PhysicalDrive28 tri.exe File opened (read-only) \??\PhysicalDrive4 tri.exe File opened (read-only) \??\PhysicalDrive10 tri.exe File opened (read-only) \??\PhysicalDrive15 tri.exe File opened (read-only) \??\PhysicalDrive23 tri.exe File opened (read-only) \??\PhysicalDrive30 tri.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tri.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tri.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 6112 tri.exe 6112 tri.exe 6112 tri.exe 6112 tri.exe 6112 tri.exe 6112 tri.exe 6112 tri.exe 6112 tri.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe Token: SeDebugPrivilege 6112 tri.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tri.exe"C:\Users\Admin\AppData\Local\Temp\tri.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5912
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1