Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    08/07/2020, 06:53

General

  • Target

    Swift Copy #09765.exe

  • Size

    690KB

  • MD5

    f3b1bf9839a7f65a913e8298bb9ded82

  • SHA1

    c1b180b445500bbfbec473409683fb150afea3a2

  • SHA256

    ea9d8c28e623cbabc1407aa3da7a681adb93ef3e758fe31aaf664ff3998cddb5

  • SHA512

    ce230ee76f1cce30226df6a5f15e7f807638a7e356e44cc17bb60aac84630975b2ce516f129e8addb0483ae72be5991ab9c495f3f18be97a913a46b57dbfb0d4

Score
5/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        PID:3580
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
        3⤵
          PID:648

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/516-3-0x0000000001260000-0x0000000001277000-memory.dmp

      Filesize

      92KB

    • memory/516-4-0x0000000001260000-0x0000000001277000-memory.dmp

      Filesize

      92KB

    • memory/516-6-0x0000000001130000-0x00000000011DE000-memory.dmp

      Filesize

      696KB

    • memory/3580-0-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB