Analysis
- max time kernel
162s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
03/10/2022, 07:09
General
- Target Swift copy-MT103___________________________________________________________________________________________.exe
- Size 15KB
- Sample221003-hysqjacfc8
- SHA256 098c30f5be90148d97ead8f3c0aadafd8ac199d1e0207f33b7bbd203f9deff27
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift copy-MT103___________________________________________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy-MT103___________________________________________________________________________________________.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 15682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4568 -ip 45681⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4568-132-0x00000000005F0000-0x00000000005FA000-memory.dmp
memory/4568-133-0x0000000005770000-0x0000000005D14000-memory.dmp
memory/4568-134-0x00000000051C0000-0x0000000005252000-memory.dmp
memory/4568-135-0x0000000005260000-0x00000000052FC000-memory.dmp
memory/4568-136-0x00000000051A0000-0x00000000051AA000-memory.dmp