7105e0d6e6f4313fd5f78f7fff42e83ea09acd42227328b6716aad564288e45a

General

Target

Swift1008_pdf.exe
Size

578KB
MD5

e5af04f898b394a134c91d809811aed6
SHA1

797dadafd9fde7db95ae65e63531333ad8e128b2
SHA256

b00c6e64af8c667452a11c65123c37fdd9efec0eec3e05e1f03bd552edf0d8ea
SHA512

4524016d55d99e296249caec2514bc83a125bf0505e11892bdcfb932f345a529a71ff583b8a21f7a5601b231c922abc7959b13135bfb3d68fc12a8a5f90c1604

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Swift1008_pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Swift1008_pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Swift1008_pdf.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Swift1008_pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Swift1008_pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Swift1008_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 852 WerFault.exe Swift1008_pdf.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

WerFault.exepowershell.exe

pid process

1280 WerFault.exe
1280 WerFault.exe
1280 WerFault.exe
1280 WerFault.exe
1280 WerFault.exe
1632 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1280 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WerFault.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1280 WerFault.exe
Token: SeDebugPrivilege 1632 powershell.exe

pid	pid_target	process	target process
1280	852	WerFault.exe	Swift1008_pdf.exe

pid	process
1280	WerFault.exe
1280	WerFault.exe
1280	WerFault.exe
1280	WerFault.exe
1280	WerFault.exe
1632	powershell.exe

pid	process
1280	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1280	WerFault.exe
Token: SeDebugPrivilege	1632	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Swift1008_pdf.exe

description	pid	process	target process
PID 852 wrote to memory of 1632	852	Swift1008_pdf.exe	powershell.exe
PID 852 wrote to memory of 1632	852	Swift1008_pdf.exe	powershell.exe
PID 852 wrote to memory of 1632	852	Swift1008_pdf.exe	powershell.exe
PID 852 wrote to memory of 1632	852	Swift1008_pdf.exe	powershell.exe
PID 852 wrote to memory of 1280	852	Swift1008_pdf.exe	WerFault.exe
PID 852 wrote to memory of 1280	852	Swift1008_pdf.exe	WerFault.exe
PID 852 wrote to memory of 1280	852	Swift1008_pdf.exe	WerFault.exe
PID 852 wrote to memory of 1280	852	Swift1008_pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Swift1008_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Swift1008_pdf.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Swift1008_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 1072
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-55-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/852-57-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/852-58-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/852-59-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/852-60-0x0000000005360000-0x00000000053DB000-memory.dmp

Filesize
492KB

Download
memory/1280-63-0x0000000000000000-mapping.dmp

Download
memory/1280-67-0x00000000003B0000-0x0000000000410000-memory.dmp

Filesize
384KB

Download
memory/1632-61-0x0000000000000000-mapping.dmp

Download
memory/1632-64-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1632-65-0x0000000002531000-0x0000000002532000-memory.dmp

Filesize
4KB

Download
memory/1632-66-0x0000000002532000-0x0000000002534000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads