Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
12/02/2025, 17:13
Behavioral task
behavioral1
Sample
2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe
-
Size
1.7MB
-
MD5
9bce9dae679419198574f4c9837085db
-
SHA1
62a24f1ee057e936f3bf01749ecd7e3675d0f10d
-
SHA256
df9ef29e8789a798981a783fafbb85395a84e8733929b2c2290bcde263c2f3f8
-
SHA512
9647610d36379a789ab45e21b1997eeff560058cf55374b0a404be9474becca566ec0dd97cbb49b8d54da811bb5fe1e4d2e3e6de9b8fd57825181d611019f467
-
SSDEEP
24576:6G5C8hr/Vz9ih9i38xVEL/QQPL6BH8kQqNgQ+uH6FqgtMok4+iL:I8hJz8eDsH8kQqNs86F1yU
Score
10/10
Malware Config
Signatures
-
Detects Trigona ransomware 14 IoCs
resource yara_rule behavioral1/memory/1268-0-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-1-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-2-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-4-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-6-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-7-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-11-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-1898-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-2259-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-2958-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-8242-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-13067-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-13068-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona behavioral1/memory/1268-13069-0x0000000000400000-0x00000000005D1000-memory.dmp family_trigona -
Trigona
A ransomware first seen at the beginning of the 2022.
-
Trigona family
-
Drops startup file 1 IoCs
description ioc Process File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\38C39E7CD822703BCCCE9ED305D7305F = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe" 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe -
Drops desktop.ini file(s) 12 IoCs
description ioc Process File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\Chess\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Microsoft Games\Solitaire\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\desktop.ini 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Java\jre7\lib\zi\America\Kentucky\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Media Player\mpvis.DLL 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Mail\es-ES\msoeres.dll.mui 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\MSB1ENES.ITS 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Windows NT\Accessories\fr-FR\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Windows NT\Accessories\ja-JP\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\WT61FR.LEX 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ky.txt 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\mlib_image.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.ELM 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\jfr\profile.jfc 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Java\jre7\lib\zi\SystemV\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Windows Media Player\fr-FR\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\Help\1040\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Internet Explorer\D3DCompiler_47.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\America\Cayenne 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\ipcclientcerts.dll 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\MSB1ENFR.ITS 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe File created \??\c:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\how_to_decrypt.hta 2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51135749e7e8d85c957ab37b0800f40a7
SHA10001810748302ae192099baf5fd70e6a9ec5a0cf
SHA2569c3c511b0bf8b327e4a25afd22d475d738a0b20ed3c6ff9062ffd11755535754
SHA512bf826782f9a71aad796f20de2d7715beb4b2a45d81b4d7f9924e2d67ec55690784dcd557d9893a68c135b1820db3b277586cf4c2143429307f84e9c3f3add9c8
-
Filesize
12KB
MD5152880dc3c03395a816072624d4f06bd
SHA164c0538af8f77ac00ba5ebd44db24f67e226efa4
SHA256fa91243b51a94a5266f32d93b88c9a78e463b9d884aedb62feb3014c187ec838
SHA5126750e9df7da0a70a1cd47bfa1180fe015bc9b1f08b30df8fcf8209e9dc859b08e69d777cff878f6c0443776e5279a11776a47b63d41d18f5705aea38562cc7cd