Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
Swift.scan.pdf..exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Swift.scan.pdf..exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Swift.scan.pdf..exe
-
Size
387KB
-
MD5
b639feeb11fb34d180a8d5e56525f9fb
-
SHA1
6692d4456af443bdeac9c221eeb9fb21c13681e8
-
SHA256
b9772ef962373f4f5e7c5e4169812301f7739d2df4b1d3dcbeea84d6eed162b3
-
SHA512
204ac33876477d553647c231e9a7304c6873ab7e620447b4369a9c80719c2cbbf6c3ef5c594bee8a26f0dd5eb0966b317301b625f4ad86a1fe422daaf2cd314c
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Swift.scan.pdf..exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe Swift.scan.pdf..exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe Swift.scan.pdf..exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Swift.scan.pdf..exepid process 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe 4124 Swift.scan.pdf..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Swift.scan.pdf..exedescription pid process Token: SeDebugPrivilege 4124 Swift.scan.pdf..exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4124-130-0x00000000006E0000-0x0000000000748000-memory.dmpFilesize
416KB
-
memory/4124-131-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/4124-132-0x00000000055F0000-0x0000000005B94000-memory.dmpFilesize
5.6MB
-
memory/4124-133-0x0000000005380000-0x000000000541C000-memory.dmpFilesize
624KB
-
memory/4124-134-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB