Analysis
- max time kernel
300s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tria1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
tria1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target tria1.exe
- Size 184KB
- Sample261024-3z4jmsc121
- SHA256 890f97d3ecfa8236756968d91f2df6dd94f67bd1620dad9f7313287991327831
- MD5 2383fe14371ffed3d7c07663a481d847
- SHA1 c94417c644c090f1e3db6d4d4f43c6f6211ff000
- SHA512 b8b06f59cd69d00135224b8531750259352567079c69e01986fcd094dd9c77f94fc290848ade8ec7dee59935d0687e6504cd2a57c0a33c3665625cc7df6dcd1d
- SSDEEP 3072:n+6LB16a/9j1uGIqDNmYH86pnwhAJaMDDDD0LLLLLLLLLLLLLLLLLLLLLLLLLLLB:+aNFj1u2m/axNlW3bOpPfLlPxG
- TLSH T14C043B17E16398FCC82BD174929AA6B3A631B4551230BAFF2BD4CB341F03E50B719E59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tria1.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: tria1.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 32 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive28 tria1.exe File opened (read-only) \??\PhysicalDrive30 tria1.exe File opened (read-only) \??\PhysicalDrive2 tria1.exe File opened (read-only) \??\PhysicalDrive7 tria1.exe File opened (read-only) \??\PhysicalDrive8 tria1.exe File opened (read-only) \??\PhysicalDrive22 tria1.exe File opened (read-only) \??\PhysicalDrive26 tria1.exe File opened (read-only) \??\PhysicalDrive29 tria1.exe File opened (read-only) \??\PhysicalDrive1 tria1.exe File opened (read-only) \??\PhysicalDrive20 tria1.exe File opened (read-only) \??\PhysicalDrive24 tria1.exe File opened (read-only) \??\PhysicalDrive14 tria1.exe File opened (read-only) \??\PhysicalDrive21 tria1.exe File opened (read-only) \??\PhysicalDrive31 tria1.exe File opened (read-only) \??\PhysicalDrive3 tria1.exe File opened (read-only) \??\PhysicalDrive6 tria1.exe File opened (read-only) \??\PhysicalDrive9 tria1.exe File opened (read-only) \??\PhysicalDrive12 tria1.exe File opened (read-only) \??\PhysicalDrive18 tria1.exe File opened (read-only) \??\PhysicalDrive23 tria1.exe File opened (read-only) \??\PhysicalDrive27 tria1.exe File opened (read-only) \??\PhysicalDrive4 tria1.exe File opened (read-only) \??\PhysicalDrive5 tria1.exe File opened (read-only) \??\PhysicalDrive10 tria1.exe File opened (read-only) \??\PhysicalDrive13 tria1.exe File opened (read-only) \??\PhysicalDrive16 tria1.exe File opened (read-only) \??\PhysicalDrive19 tria1.exe File opened (read-only) \??\PhysicalDrive0 tria1.exe File opened (read-only) \??\PhysicalDrive11 tria1.exe File opened (read-only) \??\PhysicalDrive15 tria1.exe File opened (read-only) \??\PhysicalDrive17 tria1.exe File opened (read-only) \??\PhysicalDrive25 tria1.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tria1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tria1.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe 5156 tria1.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe Token: SeDebugPrivilege 5156 tria1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tria1.exe"C:\Users\Admin\AppData\Local\Temp\tria1.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1