Overview

overview

10

Static

static

10

2025-02-12...na.exe

windows7-x64

10

2025-02-12...na.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2025, 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe

  • Size

    1.7MB

  • MD5

    9bce9dae679419198574f4c9837085db

  • SHA1

    62a24f1ee057e936f3bf01749ecd7e3675d0f10d

  • SHA256

    df9ef29e8789a798981a783fafbb85395a84e8733929b2c2290bcde263c2f3f8

  • SHA512

    9647610d36379a789ab45e21b1997eeff560058cf55374b0a404be9474becca566ec0dd97cbb49b8d54da811bb5fe1e4d2e3e6de9b8fd57825181d611019f467

  • SSDEEP

    24576:6G5C8hr/Vz9ih9i38xVEL/QQPL6BH8kQqNgQ+uH6FqgtMok4+iL:I8hJz8eDsH8kQqNs86F1yU

Score
10/10
trigonadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects Trigona ransomware 14 IoCs
  • Trigona

    A ransomware first seen at the beginning of the 2022.

    ransomwaretrigona
  • Trigona family
    trigona
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-12_9bce9dae679419198574f4c9837085db_trigona.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:2384
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkQ0NzY2RDQtOTY5OS00OEQxLTlBNEUtQ0MzQTQ1Qzg3NkU1fSIgdXNlcmlkPSJ7MDI1MEZDRUItM0QzMy00RDk0LUE2RjQtRDhEQzk5M0IxQTQyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjQ2MENDRDctMTkxRi00NzMwLUI5MUYtQkJCQUYyRkI2MTEzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzMyNTk5MTE5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3796
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:10988
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:10992
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff664b56a68,0x7ff664b56a74,0x7ff664b56a80
        3⤵
        • Executes dropped EXE
        PID:9724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2508704002-2325818048-3575902788-1000\desktop.ini
    Filesize

    2KB

    MD5

    84c65fb28b26985a9dbf968d92ccd084

    SHA1

    2e302bc3059ab0c16e8c349debf4cd4e7a406e68

    SHA256

    098901ac64a1cdd9ef66dda4af9726c9693aa2f56fcef6eef76903bda7b288b2

    SHA512

    734af7143ba552d9e9fbc8230552f0b023bb29f22f353b58f6b9ab889b1e179e717fe772f02ae1eced105d49e19caf4ec27479c0b0d9acb3f06054c013daa049

    Download Submit

  • C:\$Recycle.Bin\S-1-5-21-2508704002-2325818048-3575902788-1000\how_to_decrypt.hta
    Filesize

    12KB

    MD5

    98a50855525cef9b0d3ff2ebf9cb5590

    SHA1

    09c1ca4e344598fbfc67b671faeb4273d9a921ce

    SHA256

    25f8269b4a67ab3486e3c8ea122327ea53d8fddbe094fdafc8c78ab834c73491

    SHA512

    0df9d0956417d4921151a53f4f4665d680aef7f116d7e95610f88f5e527646ec7237e3d668bdfea1cae95e1f806466f9f35245a64d9c77fb0abee1519af61973

    Download Submit

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{57D08155-833C-46C1-A3AF-224108FE40AF}\EDGEMITMP_401A1.tmp\setup.exe
    Filesize

    6.8MB

    MD5

    1b3e9c59f9c7a134ec630ada1eb76a39

    SHA1

    a7e831d392e99f3d37847dcc561dd2e017065439

    SHA256

    ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

    SHA512

    c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

    Download Submit

  • C:\Program Files\MsEdgeCrashpad\settings.dat
    Filesize

    280B

    MD5

    d29bb4a0b96e3d051598b214ccf2ee7a

    SHA1

    adf21ff509353ae8b2798106ed1ac7042280ead6

    SHA256

    7d4373da904c90df389625ed04a76bea62fc25ceed361bc2f57a9bfafe53f85a

    SHA512

    5a145cba8380992273a3f754e4bf39b81c8fd2e3e501436712e3ae4d657816f3934489b0c652f63974bcf6093da4ff50a050e1e4f5ee1a7f2cca1b6a3eeabdee

    Download Submit

  • C:\Program Files\MsEdgeCrashpad\throttle_store.dat
    Filesize

    20B

    MD5

    9e4e94633b73f4a7680240a0ffd6cd2c

    SHA1

    e68e02453ce22736169a56fdb59043d33668368f

    SHA256

    41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

    SHA512

    193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

    Download Submit

  • memory/2384-2864-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-9645-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-7-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-0-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-5-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-4398-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-5071-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-12-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-15677-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-20345-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-23909-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-3-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-2-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2384-1-0x0000000000400000-0x00000000005D1000-memory.dmp

    Filesize

    1.8MB

    Download