516b18a120eb6f6380a7df0ff52def508e3da5e79b12a60647cc438e478e3363 | Triage

Analysis

max time kernel
136s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 11:47

Sharing

Report Analysis Logs

General

Target

Swift copy.exe
Size

405KB
MD5

76e2b77b8945a9d50034405c520fad02
SHA1

6645d985c7a50f7bf5bb1c49716e18f6af7de6ca
SHA256

516b18a120eb6f6380a7df0ff52def508e3da5e79b12a60647cc438e478e3363
SHA512

946aa476a2905bff089bb5fc6ade46f0d4b3202bfc34ca876be40dfd42729cda4556b6960225bef41c126fa206271c970e6d2e8bd7f641307e699169349820ad

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2744 664 WerFault.exe Swift copy.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2744 WerFault.exe
Token: SeBackupPrivilege 2744 WerFault.exe
Token: SeDebugPrivilege 2744 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 936
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download