trigona | f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e

Resubmissions

21-01-2024 14:53

240121-r9tawaddhp 10

17-03-2023 06:39

230317-helswaef33 10

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
Size

1.1MB
MD5

e248e214c121845e69bbf266cc9e2853
SHA1

683a1a845f0c2d0f358d62a450f710f960190f2f
SHA256

f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e
SHA512

d5a5968b079b2a561f2adeaa1cff9ba8e2faac242ef362894dde0b8f72ec725780da651950d06e2b019369f34dbbaf31a497440b4aabe7f8357f789bbdab9031
SSDEEP

24576:KYxvmwliqDHWHVjdzuM7Br+e5rh+u7z7k:Zvmw3UjnrP9gQY

Score

10^/10

trigona discovery persistence ransomware

Malware Config

Signatures

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AAFBECD7D37C840560C709E6D969C468 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe"	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\desktop.ini	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\dataservices\DESKTOP.INI	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\f:\$recycle.bin\s-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\$recycle.bin\s-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\msquic.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\java\jre-1.8\bin\pack200.exe	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\dataservices\DESKTOP.INI	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\library\analysis\PROCDB.XLAM	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\css\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\bin\npt.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\licenses16\ProfessionalR_Retail-ppd.xrm-ms	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\bibliography\sort\YEAR.XSL	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\water\PREVIEW.GIF	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\System.Collections.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\locale\or\lc_messages\vlc.mo	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\plugins\stream_filter\libcache_read_plugin.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\mozilla firefox\uninstall\uninstall.log	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_anonymoususer_18.svg	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\clicktorun\AppVClient.man	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\ONENOTE_F_COL.HXK	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\Microsoft.Spatial.NetFX35.V7.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\fpa_f3\FA000000003	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\wordvisi.ttf	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\papyrus\PREVIEW.GIF	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\localized_images\fr-fr\PlayStore_icon.svg	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\reference assemblies\microsoft\framework\v3.0\PresentationFramework.Royale.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\RegisterLimit.dxf	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\vlc-cache-gen.exe	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\vsto\vstoee.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\reference assemblies\microsoft\framework\v3.0\System.IO.Log.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\clrjit.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\System.Xml.XPath.XDocument.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\bin\tnameserv.exe	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\cartridges\sybase.xsl	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\slate\PREVIEW.GIF	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\nls\ui-strings.js	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files\videolan\vlc\locale\da\lc_messages\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\sl-si\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\common files\system\ado\it-it\msader15.dll.mui	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\locale\af\lc_messages\vlc.mo	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\DropboxStorage.api	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\tracker\forms_received.gif	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\ccloud.png	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad.xml	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files\google\chrome\application\106.0.5249.119\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files\microsoft office\root\office16\odbc drivers\salesforce\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\reference assemblies\microsoft\framework\v3.5\es\System.Data.Entity.Design.Resources.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\[email protected]	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\[email protected]	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilesx64\microsoft analysis services\as oledb\140\dbghelp.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\dialogs\error_window.html	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\view.html	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\addins\powerpivot excel add-in\sqmapi.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File created	\??\c:\program files\uninstall information\how_to_decrypt.hta	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app\dev\nls\fr-ma\ui-strings.js	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
File opened for modification	\??\c:\program files\java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll	f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe

C:\Users\Admin\AppData\Local\Temp\f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe
"C:\Users\Admin\AppData\Local\Temp\f64211b0a49589bb53523dfb88eb9937ab88c8fcea98e2aabcbee90f1828e94e.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini

Filesize
897B

MD5
151ef62fdec8031b5b9ef4c5b5d9f0d6

SHA1
17c11d9b5508da6a36a12e4735373b6de482994e

SHA256
dc0432f3bee27a26569cf6c950493ca393240e0962fa9e3e593dca52060db9ac

SHA512
813413d097c10c9951ed3e5dde570774968b86ff3ab4d2e2fd9183d8c56268604a220cf66d219d5ddd8c47c0eecfcf5f975f83abf480542326de481daeff5c8d

Download Submit
C:\$Recycle.Bin\S-1-5-21-1815711207-1844170477-3539718864-1000\how_to_decrypt.hta

Filesize
11KB

MD5
51ff4d353adc5d947877e43da8a3fb62

SHA1
f7b99631470c2f897c73aaa1db402d5677e79e0d

SHA256
911b178da73d85e8d575716dfd267530ec8dc03bf4c1ac65d8e503d3bd371262

SHA512
ff688dde94f387cf75b36e63e72fc011ece662e053336eed3598ad4916258c8d4120d04528b91ca69f110a2b59f359585f712328026efce208de16249ddc765d

Download Submit
memory/2268-6903-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-8811-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-3-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-1-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-1969-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-5349-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-4-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-11157-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-14243-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-15472-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-15859-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-18170-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2268-21003-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads