76920592836662d1651d20afd9ac1afee41c96324e1cb7ddfde3698edc4dc628

General

Target

DigioSmartClientWinV1.exe
Size

2.6MB
MD5

2c26a5fe35fb0d917f94abf706dc37ca
SHA1

3aacc94414991041c970ef8f09980e5966e9e18b
SHA256

76920592836662d1651d20afd9ac1afee41c96324e1cb7ddfde3698edc4dc628
SHA512

a6f39e56017beac8e7a1085e415e5e52d439d7a6ed6bdd59505e44bdcf39f253ceede3f4754bcf13c508d51247e04d8bcf2b6259c569bdeb98282c9d8c60a1b6
SSDEEP

49152:m75D5c14Z/7oFu9TNtROHcXUY2he3E/6BaMT8N2x9mV7dfR:K504Z/7x9XRO8F2c3GN2vYJ5

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

DigioSmartClientWinV1.tmpDigioSmartClient.exe

pid process

1412 DigioSmartClientWinV1.tmp
316 DigioSmartClient.exe
Loads dropped DLL 2 IoCs

Processes:

DigioSmartClientWinV1.execmd.exe

pid process

1356 DigioSmartClientWinV1.exe
604 cmd.exe

pid	process
1412	DigioSmartClientWinV1.tmp
316	DigioSmartClient.exe

pid	process
1356	DigioSmartClientWinV1.exe
604	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DigioSmartClientWinV1.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	DigioSmartClientWinV1.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DigioSmartClient = "\"C:\\Program Files (x86)\\DigioSmartClient\\DigioSmartClient.exe\""	DigioSmartClientWinV1.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

Processes:

DigioSmartClientWinV1.tmp

description	ioc	process
File created	C:\Program Files (x86)\DigioSmartClient\is-4D9T5.tmp	DigioSmartClientWinV1.tmp
File created	C:\Program Files (x86)\DigioSmartClient\is-OHKK1.tmp	DigioSmartClientWinV1.tmp
File created	C:\Program Files (x86)\DigioSmartClient\is-HE2NH.tmp	DigioSmartClientWinV1.tmp
File created	C:\Program Files (x86)\DigioSmartClient\is-GNBVB.tmp	DigioSmartClientWinV1.tmp
File opened for modification	C:\Program Files (x86)\DigioSmartClient\unins000.dat	DigioSmartClientWinV1.tmp
File opened for modification	C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe	DigioSmartClientWinV1.tmp
File created	C:\Program Files (x86)\DigioSmartClient\unins000.dat	DigioSmartClientWinV1.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DigioSmartClientWinV1.tmp

pid process

1412 DigioSmartClientWinV1.tmp
1412 DigioSmartClientWinV1.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DigioSmartClientWinV1.tmp

pid process

1412 DigioSmartClientWinV1.tmp

pid	process
1412	DigioSmartClientWinV1.tmp
1412	DigioSmartClientWinV1.tmp

pid	process
1412	DigioSmartClientWinV1.tmp

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

DigioSmartClientWinV1.exeDigioSmartClientWinV1.tmpcmd.exeDigioSmartClient.exejavaw.exe

description	pid	process	target process
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1356 wrote to memory of 1412	1356	DigioSmartClientWinV1.exe	DigioSmartClientWinV1.tmp
PID 1412 wrote to memory of 604	1412	DigioSmartClientWinV1.tmp	cmd.exe
PID 1412 wrote to memory of 604	1412	DigioSmartClientWinV1.tmp	cmd.exe
PID 1412 wrote to memory of 604	1412	DigioSmartClientWinV1.tmp	cmd.exe
PID 1412 wrote to memory of 604	1412	DigioSmartClientWinV1.tmp	cmd.exe
PID 604 wrote to memory of 316	604	cmd.exe	DigioSmartClient.exe
PID 604 wrote to memory of 316	604	cmd.exe	DigioSmartClient.exe
PID 604 wrote to memory of 316	604	cmd.exe	DigioSmartClient.exe
PID 604 wrote to memory of 316	604	cmd.exe	DigioSmartClient.exe
PID 316 wrote to memory of 1076	316	DigioSmartClient.exe	javaw.exe
PID 316 wrote to memory of 1076	316	DigioSmartClient.exe	javaw.exe
PID 316 wrote to memory of 1076	316	DigioSmartClient.exe	javaw.exe
PID 316 wrote to memory of 1076	316	DigioSmartClient.exe	javaw.exe
PID 1076 wrote to memory of 1200	1076	javaw.exe	cmd.exe
PID 1076 wrote to memory of 1200	1076	javaw.exe	cmd.exe
PID 1076 wrote to memory of 1200	1076	javaw.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe
"C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\is-V9P0I.tmp\DigioSmartClientWinV1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-V9P0I.tmp\DigioSmartClientWinV1.tmp" /SL5="$70124,2498203,62976,C:\Users\Admin\AppData\Local\Temp\DigioSmartClientWinV1.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:604

