Overview

overview

8

Static

static

3

SmartSign_...et.exe

windows10-2004-x64

8

SmartSign_...et.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/10/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SmartSign_AggiornamentoDaInternet.exe
  • Size 5.3MB
  • Sample261030-phpghadv2l
  • SHA256 f252adeb6384ef56f9041187e8b0276d7d6bcae5f28e56f6a4144b901a7cd872
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SmartSign_AggiornamentoDaInternet.exe
    "C:\Users\Admin\AppData\Local\Temp\SmartSign_AggiornamentoDaInternet.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" RunFromCD RunFromMenu InstallAndRunAggInternet:YES
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione.exe
        "C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione.exe" Start
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe
          C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe RunFromCD RunFromMenu InstallAndRunAggInternet:YES RunFromBootStrapper
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RunAppOn64bit_NET40.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX0\RunAppOn64bit_NET40.exe C:\Windows\Regedit.exe| /s "C:\Users\Admin\AppData\Local\Temp\rad94A6F.tmp"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4788
            • C:\Windows\Regedit.exe
              "C:\Windows\Regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\rad94A6F.tmp"
              6⤵
              • Runs regedit.exe
              PID:680
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RegOcx32.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX0\RegOcx32.exe
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1880
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\system32\netsh.exe advfirewall firewall delete rule "name=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" dir=in
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4256
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\system32\netsh.exe advfirewall firewall delete rule "name=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" dir=out
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4320
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\system32\netsh.exe advfirewall firewall add rule "name=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" dir=in action=allow "program=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" enable=yes remoteip=LocalSubnet profile=any protocol=any
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4504
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\system32\netsh.exe advfirewall firewall add rule "name=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" dir=out action=allow "program=C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe" enable=yes remoteip=LocalSubnet profile=any protocol=any
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AvvioInstallazione_DaEseguire.ini
        • Path C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione_DaEseguire.ini
        • Size 157B
        • SHA256 230ab07f08ef90a6c3e84ba1187c3a019057d413175051e9621d1523fffa6200
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AvvioInstallazione_DaMappare.ini
        • Path C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione_DaMappare.ini
        • Size 102B
        • SHA256 83187277e11676df07a7afdbf951f2af02b2c790810ae65cae336564c7a8460d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AvvioInstallazione_Log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione_Log.txt
        • Size 1KB
        • SHA256 edf31333ff15498c518dc52cf1820aff2f0568aeb0f24ee329cda6868c6ae6dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AvvioInstallazione_Log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\AvvioInstallazione_Log.txt
        • Size 1KB
        • SHA256 41f67d6ee51178841d89110536a0deb2865ba9dd76bcaf98e5e4e6034ce3107f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AvvioInstallazione.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AvvioInstallazione.exe
        • Size 72KB
        • SHA256 f578c2ea44ed3c548f7df9bb5e92a2826b5dc77d169b5117a760977ae539f7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lastver.ini
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Lastver.ini
        • Size 275B
        • SHA256 647c6b84ef95f9e4e8fdddc00ca6c1364073ed8d387ffaf1a65c63a68cff1617
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSCOMCT2.OCX
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSCOMCT2.OCX
        • Size 632KB
        • SHA256 2b7a1f905486736eda8b51add1bc2590c2a6d9d5a9ab7565335d989f39c0eb8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSCOMCTL.OCX
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSCOMCTL.OCX
        • Size 1.0MB
        • SHA256 09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSWINSCK.OCX
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSWINSCK.OCX
        • Size 106KB
        • SHA256 78dcd52e2311d08fc405ac2b54686ee66dda4fa68994819ae3315172b27e1f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REGOCX32.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\REGOCX32.EXE
        • Size 24KB
        • SHA256 ec854dab21a0739e342f73e86c45f91a5dc4a11ba712a1eb7f4b02221d0af6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RunAppOn64bit_NET40.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\RunAppOn64bit_NET40.exe
        • Size 29KB
        • SHA256 30b767729d9b1ea113a3f750f1a3ce1a8b0069581e21edf800aa6cc27013c305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetupUnificato.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe
        • Size 1.5MB
        • SHA256 224e741bddd48721c3be3d086233fae7224d409d96ca52543eb5daa5871f5195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetupUnificato.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupUnificato.exe.manifest
        • Size 1KB
        • SHA256 94ae0127fa0ebf82dcd33497d9b9f52afbd69ee7ef5ccddefe3af4eb65210539
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rad94A6F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\rad94A6F.tmp
        • Size 134B
        • SHA256 afb9a6e9fa063b8e57293a7016b9118f24cc06c13eca6d6a326e870980bbf16b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1880-126-0x0000000000010000-0x0000000000018000-memory.dmp
        Download

        memory/4788-119-0x0000000000380000-0x000000000038A000-memory.dmp
        Download