Analysis
-
max time kernel
97s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 10:00
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v2004-20220721-en
General
-
Target
Swift Copy.exe
-
Size
971KB
-
MD5
480994b2aba1ea6c8c72aeda3db6c64a
-
SHA1
29b9246b2d927fddd0d0fff372e564dde7292409
-
SHA256
2a0d6ebfcca611f4249d12ea9fbf3b8bf44729d9db9ecfd0f43c72946febca24
-
SHA512
736678e599d60c5375681b27e65aecae99e7350c81ffeb8d9d7073be17ccb7fee800e3779f3f8c43e46cbb8d3a3713df2700af235970f5610ce882543fd9a9e6
Malware Config
Signatures
-
Detect Neshta payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/992-70-0x00000000004080E4-mapping.dmp family_neshta behavioral1/memory/992-69-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-74-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-77-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
Swift Copy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Swift Copy.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Loads dropped DLL 1 IoCs
Processes:
Swift Copy.exepid process 992 Swift Copy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 272 set thread context of 992 272 Swift Copy.exe Swift Copy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Swift Copy.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe Swift Copy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe Swift Copy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe Swift Copy.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe Swift Copy.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe Swift Copy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe Swift Copy.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe Swift Copy.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Swift Copy.exe -
Drops file in Windows directory 1 IoCs
Processes:
Swift Copy.exedescription ioc process File opened for modification C:\Windows\svchost.com Swift Copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Swift Copy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Swift Copy.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Swift Copy.exepid process 272 Swift Copy.exe 272 Swift Copy.exe 272 Swift Copy.exe 272 Swift Copy.exe 272 Swift Copy.exe 272 Swift Copy.exe 272 Swift Copy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Swift Copy.exedescription pid process Token: SeDebugPrivilege 272 Swift Copy.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 272 wrote to memory of 1744 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 1744 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 1744 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 1744 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe PID 272 wrote to memory of 992 272 Swift Copy.exe Swift Copy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156