C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe
"C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\system32\cmd.exe
cmd.exe /c "wmic OS get OSArchitecture"
6⤵
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe

Filesize
2.5MB

MD5
68cd3c29f0a12a5ed1900130caf65a38

SHA1
3b871a5756c4817939047ae00a779bee948e6d90

SHA256
d32469d0c846575fa17df0227326221a11bd2c8437504abe394ae2472c2b0d41

SHA512
c1226a8dd95af3349e106fb223819adbc8153e9fb5ec77c49f68fd4a6d0b92589d3105a292a3f91572c1645a2146ef72f5a937ffeae228d21a5838b363ee80e4

Download Submit
C:\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe

Filesize
2.5MB

MD5
68cd3c29f0a12a5ed1900130caf65a38

SHA1
3b871a5756c4817939047ae00a779bee948e6d90

SHA256
d32469d0c846575fa17df0227326221a11bd2c8437504abe394ae2472c2b0d41

SHA512
c1226a8dd95af3349e106fb223819adbc8153e9fb5ec77c49f68fd4a6d0b92589d3105a292a3f91572c1645a2146ef72f5a937ffeae228d21a5838b363ee80e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V9P0I.tmp\DigioSmartClientWinV1.tmp

Filesize
702KB

MD5
3aa677774c26200eb78f1c5e23ee981c

SHA1
46688b35cc291c45b2eea674cc8cee4420652ecf

SHA256
8106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37

SHA512
b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V9P0I.tmp\DigioSmartClientWinV1.tmp

Filesize
702KB

MD5
3aa677774c26200eb78f1c5e23ee981c

SHA1
46688b35cc291c45b2eea674cc8cee4420652ecf

SHA256
8106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37

SHA512
b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557

Download Submit
\Program Files (x86)\DigioSmartClient\DigioSmartClient.exe

Filesize
2.5MB

MD5
68cd3c29f0a12a5ed1900130caf65a38

SHA1
3b871a5756c4817939047ae00a779bee948e6d90

SHA256
d32469d0c846575fa17df0227326221a11bd2c8437504abe394ae2472c2b0d41

SHA512
c1226a8dd95af3349e106fb223819adbc8153e9fb5ec77c49f68fd4a6d0b92589d3105a292a3f91572c1645a2146ef72f5a937ffeae228d21a5838b363ee80e4

Download Submit
\Users\Admin\AppData\Local\Temp\is-V9P0I.tmp\DigioSmartClientWinV1.tmp

Filesize
702KB

MD5
3aa677774c26200eb78f1c5e23ee981c

SHA1
46688b35cc291c45b2eea674cc8cee4420652ecf

SHA256
8106da5409b257dd305a2de755abc653a48e158f7a8d6348a9a5ad36c5708e37

SHA512
b234f4dc2c85e47a9bc4616b1e53d20ce428c14e2487332d05c8cc4edc94486c79869a78c4761dc8c41ede8d9808b974c2da0a285f6a74a9ef581a460bfc7557

Download Submit
memory/316-67-0x0000000000000000-mapping.dmp

Download
memory/604-64-0x0000000000000000-mapping.dmp

Download
memory/1076-71-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1076-70-0x0000000000000000-mapping.dmp

Download
memory/1356-61-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1356-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1356-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1412-58-0x0000000000000000-mapping.dmp

Download
memory/1412-62-0x0000000074571000-0x0000000074573000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads