ca8f27e8398ec81d1bbaa5714ef8bb4c557edeb706690bc031a3089c990bbef1 | Triage

Analysis

max time kernel
124s
max time network
134s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:38

Sharing

Report Analysis Logs

General

Target

Swift Copy.exe
Size

449KB
MD5

f68a1350469f33284215b4bdeece9684
SHA1

a18e517eb1409c06d73cae87d3253ea83ad8c97f
SHA256

ca8f27e8398ec81d1bbaa5714ef8bb4c557edeb706690bc031a3089c990bbef1
SHA512

8d47ca1fe59f89112b09cde3648e8b2bc4d29cc9b5abcb3019b4d35fdf49d8e9671ca61674154a9ee02630b137af456b08e691996d04cfb1a3b72445d261867e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 3588 WerFault.exe Swift Copy.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3792 WerFault.exe
Token: SeBackupPrivilege 3792 WerFault.exe
Token: SeDebugPrivilege 3792 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 912
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/3792-1-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/3792-10-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download