4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878 | Triage

Analysis

max time kernel
66s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
11-07-2020 05:59

Sharing

Report Analysis Logs

General

Target

Swift.exe
Size

241KB
MD5

5f8de689089e31366591d5e089aad91d
SHA1

365fcdf345e1446f55e9b67b885496776b8f58e8
SHA256

4b62d48e62e1049afd4571693db1e047f88a36889a38bb53188340445d4f9878
SHA512

9328257da277f84b1449b2e8bc75525e019370e83c50cc4bca650bb79fdb04304084e64f6919e00895a95d72fe6698a9b576379ed9be0513225fad81b26e922d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2432 2564 WerFault.exe Swift.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2432 WerFault.exe
Token: SeBackupPrivilege 2432 WerFault.exe
Token: SeDebugPrivilege 2432 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Swift.exe"
1⤵
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 912
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/2432-2-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2432-51-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download