Analysis
- max time kernel
151s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 12:43
General
- Target SwiftBNF.scan.pdf..exe
- Size 732KB
- Sample220521-pybkksbdfl
- SHA256 59ab0c3f8318f555ee1316fa382e9947c79e4ea03f321ebd282ed08012b8139a
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwiftBNF.scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\SwiftBNF.scan.pdf..exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2844-130-0x00000000005E0000-0x000000000069E000-memory.dmp
memory/2844-131-0x0000000005780000-0x0000000005D24000-memory.dmp
memory/2844-132-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/2844-133-0x0000000005480000-0x000000000548A000-memory.dmp
memory/2844-134-0x0000000005650000-0x00000000056EC000-memory.dmp
memory/2844-135-0x0000000005E30000-0x0000000005E96000-memory.dmp