Overview

overview

10

Static

static

Swift Copy...df.exe

windows7_x64

10

Swift Copy...df.exe

windows10_x64

1

Analysis

  • max time kernel
    42s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09/08/2021, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Swift Copy Details.pdf.exe
  • Size 797KB
  • Sample210809-h6mcj2e13n
  • SHA256 8b62c11fae14388dbbf8adaf6309f52c01df5a0550d57ef539b054c30a6d4ae2
  • MD5 SHA1 SHA512
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
      2⤵
        PID:3816
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
        2⤵
          PID:3928
        • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
          2⤵
            PID:2716
          • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
            2⤵
              PID:2772
            • C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe
              "C:\Users\Admin\AppData\Local\Temp\Swift Copy Details.pdf.exe"
              2⤵
                PID:4000

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  memory/3016-114-0x0000000000420000-0x0000000000421000-memory.dmp
                  Download

                  memory/3016-116-0x0000000004D20000-0x0000000004D21000-memory.dmp
                  Download

                  memory/3016-117-0x0000000005380000-0x0000000005381000-memory.dmp
                  Download

                  memory/3016-118-0x0000000004E80000-0x0000000004E81000-memory.dmp
                  Download

                  memory/3016-119-0x0000000004D00000-0x0000000004D01000-memory.dmp
                  Download

                  memory/3016-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
                  Download

                  memory/3016-121-0x0000000004DC0000-0x0000000004E52000-memory.dmp
                  Download

                  memory/3016-122-0x0000000008650000-0x0000000008661000-memory.dmp
                  Download

                  memory/3016-123-0x0000000008860000-0x0000000008902000-memory.dmp
                  Download

                  memory/3016-124-0x000000000B040000-0x000000000B075000-memory.dmp
                  Download