Resubmissions
12/02/2024, 19:56
240212-ynry9ada641012/02/2024, 19:35
240212-yazryabb7s1004/02/2024, 01:11
240204-bjxbvadhh923/01/2024, 03:08
240123-dnenpsfccr10Analysis
- max time kernel
106s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
23/01/2024, 03:08
General
- Target 85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431.exe
- Size 342KB
- Sample240123-dnenpsfccr
- SHA256 85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431
Malware Config
Signatures
- Trigona
A ransomware first seen at the beginning of the 2022.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops desktop.ini file(s) 4 IoCs
- Drops file in Program Files directory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431.exe"C:\Users\Admin\AppData\Local\Temp\85f4088286ac1eedc94ad9dc6465e9e4b89d1cde3012f9949450fcc9f2b60431.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5q50w442157fwg1h1trd550bh05.36zc2wisur._locked
desktop.ini
Click on 'Change' to select default PDF handler.pdf
aic_file_icons_retina_thumb.png
aic_file_icons_highcontrast.png
aic_file_icons_retina_thumb_highContrast_bow.png
aic_file_icons_retina_thumb_highContrast_wob.png
selection-actions2x.png
s_filetype_psd.svg
s_filetype_xd.svg
s_export_18.svg
A12_Spinner.gif
A12_Spinner_2x.gif
A12_Spinner_int.gif
A12_Spinner_int_2x.gif
adc_logo.png
apple-touch-icon-114x114-precomposed.png
apple-touch-icon-144x144-precomposed.png
apple-touch-icon-72x72-precomposed.png
available_for_trial.83g.d8c741l8i3r._locked
ccloud_retina.png
createpdf.svg
favicon.ico
illustrations.png
illustrations_retina.png
ind_prog.gif
large_trefoil_2x.png
logo_retina.png
progress_spinner.gif
progress_spinner_dark.gif
progress_spinner_dark2x.gif
s_download_pdf_18.svg
spectrum_spinner.svg
spectrum_spinner_process.svg
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
icons.png
icons_ie8.gif
icons_retina.png
illustrations.png
illustrations_retina.png
new_icons.png
new_icons_retina.png
exportpdf-selector.js
exportpdf-tool-view.js
ui-strings.js
ui-strings.js
ui-strings.js
core_icons.png
core_icons_fw.png
core_icons_retina.png
sample-thumb.png
check.cur
circle.cur
dot.cur
line.cur
text.cur
x.cur
file_icons.png
file_icons.png
s_empty_folder_state.svg
available_for_trial.32mg34z690g5z5kmup7u827858bp39q8eq225s416lg.70r._locked
ui-strings.js
selector.js
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
MobileAcrobatCard_Light.pdf
MobileScanCard_Light.pdf
available_for_trial.fj41f4u0n65dt7080h4fhhn14d160tniydd1j864iw.b5vkvv2r._locked
pdf-ownership-variant2-2x.gif
ui-strings.js
ui-strings.js
cstm_brand_preview2x.png
ui-strings.js
available_for_trial.3h0715d393tyv3x.h9b3xc59r._locked
Download_on_the_App_Store_Badge_en_135x40.svg
Download_on_the_App_Store_Badge_nl_135x40.svg
af_get.svg
am_get.svg
ar_get.svg
az_get.svg
be_get.svg
bg_get.svg
el_get.svg
et_get.svg
fil_get.svg
hu_get.svg
id_get.svg
iw_get.svg
lt_get.svg
lv_get.svg
ms_get.svg
nl_get.svg
pt_get.svg
ro_get.svg
sk_get.svg
sl_get.svg
th_get.svg
vi_get.svg
zh-hk_get.svg
flags.png
scanAppLogo.png
faf_icons.png
cloud_secured_lg.png
core_icons.png
sfs_icons.png
ui-strings.js
ui-strings.js
ui-strings.js
main.css
ui-strings.js
ui-strings.js
ui-strings.js
example_icons2x.png
available_for_trial.mo57nz21ubi.o4b67812nr._locked
core_icons.png
available_for_trial.7r3q63t1c6y57cz1w75a34dfjb5y1b57a3.yr._locked
core_icons.png
core_icons_retina.png
illustrations.png
illustrations_retina.png
plugin.js
ui-strings.js
ui-strings.js
available_for_trial.3k6832but9tkjaa5uf07g80wjmr5z.0l82nbj3r._locked
ui-strings.js
DisplayLanguageNames.en_GB_EURO.txt
57w76.nr._locked
java.exe
javaws.exe
bb5ih1nz.hyvj6r._locked
chrome_installer.exe
Workflow.Targets
Workflow.VisualBasic.Targets
MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe
12ur4br0p367i3n3m88z89vuuak5f482ch0le286t2.6b7621275r._locked
Edge.dat.DATA
EdgeWebView.dat.DATA
08of5o6jf5v852356t9518qf1c79r04pe6.bs3ji1r._locked
