trigona | 0917dd528f04afc8c05240bd8e08cd75859b2e3b0bb10fc4c5d797f912b16701

General

Target

sample.exe
Size

1.1MB
MD5

b02301c3c8e078e2287c1fbca12f8a00
SHA1

f740cb6c2bb9973fe5a4dc3ac609e36436e719eb
SHA256

11b0e9673bbeb978aa9b95bcad43eb21bbe0bbaaf7e5a0e20d48b93d60204406
SHA512

d1e447fbc546234200c705d4b35151a18c3041e5e39c7849bd524b3cc76e51872b831b2f71fa92008a10c006ecf7c9e4f5279212e949078fe09ad8542e6ee7f9
SSDEEP

12288:3RYqX7pdDWExBDmkYhiPJSA0IqOO2vBwRns2MqnuY/gtTyoCCP:BY6frxBDmkY+Jr0Iql2v4sx+uxtTy/CP

Score

10^/10

trigona discovery persistence ransomware

Malware Config

Signatures

Detects Trigona ransomware 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3856-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-4-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-6-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-516-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-9250-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-11666-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-11667-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-11668-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-11669-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/3856-11670-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D41D8669A36291EDD82BC1CBE9E31356 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sample.exe"	sample.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops desktop.ini file(s) 2 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\desktop.ini	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	sample.exe

Drops file in Program Files directory 64 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\6445_48x48x32.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms	sample.exe
File created	\??\c:\Program Files\VideoLAN\VLC\skins\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-150_contrast-white.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-125.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppWord32x32.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Error.jpg	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notification-checkbox.css	sample.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadomd28.tlb	sample.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\SMSConnect2x.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\browser\features\[email protected]	sample.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxMetadata\how_to_decrypt.hta	sample.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\or\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\accessibility_keyboard_arrows.png	sample.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\msjet.xsl	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\sendingDark.gif	sample.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_contrast-black.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_OwlEye.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle	sample.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJH.TTC	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48_altform-unplated.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\BhaiMDL2.2.52.ttf	sample.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\CottonCandy.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\EXPEDITN.INF	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-400.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\SpeechOff.wav	sample.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\PREVIEW.GIF	sample.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_contrast-white.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_lt.json	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png	sample.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\how_to_decrypt.hta	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-125.png	sample.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms	sample.exe
File opened for modification	\??\c:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	sample.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\how_to_decrypt.hta
Filesize
11KB

MD5
245572d92eb7c7430598b322ab1d177a

SHA1
86cc52e6e27d6e30b6fcd4d4cba8525dfb0f60aa

SHA256
aba822ad028d159d1a6761c951c1344bdddbbb38c182cfeca2ce438a401bb979

SHA512
01d4ed22f712c5a173922ddf6f208ca9f8d70cf4e274e4683cd0cbe0f457c20b6d7112bfdd43691080b094f5a8cebabad955eccb428b6a70a492262773916134

Download Submit
memory/3856-516-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-4-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-6-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-9250-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-11666-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-11667-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-11668-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-11669-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/3856-11670-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads