8d1bca33c800f77b9ce017415aaadf9d619543067f9336503e21460edbc18b17 | Triage™

Analysis

max time kernel
147s
max time network
94s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift.exe
Size 609KB
Sample200709-76kdmjbs8j
SHA256 8d1bca33c800f77b9ce017415aaadf9d619543067f9336503e21460edbc18b17
MD5 4e6f3e60d46cc93d8c7ae643341281ed
SHA1 a837c2d39028523a4294c31a363718f3f95bb195
SHA512 80c89c897306556a26fa20455f3977d3c8c16e8043a9b204d39589f1b89c6fbb2db596e912d119556c96645ef76d5ca07620980939a0da59843f3e44748b4ba2
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	Swift.exe
Token: SeRestorePrivilege	1048	WerFault.exe
Token: SeBackupPrivilege	1048	WerFault.exe
Token: SeDebugPrivilege	1048	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3692	Swift.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe
1048	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	3692	WerFault.exe	65

C:\Users\Admin\AppData\Local\Temp\Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Swift.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 1284
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x0000000004660000-0x0000000004661000-memory.dmp

Download

memory/1048-1-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Download