Overview

overview

10

Static

static

10

704f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    209s
  • max time network
    217s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2024 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    704f1.exe

  • Size

    1.1MB

  • MD5

    67dd0708a2dcbe6b7661fd5eb4593ea7

  • SHA1

    3d496563984c73e129577da8ca87d3e823fdcce4

  • SHA256

    704f1655ce9127d7aab6d82660b48a127b5f00cadd7282acb03c440f21dae5e2

  • SHA512

    6dc6949196b6aa1e44564c955bf02b45e74247c23408e24fe206087725922dcb5cebb5db58635414313e6c96cfba26758919509ecd0e19832506069236dd9c21

  • SSDEEP

    24576:oYj5E9T+xHeQhNmYOnW8FQrbID+u9v1Qs:Z5E9LQvRrtSvB

Score
10/10
trigonadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects Trigona ransomware 20 IoCs
  • Trigona

    A ransomware first seen at the beginning of the 2022.

    ransomwaretrigona
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\704f1.exe
    "C:\Users\Admin\AppData\Local\Temp\704f1.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\appdata\local\temp\how_to_decrypt.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:4088
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OptimizeSubmit.ps1xml
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:11840
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:11624
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:11624 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:11792
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:11288
      • C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
        "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\RequestExport.rtf"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:11388
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:2060

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PerfLogs\how_to_decrypt.hta
        Filesize

        11KB

        MD5

        46f6c22847169bbb882715413f9b86ea

        SHA1

        1d5bb88278856993c2754d4c758a2b359f0e9e07

        SHA256

        342d890c7e8367aa6d55cd8f2c203b2971e5cf9d598133c59eb79f3fe04117a7

        SHA512

        cd985c44fd6403176f53e858f96f54aec05f93913d8b4cee38d554247c0fa77fb3ed007b6590d93d665533b7528cfcb2dfc0fed6a0f4e7cd49d360e333aaa7a6

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5B2BEB3B-C9D8-11EE-9BE3-5A2E32B6DBC3}.dat
        Filesize

        6KB

        MD5

        fd14b51530fffcdd945cb7de781ba4a8

        SHA1

        cc75c22cd2ef9502fe0cece384592b384e17f135

        SHA256

        76ab4e115e6c3edf757797f38d1644d59df09cc83ffe6d9da0cc02ebe858753a

        SHA512

        991289844e82abb7c77dbc766d9051a2a51a00f9784430e4995b88e7e370658aab30d2f76cc9d44d762c03262a718082768b0f121a032d37d69d82e107815c83

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{BFF9F9CB-9B3E-11EE-9BDC-7E02F21A0140}.dat
        Filesize

        7KB

        MD5

        928b7a0aef82c5d2f80a6195e5e62030

        SHA1

        08000b0d9980e35e5bbee181083059cf2b9cae01

        SHA256

        87aed9a7cacd23fa7b4eb0a0ae77766f4b4b69d9f927b4c2e9995c9287d06f33

        SHA512

        1bb7eda67eeff291013fcfcef475e79b929a21b7f72820066d11a6f8c4fbb740ae40baffcc013e4169ab0eb5f012c9317530c7271a23167d8f33a1cf1e420e35

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{5B2BEB3C-C9D8-11EE-9BE3-5A2E32B6DBC3}.dat
        Filesize

        6KB

        MD5

        1b605976b81a5e7e3bd2c4b942a873dc

        SHA1

        fc99d4b0b95fffa6a38eefe88fafc9da7731ec1e

        SHA256

        b0fe7dfa93ec89a0fcf45cbdb105cc7690c24bf1ffd626a2cfe29f2e2e11a895

        SHA512

        16002be1653703b5fee31663ba2231ba239cc07bf07a943e89f82b2b46486c88859c1626d94d94c8c01782a8a8e07567d941ad23fbc74799d75b2be2f29918a9

        Download Submit

      • memory/2564-21125-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-28700-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-778-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-880-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-2494-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-5826-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-9665-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-12645-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-14501-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-16297-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-0-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-26800-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-27204-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-7-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-4-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-3-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-1-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-31721-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-34242-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-34244-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2564-34245-0x00000000065D0000-0x0000000006BD8000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2564-34247-0x0000000001740000-0x0000000001764000-memory.dmp

        Filesize

        144KB

        Download

      • memory/2564-34248-0x0000000001810000-0x000000000181F000-memory.dmp

        Filesize

        60KB

        Download

      • memory/2564-34249-0x0000000001830000-0x00000000018A4000-memory.dmp

        Filesize

        464KB

        Download

      • memory/2564-34250-0x0000000008BE0000-0x0000000008CA2000-memory.dmp

        Filesize

        776KB

        Download