resource	yara_rule
behavioral3/memory/3272-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-4-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-11-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-301-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-767-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-1718-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-3366-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-5266-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-7400-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-9897-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral3/memory/3272-11066-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	Trigona.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini	Trigona.exe
File opened for modification	\??\c:\Program Files\desktop.ini	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Trigona.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.RegularExpressions.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\uk.txt	Trigona.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms	Trigona.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\FPA_w1\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sv.txt	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\verify.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL	Trigona.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\lij.txt	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll	Trigona.exe
File created	\??\c:\Program Files\Java\jre-1.8\lib\amd64\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.ProtectedData.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	Trigona.exe
File created	\??\c:\Program Files\Java\jre-1.8\lib\cmm\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.Messages.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\t2k.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms	Trigona.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui	Trigona.exe
File created	\??\c:\Program Files\Common Files\System\ado\it-IT\how_to_decrypt.hta	Trigona.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui	Trigona.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	Trigona.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaws.exe	Trigona.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll	Trigona.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads