127d1bc07171d0d03ae4ee209692c3c226d0160e23fc08c805d01929a8997874 | Triage

Analysis

max time kernel
116s
max time network
121s
platform
windows10_x64
resource
win10
submitted
30-06-2020 06:33

Sharing

Report Analysis Logs

General

Target

Swift Copy.exe
Size

398KB
MD5

a1136dc9dcc542385d4388a1ede5bec4
SHA1

090a240c2b355a6ab832f3cc838655fd7482d566
SHA256

127d1bc07171d0d03ae4ee209692c3c226d0160e23fc08c805d01929a8997874
SHA512

a2fff752dfb5c6e75f0f09fbac491719d701793027a390f2623b9e4f2b6c37c36f8c37533a50e2b9e13e5b81447a846bebfb66319950e509d37ee5c0c09e38fd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3556 3056 WerFault.exe Swift Copy.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3556 WerFault.exe
Token: SeBackupPrivilege 3556 WerFault.exe
Token: SeDebugPrivilege 3556 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-0-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/3556-1-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download