Analysis
-
max time kernel
135s -
max time network
103s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 05:48
Static task
static1
Behavioral task
behavioral1
Sample
TT_Swift_Copy.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TT_Swift_Copy.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
TT_Swift_Copy.exe
-
Size
840KB
-
MD5
51e3866b7d82195b81c27f923a7a5de9
-
SHA1
537c2600b5e907a6c27fdb1790b0c9e9d3116dd8
-
SHA256
1d2b14679a8794ddfca09b38774d9b8f432955eb2d6a14cc45c79b009d5077f8
-
SHA512
bf053907af1a91ecd4b1acd90f7feabe336fea44de9c7ad1a3dffc937b715fb5aa41da6736e46f4fd5f9415014869e3ed7082cae899fa8687ca832d41032d39a
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2184 1768 WerFault.exe TT_Swift_Copy.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe 2184 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2184 WerFault.exe Token: SeBackupPrivilege 2184 WerFault.exe Token: SeDebugPrivilege 2184 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT_Swift_Copy.exe"C:\Users\Admin\AppData\Local\Temp\TT_Swift_Copy.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 11602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken