Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2024 14:53
Behavioral task
behavioral1
Sample
Trigona.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Trigona.exe
Resource
win10-20231215-en
windows10-1703-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Trigona.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Trigona.exe
Resource
win11-20231215-en
windows11-21h2-x64
5 signatures
150 seconds
General
-
Target
Trigona.exe
-
Size
1.1MB
-
MD5
2c31a750240788f924ef64a2fb4fdf3b
-
SHA1
c9c6a7f911d16b49d8b838dca3683357b72c9d6d
-
SHA256
b49bf3a4baf637e067a8db7360051eba39713b7958519b49f8e236b6014c8477
-
SHA512
1e36c96110b793bfea2e65f6ff4c0e59a0a6b8f86395d7be6497be264954ab9b7c61d0adfa85dcef5ce69afe4b200b3ece82cbf089264f7d648eaaa53acbd50d
-
SSDEEP
12288:XRYqX7pdDWExBDmkYhiPJSA0IqOO2vBwRns2MqnuY/gtTyb7:hY6frxBDmkY+Jr0Iql2v4sx+uxtTyn
Score
10/10
Malware Config
Signatures
-
Detects Trigona ransomware 13 IoCs
resource yara_rule behavioral3/memory/3272-0-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-1-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-2-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-4-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-11-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-301-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-767-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-1718-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-3366-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-5266-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-7400-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-9897-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona behavioral3/memory/3272-11066-0x0000000000400000-0x0000000000526000-memory.dmp family_trigona -
Trigona
A ransomware first seen at the beginning of the 2022.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\982D6F5F544FDB1A58068FF26E66BA9A = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trigona.exe" Trigona.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini Trigona.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini Trigona.exe File opened for modification \??\c:\Program Files\desktop.ini Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Trigona.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.RegularExpressions.dll Trigona.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\uk.txt Trigona.exe File created \??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms Trigona.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\FPA_w1\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\sv.txt Trigona.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll Trigona.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\verify.dll Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL Trigona.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\lij.txt Trigona.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll Trigona.exe File created \??\c:\Program Files\Java\jre-1.8\lib\amd64\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.ProtectedData.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Trigona.exe File created \??\c:\Program Files\Java\jre-1.8\lib\cmm\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.Messages.dll Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll Trigona.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Controls.Ribbon.resources.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\t2k.dll Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms Trigona.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\en-US\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms Trigona.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui Trigona.exe File created \??\c:\Program Files\Common Files\System\ado\it-IT\how_to_decrypt.hta Trigona.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui Trigona.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll Trigona.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll Trigona.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe Trigona.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll Trigona.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5209df1668b94cd83ceb1dae46201e25a
SHA1d4c9cecc3d1c0d8c935e023b8dbe9f50ae73f2e3
SHA25600df70eac265ba2a700056675d368b76b9af669d35477910094d13b854eaa368
SHA51291b302a86eea003492a8ec92eb33e07644b6d78eaec5afd1c5a9fb0a529fb130d5db58ff4fb5af8801ff98806668dce6ace975db49dcc947e8b770692c620ff3
-
Filesize
11KB
MD55e6318e1aeed0f69ce15c9abb36eacc0
SHA10b7664bf9b63dd1ae74ce82b5c136d42366c285f
SHA2569d13e9d6c20d8a71b54a9b53d40dc1281e34f9f55bc999ad3138e4710c3e7b79
SHA51274e0fdddec47295e3464b3d2dd34f18507433ff5e5339618f11d25f96517ef00e7a64b2fef989a8558a9aea808a50eb63c6aebc0ac32b5d3c7d6d99b512c2f6c