trigona | 0917dd528f04afc8c05240bd8e08cd75859b2e3b0bb10fc4c5d797f912b16701

General

Target

sample.exe
Size

1.1MB
MD5

b02301c3c8e078e2287c1fbca12f8a00
SHA1

f740cb6c2bb9973fe5a4dc3ac609e36436e719eb
SHA256

11b0e9673bbeb978aa9b95bcad43eb21bbe0bbaaf7e5a0e20d48b93d60204406
SHA512

d1e447fbc546234200c705d4b35151a18c3041e5e39c7849bd524b3cc76e51872b831b2f71fa92008a10c006ecf7c9e4f5279212e949078fe09ad8542e6ee7f9
SSDEEP

12288:3RYqX7pdDWExBDmkYhiPJSA0IqOO2vBwRns2MqnuY/gtTyoCCP:BY6frxBDmkY+Jr0Iql2v4sx+uxtTy/CP

Score

10^/10

trigona persistence ransomware

Malware Config

Signatures

Detects Trigona ransomware 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-4-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-5-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-405-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-772-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-4017-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-8981-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-9750-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-9828-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-9912-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-10787-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2360-11879-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\AF72AA6B92B9084985D3EAD9AB43B04C = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sample.exe"	sample.exe

Drops desktop.ini file(s) 12 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files (x86)\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Mahjong\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Purble Place\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Solitaire\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Chess\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\FreeCell\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Hearts\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	sample.exe

Drops file in Program Files directory 64 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui	sample.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css	sample.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.INF	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297725.WMF	sample.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui	sample.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\America\Moncton	sample.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF	sample.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02443_.WMF	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\America\Denver	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0088542.WMF	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg	sample.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml	sample.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.ELM	sample.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152890.WMF	sample.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\cy.txt	sample.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\mng2.txt	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk	sample.exe
File created	\??\c:\Program Files\Windows Mail\de-DE\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21433_.GIF	sample.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\THMBNAIL.PNG	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153307.WMF	sample.exe
File created	\??\c:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF	sample.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\jfr\default.jfc	sample.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js	sample.exe
File created	\??\c:\Program Files\Windows Sidebar\it-IT\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\browser\features\[email protected]	sample.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	sample.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\master_preferences	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar	sample.exe
File created	\??\c:\Program Files\Microsoft Games\Multiplayer\Spades\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar	sample.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\how_to_decrypt.hta

Filesize
11KB

MD5
3e0682a6fb93c4eb5fa40314842aa292

SHA1
3141ef9d74b06ba7f968bdb279ad2b575db78b83

SHA256
1af29723b96b3b7dc17d0925ef7ab85ed7e45229f4bd350a3149f536bd93270b

SHA512
45d14390ed8fc22e00e6de191e83525721f46440805ef0d212c22badbe9b69b7228163c96575dca37cc78698c6f4f757536f3a7b0f29f539d2d487a3666a4ad3

Download Submit
memory/2360-772-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-4-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-5-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-405-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-4017-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-8981-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-9750-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-9828-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-9912-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-10787-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-11879-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads