c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Signal.exe
Size

177.7MB
MD5

60395fa951d43300e09d76c7b1b876d1
SHA1

94f5757c2bba2f918cec19f1832e058c2558e5e7
SHA256

7261c1766bfbddf94b14e3b266b210df18e1e94500770c849dd7841d1a206d2c
SHA512

d8811a23f5de57b9b6e61cb03e5fd57e390538df38966e08f5a2839ae8b4d39998888bbabf19276836b28d7a3281ff5046573c62e0b27e399c8cd1ce6bc54f85
SSDEEP

1572864:v+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaX:vA5kyGScBQT/

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Signal.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\org.whispersystems.signal-desktop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe --start-in-tray"	Signal.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Signal.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation Signal.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	Signal.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Signal.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Signal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Signal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Signal.exe

Modifies registry class 14 IoCs

Processes:

Signal.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\ = "URL:signalcaptcha"	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\shell\open\command	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\shell	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\shell\open\command	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\shell	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Signal.exe\" \"%1\""	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\URL Protocol	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\ = "URL:sgnl"	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\sgnl\shell\open	Signal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\URL Protocol	Signal.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\signalcaptcha\shell\open	Signal.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Signal.exeSignal.exe

pid	process
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
1956	Signal.exe
2744	Signal.exe
2744	Signal.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Signal.exe

description	pid	process
Token: 33	1956	Signal.exe
Token: SeIncBasePriorityPrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe
Token: SeShutdownPrivilege	1956	Signal.exe
Token: SeCreatePagefilePrivilege	1956	Signal.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

Signal.exe

description	pid	process	target process
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 4860	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 3512	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 3512	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 2744	1956	Signal.exe	Signal.exe
PID 1956 wrote to memory of 2744	1956	Signal.exe	Signal.exe

C:\Users\Admin\AppData\Local\Temp\Signal.exe
"C:\Users\Admin\AppData\Local\Temp\Signal.exe"
1⤵
- Adds Run key to start application
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,1620921066654452660,3087131959094791395,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --fetch-schemes=attachment --streaming-schemes=attachment --field-trial-handle=2216,i,1620921066654452660,3087131959094791395,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Signal.exe
  "C:\Users\Admin\AppData\Local\Temp\Signal.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Signal" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1092,i,1620921066654452660,3087131959094791395,262144 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\config.json.93958751

Filesize
214B

MD5
a63b5e5c7617e7edaf3415a3ecbec21e

SHA1
f5e4197dcfaa0630e16d00b6dba6c31796b413b6

SHA256
7728964d96a28d24686e7ab77ea4dcfd472b6391bf0ff72705f4a046849aea11

SHA512
f670c3563e8cbeabc3cb54def4fe912f2264c3c198f44fa1f939a3d3a180a522dacfc8cc80444f54d6ffaafa49261cd71339306235a5460cd9fbfb15fe4dbba1

Download Submit
C:\Users\Admin\AppData\Roaming\Signal\ephemeral.json

Filesize
28B

MD5
c35daa5ff811f348dd78f3c6cb47ec55

SHA1
418a52d1e0a309cdaabf67d41466fa69123932d2

SHA256
3f34dc4928bf26fbfe9d252a0644b9f7a24150fd7575023ec7db60991dca1fcc

SHA512
e25b1d7a59d73959229a49675f8d27440accc265552b8b5460e487084e4a8210df5afd58b03a878ef937a893125b14327daadc3a5f0e74543c2543d02cf7f9ef

Download Submit
memory/2744-79-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-74-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-73-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-75-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-82-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-85-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-84-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-83-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-81-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download
memory/2744-80-0x000002CE6BC80000-0x000002CE6BC81000-memory.dmp

Filesize
4KB

Download