Malware Detection and Prevention: Trojan Variants Blocked Across Multiple Systems

Initial Signal

Microsoft Defender for Endpoint detected malware on ws-001.[INTERNAL_DOMAIN_1].local and three other corporate devices. The threat was identified as Trojan:Win32/Vigorf.A and Trojan:Win32/Malgent!MSR (T1204.002 User Execution: Malicious File), classified by Microsoft as malware with a global prevalence of 40,000 instances since 2018. The malicious file (SHA-256: 58b48f2272fba4e462f744490784eccd72909e49e16b5d1c001f26d265f0a39e) appeared in multiple locations and formats: Test.rar, Test.zip, Test.tar, , and Test.exe in download folders, plus browser cache files in both Chrome and Edge. The consistent presence across multiple browsers and file formats suggested web-based infection attempts rather than a single delivery vector. What made this noteworthy was not the detections themselves—those worked as designed—but the scope: the same malicious hash across four systems and two user accounts indicated a broader exposure event. However, Microsoft Defender's prevention controls blocked execution in browser caches, and no process creation events were recorded for the malicious SHA-256, meaning the malware never ran. The investigation correlated 256 records across Microsoft Defender XDR, Defender for Endpoint, and Entra ID over 2m 28s of autonomous analysis.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified Microsoft's explicit classification of the file
   Pass
2. fp2
   Analyzed detection consistency across multiple systems
   Pass
3. fp3
   Evaluated file locations and naming patterns
   Pass
4. fp4
   Checked for legitimate software with matching characteristics
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of True Positive - Blocked at high confidence rests on the following mutually corroborating signals:

1. Microsoft's explicit classification of the file as 'Malware' with a global prevalence of 40,000 instances since 2018, confirmed by consistent SHA-256 and SHA-1 hash values across all detections

2. Dual malware family identification (Trojan:Win32/Vigorf.A and Trojan:Win32/Malgent!MSR) across multiple detection engines and systems, eliminating the possibility of a single false positive

3. Successful prevention by Microsoft Defender: the malware was blocked from executing in browser caches and detected during scheduled scans in download folders, with no process creation events recorded for the malicious SHA-256

4. Multi-system and multi-user presence (four devices, two user accounts) with consistent file hashes across different formats (RAR, ZIP, TAR, EXE), indicating a genuine web-based infection attempt rather than isolated noise

5. Absence of post-execution indicators: no persistence mechanisms, no credential theft, no unauthorized access, and no lateral movement detected in RDP or PowerShell logs, confirming that security controls functioned as designed and prevented compromise

Lessons

1. 01
   Prevention success is not invisibility. This investigation detected malware on four systems and two user accounts, yet no compromise occurred. The temptation is to treat this as a non-event because nothing executed. Instead, treat it as a signal: users are encountering malicious content through web browsing. The fact that Defender blocked execution is a win, but the presence of the malware in four download folders means the infection vector is active and users are still at risk if they bypass or disable protections. Escalate to user awareness and endpoint hardening, not just alert closure.
2. 02
   Browser cache detections reveal web-based attack campaigns. The malware appeared in both Chrome and Edge browser caches on the same system, a pattern that typically indicates drive-by downloads or malicious ad networks rather than phishing or social engineering. This is distinct from a single user downloading a file. Correlate browser cache detections across your environment to identify compromised websites or ad networks targeting your organization, then work with network security to block those sources at the perimeter.
3. 03
   File format variation signals deliberate obfuscation. The same malicious hash appeared as Test.rar, Test.zip, Test.tar, and Test.exe in download folders. This is not accidental—it indicates either multiple download attempts by the user or an attacker deliberately repackaging the same payload in different formats to evade detection or increase the chance of execution. When you see this pattern, assume intent and investigate the user's browsing history and any recent phishing emails or suspicious links they may have clicked.