51291ed880000172b7b74827cdbeb6b9f81d714dba9f9f0d8390b11c2329e5c3

General

Target

12noon-alarm-plus-plus-setup-x64.exe
Size

3.4MB
MD5

c5e6e9ff9ab3dd565ed430ff745a5014
SHA1

a817367a96790ef64a3df6cca9c3470fc2e41bf3
SHA256

51291ed880000172b7b74827cdbeb6b9f81d714dba9f9f0d8390b11c2329e5c3
SHA512

4184c8921859ddd7610714cad5409c8ef3f5be39bf4e3133dcebfef3b244ad2f88d4fed0e3a3d28c46c994827de6fb13b11595fa7f92735e4b40a24ec50e65d9
SSDEEP

98304:HXZyJCV6D//lO4UVRZClz9Wpvq4w7lYmMSZaMVO4RZNr9T7c7NNZ1:HJy+E//lO4MI9WRq4LmMSZhrT9T7c7Nh

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
2052	12noon-alarm-plus-plus-setup-x64.exe
2052	12noon-alarm-plus-plus-setup-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\12noon Alarm++\License.txt	12noon-alarm-plus-plus-setup-x64.exe
File created	C:\Program Files\12noon Alarm++\Warranty.txt	12noon-alarm-plus-plus-setup-x64.exe
File created	C:\Program Files\12noon Alarm++\Alarm.exe	12noon-alarm-plus-plus-setup-x64.exe
File created	C:\Program Files\12noon Alarm++\Examples.alarm	12noon-alarm-plus-plus-setup-x64.exe
File created	C:\Program Files\12noon Alarm++\Alarm.pdb	12noon-alarm-plus-plus-setup-x64.exe
File created	C:\Program Files\12noon Alarm++\Uninstall.exe	12noon-alarm-plus-plus-setup-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12noon-alarm-plus-plus-setup-x64.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\CLSID	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\DefaultIcon	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\InprocHandler32\ = "old32.dll"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\ = "Alarm++ File"	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\DefaultIcon	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell\open\ = "Open"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell\open\command\ = "\"C:\\Program Files\\12noon Alarm++\\Alarm.exe\" \"%1\""	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\LocalServer32	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\ = "Alarm++ File"	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\InprocHandler32	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.alarm	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\DefaultIcon\ = "C:\\Program Files\\12noon Alarm++\\Alarm.exe,0"	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell\open\command	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.alarm\ = "12noon.Alarm.Document"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell\ = "open"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\LocalServer32\ = "C:\\Program Files\\12noon Alarm++\\Alarm.exe"	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\ProgID	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\ProgID\ = "12noon.Alarm.Document"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.alarm\InfoTip = "Alarm++ File"	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\CLSID\ = "{279E93A4-9430-11D1-8958-EC130DC10627}"	12noon-alarm-plus-plus-setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\12noon.Alarm.Document\shell\open	12noon-alarm-plus-plus-setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{279E93A4-9430-11D1-8958-EC130DC10627}\DefaultIcon\ = "C:\\Program Files\\12noon Alarm++\\Alarm.exe,0"	12noon-alarm-plus-plus-setup-x64.exe

C:\Users\Admin\AppData\Local\Temp\12noon-alarm-plus-plus-setup-x64.exe
"C:\Users\Admin\AppData\Local\Temp\12noon-alarm-plus-plus-setup-x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz7754.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz7754.tmp\nsDialogs.dll

Filesize
9KB

MD5
48f3e7860e1de2b4e63ec744a5e9582a

SHA1
420c64d802a637c75a53efc8f748e1aede3d6dc6

SHA256
6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156

SHA512
28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583

Download Submit

Analysis

Sharing