e93300d3c30f828f0e44993cfc85fa7a72e098b6b77a9665466f29a9ee06fb8b

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 09:08

Target

Swift-IMG_20221004_001.exe
Size

22KB
MD5

e0c62ae1f14853f48c209caaf79e8d14
SHA1

c10eb3c2f9bd4725ea96850ddfc1599f747dea58
SHA256

617fbed8938dd5a9348bb5bfa4d81007e910fd257e286f2b76323b95433b4ae0
SHA512

06c5682006d9cf3330c7dce3beb60536794aa1c66ede77df54886bd43286f243c8a9b130ca42c74901ebbea5d9dfa50194014971c767235bec4969f2464e6b2d
SSDEEP

384:TSK+X9LuPNMDo5e5Zz5TBHCZJ5H1NrOV:TSK+Ra8dFTBi3vNrOV

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	Swift-IMG_20221004_001.exe

C:\Users\Admin\AppData\Local\Temp\Swift-IMG_20221004_001.exe
"C:\Users\Admin\AppData\Local\Temp\Swift-IMG_20221004_001.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1992-54-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1992-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download