22dcf97ec111b708369a785ba32a1d8767e6be002919072c04ddae954fb3fe26 | Triage™

Analysis

max time kernel
117s
max time network
120s
platform
windows10_x64
resource
win10
submitted
24/07/2020, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift2NIOMI3816.exe
Size 785KB
Sample200724-sm7ef56wgx
SHA256 22dcf97ec111b708369a785ba32a1d8767e6be002919072c04ddae954fb3fe26
MD5 911e7fc51a299cdc36cccd3cad930169
SHA1 75b4f551138ec7ac673f985145c70cf5c340f62c
SHA512 64c2892444f6adfe6f7259902b1c274e11742fea65f0ca961c1239f2f9ea53807d5051dcc6a6fdce92b444a558d68d63a9f4b664e0beed0a414b53128a859e4c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3524	3412	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3412	Swift2NIOMI3816.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	Swift2NIOMI3816.exe
Token: SeRestorePrivilege	3524	WerFault.exe
Token: SeBackupPrivilege	3524	WerFault.exe
Token: SeDebugPrivilege	3524	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift2NIOMI3816.exe
"C:\Users\Admin\AppData\Local\Temp\Swift2NIOMI3816.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1376
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-0-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/3524-2-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download