1d2b14679a8794ddfca09b38774d9b8f432955eb2d6a14cc45c79b009d5077f8 | Triage

Analysis

max time kernel
135s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 05:48

Sharing

Report Analysis Logs

General

Target

TT_Swift_Copy.exe
Size

840KB
MD5

51e3866b7d82195b81c27f923a7a5de9
SHA1

537c2600b5e907a6c27fdb1790b0c9e9d3116dd8
SHA256

1d2b14679a8794ddfca09b38774d9b8f432955eb2d6a14cc45c79b009d5077f8
SHA512

bf053907af1a91ecd4b1acd90f7feabe336fea44de9c7ad1a3dffc937b715fb5aa41da6736e46f4fd5f9415014869e3ed7082cae899fa8687ca832d41032d39a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 1768 WerFault.exe TT_Swift_Copy.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2184 WerFault.exe
Token: SeBackupPrivilege 2184 WerFault.exe
Token: SeDebugPrivilege 2184 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TT_Swift_Copy.exe
"C:\Users\Admin\AppData\Local\Temp\TT_Swift_Copy.exe"
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1160
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2184-2-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download