Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
18/04/2023, 10:19
Behavioral task
behavioral1
Sample
fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
- Size 1.1MB
- Sample230418-mclsbacf2v
- SHA256 fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b
- MD5 530967fb3b7d9427552e4ac181a37b9a
- SHA1 41bcf469661ab9609a0d181953c2f8ffb75bb483
- SHA512 b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa
- SSDEEP 24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Trigona ransomware 14 IoCs
resource yara_rule behavioral2/memory/2036-133-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-134-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-136-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-138-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-1720-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-4570-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-5172-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-5644-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-10184-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-14730-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-18262-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-20948-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-22788-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral2/memory/2036-22789-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona - Trigona
A ransomware first seen at the beginning of the 2022.
- Drops startup file 1 IoCs
description ioc Process File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CCD329904494D2EB7164EE0AB48F5E07 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe" fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\desktop.ini fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\pa-in.txt fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\197.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\es\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\eu\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jre1.8.0_66\bin\dt_socket.dll fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\WideTile.scale-125.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-125.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-16.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\WideTile.scale-125.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\kweather.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Google\Temp\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jre1.8.0_66\lib\tzmappings fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\182.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\meta-index fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\BORDERS\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe File created \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\how_to_decrypt.hta fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini
- Size 2KB
- SHA256 b99bf0e6bcbdc30241c302f5b18b96ff92e29b1b0bb220a1cb9cf30b0d6a5e52
- MD5 d39595240eb1be47bafa9d0bb9bede98
- SHA1 fb274ff6d9b6ef4124a743fc9c63927d8e84cfe5
- SHA512 f5071428dc6a33fe3f3e22b27cf3b180747de24060ba4edeeae48079120928fd68a4d749c4f822c873399e26539156ec6793beabb589d7e88aab80a19af34df6
- MD5 SHA1 SHA512
- Path C:\PerfLogs\how_to_decrypt.hta
- Size 11KB
- SHA256 1a98460dd247ee6ff3a87092c60e34328822992eeafc4816b88578dfc2a54ce5
- MD5 56c73eb4a727ff9615275cda0a3b6729
- SHA1 20f8901a49f52f50f7e872292dc613e9d4e5370e
- SHA512 0e51d2b0b4c56cf8e601026ae4db8d584d910177987cf54b8904139b6dcdf6c93ad4fe87568609d8b8ee079ac7841517ab99eaab4a30ab38df28ef514a2695db
- SSDEEP 192:toPupsc3vIyYQE1ZoIfdCQAmzsN9VCq9iqIBtklKTbaB3VsLM:kupsc3gbQYRVCQAmzydexM
- MD5 SHA1 SHA512 SSDEEP