c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Signal.exe
Size

177.7MB
MD5

60395fa951d43300e09d76c7b1b876d1
SHA1

94f5757c2bba2f918cec19f1832e058c2558e5e7
SHA256

7261c1766bfbddf94b14e3b266b210df18e1e94500770c849dd7841d1a206d2c
SHA512

d8811a23f5de57b9b6e61cb03e5fd57e390538df38966e08f5a2839ae8b4d39998888bbabf19276836b28d7a3281ff5046573c62e0b27e399c8cd1ce6bc54f85
SSDEEP

1572864:v+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaX:vA5kyGScBQT/

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Signal.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\org.whispersystems.signal-desktop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe --start-in-tray"	Signal.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Signal.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation Signal.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Signal.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Signal.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Signal.exe

Modifies registry class 14 IoCs

Processes:

Signal.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\ = "URL:signalcaptcha"	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\URL Protocol	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\shell\open\command	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\shell\open	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\shell	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\URL Protocol	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\shell	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\signalcaptcha\shell\open	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\ = "URL:sgnl"	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\sgnl\shell\open\command	Signal.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Signal.exeSignal.exe

pid	process
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4496	Signal.exe
4304	Signal.exe
4304	Signal.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Signal.exe

description	pid	process
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: 33	4496	Signal.exe
Token: SeIncBasePriorityPrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe
Token: SeShutdownPrivilege	4496	Signal.exe
Token: SeCreatePagefilePrivilege	4496	Signal.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

Signal.exe

description	pid	process	target process
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4268	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 2596	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 2596	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4304	4496	Signal.exe	Signal.exe
PID 4496 wrote to memory of 4304	4496	Signal.exe	Signal.exe

C:\Users\Admin\AppData\Local\Temp\Signal.exe
"C:\Users\Admin\AppData\Local\Temp\Signal.exe"
1⤵
- Adds Run key to start application
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2392,i,5518217404619839276,2696755702799201566,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --fetch-schemes=attachment --streaming-schemes=attachment --field-trial-handle=2620,i,5518217404619839276,2696755702799201566,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1940,i,5518217404619839276,2696755702799201566,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\config.json.3445109779

Filesize
214B

MD5
606c58ac5d69123425b066518964ffd5

SHA1
17b9f351f170e211cb519bcb8b081825e605593a

SHA256
63929c4a5684275dd867bc0915ac746663d38645da5ee7cf2cadcacc94e985e6

SHA512
80da3240cb0e6a09bf3699bdb35f496b032cf5628bcb3c9a08b9bc2fc24ca30dd2e920ba00e05b1416827b9013cb8e2f9563e517dd568f018dbe4cae69e5ce19

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\ephemeral.json

Filesize
28B

MD5
c35daa5ff811f348dd78f3c6cb47ec55

SHA1
418a52d1e0a309cdaabf67d41466fa69123932d2

SHA256
3f34dc4928bf26fbfe9d252a0644b9f7a24150fd7575023ec7db60991dca1fcc

SHA512
e25b1d7a59d73959229a49675f8d27440accc265552b8b5460e487084e4a8210df5afd58b03a878ef937a893125b14327daadc3a5f0e74543c2543d02cf7f9ef

Download Submit
memory/4304-80-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-75-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-74-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-73-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-79-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-85-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-84-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-83-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-82-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-81-0x000002456B0D0000-0x000002456B0D1000-memory.dmp

Filesize
4KB

Download