661d3f465880ba56d3af8d6fc5d18b807921f1b4f4c4a48a5781ba4ccea2e049

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Signal.exe
Size

172.4MB
MD5

5b27507cc4534fa7056ea446d2c41ab0
SHA1

8e9937c140aad75a397136bff4b13b5a11ade021
SHA256

247f158b00c753297d2b4425ce775b50e01bd0c5b1f23c28ae1502fd51172e48
SHA512

666f6124868d339a309a665f704f7929477e172c02ddcd6adeb5fa6e62236e93885697cd928e30e7bd0398a3a54fcbc8d641fe8d20a7f1e192b918f0d95a696e
SSDEEP

1572864:7VzcyEjO1TyBvzfZHwlBuauSfmDFfEP/U9Je4Lhb9mMFVYQSkxbD7O:8z6fgxbDS

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\org.whispersystems.signal-desktop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe --start-in-tray"	Signal.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Signal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Signal.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Signal.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\shell\open\command	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\shell	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\ = "URL:signalcaptcha"	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\shell	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\shell\open	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\URL Protocol	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\ = "URL:sgnl"	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\sgnl\shell\open	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\URL Protocol	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\signalcaptcha\shell\open\command	Signal.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1192	Signal.exe
1636	Signal.exe
1636	Signal.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe
Token: SeShutdownPrivilege	1192	Signal.exe
Token: SeCreatePagefilePrivilege	1192	Signal.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 4848	1192	Signal.exe	87
PID 1192 wrote to memory of 1236	1192	Signal.exe	88
PID 1192 wrote to memory of 1236	1192	Signal.exe	88
PID 1192 wrote to memory of 1636	1192	Signal.exe	91
PID 1192 wrote to memory of 1636	1192	Signal.exe	91

C:\Users\Admin\AppData\Local\Temp\Signal.exe
"C:\Users\Admin\AppData\Local\Temp\Signal.exe"
1⤵
- Adds Run key to start application
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,2975491109474039810,3836142560013384052,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --fetch-schemes=attachment --streaming-schemes=attachment --field-trial-handle=2192,i,2975491109474039810,3836142560013384052,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --fetch-schemes=attachment --streaming-schemes=attachment --app-user-model-id=org.whispersystems.signal-desktop --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=CSSPseudoDir,CSSLogical --disable-blink-features=Accelerated2dCanvas,AcceleratedSmallCanvases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3292,i,2975491109474039810,3836142560013384052,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  - Checks computer location settings
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\config.json.3675338537

Filesize
214B

MD5
cf9ba7cd75207b44f9b3ee4cf2a909df

SHA1
da83f54c7739da4cfb28e2ed3013654a3a983ddf

SHA256
3a987e9e6be7ec4e26765441a56933f2e7e8bf210d63fe25c451a2bb8fffb120

SHA512
450b919364aee244b9e745c9616c8393a3fadd8d3eb0fbef1672874cec596fe9f731577a89ac1e5f42376611fa3ad4e341f57723f4afb04d148af446d8632f89

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\ephemeral.json

Filesize
28B

MD5
c35daa5ff811f348dd78f3c6cb47ec55

SHA1
418a52d1e0a309cdaabf67d41466fa69123932d2

SHA256
3f34dc4928bf26fbfe9d252a0644b9f7a24150fd7575023ec7db60991dca1fcc

SHA512
e25b1d7a59d73959229a49675f8d27440accc265552b8b5460e487084e4a8210df5afd58b03a878ef937a893125b14327daadc3a5f0e74543c2543d02cf7f9ef

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\ephemeral.json

Filesize
106B

MD5
80665dfa92786905b7cfaf23fff21438

SHA1
b9ddbbc0129e0f21ac6abf43e9ffc5fe1f9c82e1

SHA256
91be126e3c6a8467da56f6ad5e7e61c18d9fb8b1b60b2406bdeb4db0a4c651ee

SHA512
6d7e632a4a46a25a93db5bbd3322935d4ac2c24343f28dedf9c7445c44fd0788996d71155a7c8686fc376dd5a4830f060e11239eefe32bebc707551dcd2b10af

Download Submit