trigona | d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2025, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
Size

1.1MB
MD5

1852be15aa8dcf664291b3849bd348e4
SHA1

eea811d2a304101cc0b0edebe6590ea0f3da0a27
SHA256

d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a
SHA512

91ca1d44fa98a43dbc53541cecb8ca656df01d6dc57783f12c70df49347520e150796834731b56107976b5b9dc915006d18caf39ac6792187d605542452bd4eb
SSDEEP

24576:hY6frxBDmkY+Jr0Iql2v4sx+uxtTyJuqe:bKuTvBwSdCud

Score

10^/10

trigona discovery persistence ransomware

Malware Config

Signatures

Detects Trigona ransomware 13 IoCs

resource	yara_rule
behavioral2/memory/1692-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-4-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-7-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-14-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-781-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-7525-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-16343-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-20742-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-20764-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-20765-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/1692-20766-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona
Trigona family
trigona

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1735	5696	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23178E8F610A741F90466C5FADA0FACF = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe"	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3311063739-2594902809-44604183-1000\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3311063739-2594902809-44604183-1000\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-400.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\sv-SE\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msado26.tlb	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Java\jre-1.8\legal\javafx\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MUOPTIN.DLL	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\nn.txt	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.TypeExtensions.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-125.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOIDRES.DLL	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Java\jdk-1.8\include\win32\bridge\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\WideTile.scale-125.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-white.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-white_scale-125.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\MyOffice.winmd	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Principal.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\am\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\clrjit.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Common Files\System\msadc\en-US\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Primitives.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\166.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\Newtonsoft.Json.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Marble.dxt	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-400_contrast-white.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-200.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Common Files\System\ado\es-ES\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2620	MicrosoftEdgeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
"C:\Users\Admin\AppData\Local\Temp\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1692

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0MwMzA3QzMtRTgxMS00QjE4LUFCMTUtMEZCMTZEQzhFOUU0fSIgdXNlcmlkPSJ7MDM4MjlENkEtRTM5OS00NjgyLTk2MzQtOEEyNTk3RTYxOTA4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUI2MTIwQjEtNjZBNi00OUU4LTlBNzAtOUI5M0NDMEU0MDUxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTg5Mzc3OTQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3311063739-2594902809-44604183-1000\desktop.ini

Filesize
2KB

MD5
b03da73f95f6c881195674fda026bd63

SHA1
2b264cf5fa9869ebf60323b6fdc91e411016f90a

SHA256
3794750f99ea3c933092baa8de6216c9e05287ac869e982a4b3781268647c8ff

SHA512
b564fc8994a4721e901bc46c39fd90e32c8d1191654170a03df09d545686680d18236f616a0e38f7d930328c3bc776cd77c04be76f17a7241816a2ff41447801

Download Submit
C:\how_to_decrypt.hta

Filesize
11KB

MD5
7711f3c3ba1bd87920feeb99efa62adb

SHA1
b52be18f93237af1814b6f252efdb8eed616af18

SHA256
da6511335b1e0a33113e9f13404ff3b2972723bb8c0dabd32e265dc113248c54

SHA512
9e34d06b6a56dad31945023f53323e36c9205924e32b665e4793f83fb848f030b0a1b23730e61b9c6ef81fe3f7258a87e2324e715b0cea0d34ae67957611aa58

Download Submit
memory/1692-4-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-14-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-781-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-7525-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-16343-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-20742-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-20764-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-20765-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1692-20766-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads