Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-02-2024 11:17

General

  • Target

    sample.exe

  • Size

    1.1MB

  • MD5

    a031edc72ddea262780560405c0ea4ae

  • SHA1

    7466b3a81dad69b01df5d4b1233734bc0454ced8

  • SHA256

    eda603f4d469d017917f5d6affeb992fdf3b7971e49868ece8c38fb8e6f8b444

  • SHA512

    608d6f490db60a8a0a9d25b5920bc1ced718a2de31a2293e799c79b15850e4a325f8dcdf004f95f09dad0093722d51cd83ee7bc33553a82a0cb87aff0004323f

  • SSDEEP

    24576:xY6frxBDmkY+Jr0Iql2v4sx+uxtTy1eFR:LKuTvBwSd7R

Malware Config

Signatures

  • Detects Trigona ransomware 13 IoCs
  • Trigona

    A ransomware first seen at the beginning of the 2022.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 13 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini

    Filesize

    2KB

    MD5

    e247613abae26f3dbe33ed3e7c3eed25

    SHA1

    6ab72d44e90f74dbfc6a638ac554b6ef73092879

    SHA256

    e8a1645ad6bea1e4879cef80ddb6613b3f20573628525b9875d4f7ed59fb1769

    SHA512

    2e66481a12849d2c471bc10bb5e192b054bb9ebae33c469b4ece701d7ed4ead95f61d8e0fb2d8a4dc8154fa4fdb9cb9a335d0846f53137248f35c51f482a73c6

  • C:\how_to_decrypt.hta

    Filesize

    11KB

    MD5

    3d64ba5c5bd122fcc61765310ddb8a4d

    SHA1

    60f10b555acd69bb6a161b63a9e8f0d9724e1b9b

    SHA256

    b7a0cd566a226bde66283549746e3aea6c8fa6103220e8c9068e9e822d2333fd

    SHA512

    2b1d3d674a9801e36fac3f64b14d4ddfce10002dece23bdd9ff8352a6d338311dbd0bc494c0ec70e71030f2ff199ca0d5adf689e17b80321a35c4953dcfb8ec7

  • memory/2896-5-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-0-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-12-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-3-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-1-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-730-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-1233-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-7134-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-9881-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-11670-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-11755-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-11892-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB

  • memory/2896-13309-0x0000000000400000-0x0000000000526000-memory.dmp

    Filesize

    1.1MB