0cztl814ga5j8r8gq62yk6ifdjmj6xu537a24.cpr95w8cr._locked
af.pak.DATA
am.pak.DATA
ar.pak.DATA
as.pak.DATA
az.pak.DATA
bg.pak.DATA
bn-IN.pak.DATA
bs.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca.pak.DATA
cs.pak.DATA
cy.pak.DATA
da.pak.DATA
de.pak.DATA
el.pak.DATA
en-GB.pak.DATA
en-US.pak.DATA
es-419.pak.DATA
et.pak.DATA
eu.pak.DATA
fa.pak.DATA
fi.pak.DATA
fil.pak.DATA
fr-CA.pak.DATA
fr.pak.DATA
ga.pak.DATA
gd.pak.DATA
gl.pak.DATA
he.pak.DATA
hi.pak.DATA
hr.pak.DATA
hu.pak.DATA
i614.be9606e4r._locked
id.pak.DATA
is.pak.DATA
it.pak.DATA
ja.pak.DATA
ka.pak.DATA
kk.pak.DATA
km.pak.DATA
kn.pak.DATA
ko.pak.DATA
kok.pak.DATA
lb.pak.DATA
lo.pak.DATA
lv.pak.DATA
mi.pak.DATA
mk.pak.DATA
ml.pak.DATA
mr.pak.DATA
ms.pak.DATA
mt.pak.DATA
nb.pak.DATA
ne.pak.DATA
nl.pak.DATA
nn.pak.DATA
or.pak.DATA
pa.pak.DATA
pl.pak.DATA
pt-BR.pak.DATA
pt-PT.pak.DATA
qu.pak.DATA
ro.pak.DATA
ru.pak.DATA
sl.pak.DATA
sq.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Latn-RS.pak.DATA
sr.pak.DATA
sv.pak.DATA
ta.pak.DATA
te.pak.DATA
th.pak.DATA
tr.pak.DATA
tt.pak.DATA
ug.pak.DATA
uk.pak.DATA
ur.pak.DATA
vi.pak.DATA
zh-CN.pak.DATA
zh-TW.pak.DATA
preloaded_data.pb.DATA
autofill_labeling.ort.DATA
autofill_labeling_email.ort.DATA
nexturl.ort.DATA
SoftLandingAssetDark.gif.DATA
SoftLandingAssetLight.gif.DATA
icudtl.dat.DATA
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Canary.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
msedge_100_percent.pak.DATA
msedge_200_percent.pak.DATA
nacl_irt_x86_64.nexe.DATA
resources.pak.DATA
v8_context_snapshot.bin.DATA
Advertising
Analytics
Content
Entities
LICENSE
Logo.png
LogoBeta.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
available_for_trial.hoo4o1o5syo77qngs9ucct0xdzf68.99wy8pr._locked
identity_helper.Sparse.Stable.msix
msedge_proxy.exe
pwahelper.exe
maintenanceservice.exe
MSFT_PackageManagementSource.psm1
MSFT_PackageManagement.psm1
PackageManagementDscUtilities.psm1
PackageManagement.format.ps1xml
PackageProviderFunctions.psm1
PSGet.Format.ps1xml
PSGet.Resource.psd1
PSModule.psm1
setup.exe
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
available_for_trial.7ofzleu7930251281733vx.9665r._locked
available_for_trial.l2wwb4096w2721jph7cslg5788jo1b.28t73h2r._locked
available_for_trial.o5.7o3e600601r._locked
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
7qjrsu3ko23zaunz40p.jpr._locked
glib.md
gstreamer.md
libxml2.md
mesa3d.md
public_suffix.md
webkit.md
4g32z372rjnw.h27j258r._locked
bcel.md
dom.md
ecc.md
jpeg.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
santuario.md
xalan.md
xmlresolver.md
msvcp140_1.dll
msvcp140_2.dll
classlist
CIEXYZ.pf
PYCC.pf
content-types.properties
currency.data
deploy.jar
ffjcext.zip
messages_es.properties
messages_fr.properties
messages_ja.properties
messages_ko.properties
messages_zh_CN.properties
splash.gif
splash_11-lic.gif
71owrp81tyjvil.t7l0e684r._locked
access-bridge-64.jar
cldrdata.jar
jaccess.jar
nashorn.jar
sunec.jar
sunjce_provider.jar
sunmscapi.jar
sunpkcs11.jar
x59yg62i3fxyc50klijx9fita74l5.2rr._locked
zipfs.jar
flavormap.properties
fontconfig.bfc
fontconfig.properties.src
LucidaBrightDemiBold.ttf
LucidaBrightDemiItalic.ttf
LucidaBrightItalic.ttf
LucidaBrightRegular.ttf
LucidaSansDemiBold.ttf
LucidaSansRegular.ttf
LucidaTypewriterBold.ttf
LucidaTypewriterRegular.ttf
hijrah-config-umalqura.properties
javaws.jar
jce.jar
jfr.jar
default.jfc
profile.jfc
jfxswt.jar
jvm.hprof.txt
jmxremote.access
management.properties
net.properties
plugin.jar
psfontj2d.properties
resources.jar
blacklist
cacerts
java.security
US_export_policy.jar
local_policy.jar
US_export_policy.jar
local_policy.jar
public_suffix_list.dat
tzdb.dat
tzmappings
IntegratedOffice.exe
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
vccorlib140.dll
pkeyconfig-office.xrm-ms
pidgenx.dll
pkeyconfig-office.xrm-ms
PREVIEWTEMPLATE2.POTX
word2013.dotx
offsym.ttf
offsymb.ttf
offsymk.ttf
offsyml.ttf
offsymsb.ttf
offsymsl.ttf
offsymt.ttf
offsymxb.ttf
offsymxl.ttf
ISO690.XSL
zlibwapi.dll
libcrypto-1_1-x64.dll
libssl-1_1-x64.dll
UCRTBASE.DLL
mfc140u.dll
msvcp120.dll
msvcp140.dll
msvcr120.dll
vcruntime140.dll
SLINTL.DLL
AppXManifestLoc.16.en-us.xml
DBGCORE.DLL
DBGHELP.DLL
available_for_trial.2uz5g2v273tf851vv094620.6b2r._locked
Csi.dll
as80.xsl
as90.xsl
db2v0801.xsl
informix.xsl
msjet.xsl
orcl7.xsl
sql2000.xsl
sql70.xsl
sql90.xsl
sqlpdw.xsl
sybase.xsl
trdtv2r41.xsl
Microsoft.AnalysisServices.Common.dll
Microsoft.AnalysisServices.Excel.BackEnd.dll
Microsoft.Data.ConnectionUI.Dialog.dll
Microsoft.Data.ConnectionUI.dll
Microsoft.SqlServer.Configuration.SString.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
available_for_trial.436jqxq1v2v1bx30kt895t.7rw18r._locked
available_for_trial.8w88bslv338zx2v20zaj68.375jr._locked
concrt140.dll
mfc140u.dll
msvcp120.dll
msvcp140.dll
msvcr120.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
hive.xsl
70po5025uppe2xh3ii17cxp.j78xr._locked
as80.xsl
as90.xsl
msql.xsl
orcl7.xsl
sql120.xsl
sql90.xsl
sqlpdw.xsl
trdtv2r41.xsl
available_for_trial.77799k53a5755795vvl45l073sh0zi2c0767e93.gb2v3t4d8r._locked
vlc.mo
vlc.mo
vlc.mo
mscordaccore_amd64_amd64_6.0.2523.51912.dll
Microsoft.DiaSymReader.Native.amd64.dll
mscordaccore_amd64_amd64_8.0.23.53103.dll
D3DCompiler_47_cor3.dll
AirSpace.Etw.man
C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
C2RManifest.Proof.Culture.msi.16.en-us.xml
C2RManifest.Proof.Culture.msi.16.es-es.xml
C2RManifest.Proof.Culture.msi.16.fr-fr.xml
C2RManifest.Word.Word.x-none.msi.16.x-none.xml
C2RManifest.dcfmui.msi.16.en-us.xml
C2RManifest.excelmui.msi.16.en-us.xml
C2RManifest.office32mui.msi.16.en-us.xml
C2RManifest.office32ww.msi.16.x-none.xml
C2RManifest.officemui.msi.16.en-us.xml
C2RManifest.onenotemui.msi.16.en-us.xml
C2RManifest.osmmui.msi.16.en-us.xml
C2RManifest.osmuxmui.msi.16.en-us.xml
C2RManifest.powerpointmui.msi.16.en-us.xml
C2RManifest.shared.Office.x-none.msi.16.x-none.xml
C2RManifest.wordmui.msi.16.en-us.xml
integrator.exe
msoutilstat.etw.man
wordEtw.man
1w4oh59icurn003488w36y8i15s.2for._locked
utc.app.json.bk
Pending.GRL
edbres00001.jrs
user.bmp
user.png
vc_runtimeAdditional_x64.msi
dotnet-runtime-8.0.0-win-x64.msi
windowsdesktop-runtime-6.0.25-win-x64.msi
data_0
data_1
data_2
data_3
index
Login Data For Account
Safe Browsing Cookies
Functional SAN Data
onenote.exe_Rules.xml
onenote.exe.db
OneDriveSetup.exe
userTelemetryCache.otc.session
asrouter.ftl
Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}
Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}
Microsoft_Windows_Explorer
https___java_com_
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe
{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt
{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe
Apps.index
0.0.filtertrie.intermediate.txt
Apps.ft
0.0.filtertrie.intermediate.txt
Settings.ft
Settings.index
AppCache133471133827043772.txt
AppCache133471134918091284.txt
AppCache133471141905215248.txt
AppCache133471146239586940.txt
settings.dat
1657114595AmcateirvtiSty.sqlite
how_to_decrypt.hta
vcredist2010_x86.log.html
memory/3856-23996-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-5913-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-2-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-4-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-12-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-16-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-53845-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-44540-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-1-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-836-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-33547-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-0-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-50140-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3856-15784-0x0000000000400000-0x0000000000463000-memory.dmp