trigona | fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b

Resubmissions

21-01-2024 14:53

240121-r9d6ysead3 10

18-04-2023 10:19

230418-mclsbacf2v 10

Analysis

max time kernel
56s
max time network
157s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
21-01-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Size

1.1MB
MD5

530967fb3b7d9427552e4ac181a37b9a
SHA1

41bcf469661ab9609a0d181953c2f8ffb75bb483
SHA256

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b
SHA512

b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa
SSDEEP

24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL

Score

10^/10

trigona discovery persistence ransomware

Malware Config

Signatures

Detects Trigona ransomware 13 IoCs

resource	yara_rule
behavioral2/memory/4500-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-7-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-849-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-853-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-1472-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-2076-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-12541-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-16340-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-16341-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-16342-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4500-16343-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1775739321-368907234-981748298-1000\Software\Microsoft\Windows\CurrentVersion\Run\EEB9D700ED91F57255D1B6187EEB4BFD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\bg\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ne\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Media Player\Media Renderer\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows NT\Accessories\ja-JP\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\System\ja-JP\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Document Themes 16\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Portable Devices\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2E005DC2-F169-4346-A21D-221A9E86E3C2\root\vfs\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\da-DK\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\pt-BR\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Java\jre-1.8\lib\jfr\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\contrast-black\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\hi\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\zh_CN\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-white\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Mail\en-US\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\oc\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\co\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Resources\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\he-IL\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ast\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_mixer\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\plugins\video_chroma\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Defender\fr-FR\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Windows Sidebar\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\VideoLAN\VLC\skins\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\surfaceHub\en-US\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Common Files\System\msadc\fr-FR\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\how_to_decrypt.hta	fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
"C:\Users\Admin\AppData\Local\Temp\fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1775739321-368907234-981748298-1000\desktop.ini

Filesize
2KB

MD5
02828b052d67f6d379d132fbac012d54

SHA1
81fec29317c4e8d4a0b363116acf8ecb00a17a01

SHA256
8a546fd20ff152f016a935edcbb28d58f9a4548b25566d10748aa3808470e01e

SHA512
bd99389329ffdfcc20ca9970eca668c9ae52c43ae45d619d0560fc88db43cbfdd5b94191b35909be9745997ef8e1d36fb564986c4c4789ac9a6ea2412c020724

Download Submit
C:\$Recycle.Bin\S-1-5-21-1775739321-368907234-981748298-1000\how_to_decrypt.hta

Filesize
11KB

MD5
5bc969b015a9f27e5363719a02be7ded

SHA1
b194e21710131e7a2f53f61cecde2338a9b13b42

SHA256
1e469083e3f3aec831d2116baff364b481558cd05c9f9d0acf0527812c34259e

SHA512
a9281c1ec6b7e0e61632df79ed75207193a5d94dbcbbcf89f635f37b82d7519f1b655f019d8d3f904a80832941ae79c2272e158b6725f69716075d9a06ea4e0d

Download Submit
memory/4500-853-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-849-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-1472-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-2076-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-12541-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-16340-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-16341-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-16342-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4500-16343-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads