Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
Swift_049949_pdf.js
Resource
win7-20220901-en
General
-
Target
Swift_049949_pdf.js
-
Size
356KB
-
MD5
f01befe67328d6895946ab4c8763f006
-
SHA1
b302694c2c69da517b88eec771d8fc2c13ad5a66
-
SHA256
4a9a8778e84343f5992bddbfdec6e7d45ca399d1f20a44bcb8eaccd05372f193
-
SHA512
012fd72d8a70023772345213fdefb6382e4658e97bfd27cd4610312e4aa7fd113bde436f159451b77688ca876401cd05b2a207d194a3e562b265fbcdfb0a17a4
-
SSDEEP
6144:BWCdn1qRUAtmWXwXXJ528/RpFH81oTrmYW1XEMnGWrUvfhZN8gkU9uQyp:BbqZmWXsXzLH981omYHMGWuZZOrU+p
Malware Config
Extracted
formbook
xrob
dV8FCtdWdnfMJ9thh8l/
IJG6Bh4iMeHVBHNp2MrpTA==
NhPKKtmQxnHYF/80
f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==
A/689/MibSRBgkPkx07m+H+g
e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==
gLN5bn+Zq1VQXmOOvw==
NFcQGvViY5sxmkty83Fde4GQhg==
XWMfFSM3f7GT9w==
Ih6vvqf9R8gDObM=
FGAlLASHlpLaUUKUJIwm9ABQ2Js=
v8R615LDC8iWchwv
m+u3rLUxScgDObM=
jc3eahERf7GT9w==
TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=
j6NQmhWeOi2B
aqJocUfM3v97ryScY6EiSMbVyBak
V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==
8zPsAt3ejcgDObM=
Rpe+BrGBzpGa9q8FHKpi
/WmW2322D7fNRPTILa58Juqk/ZM=
+RXDz2RnrG6J
G2uU9LualUtez4NigNITbgyuIybyPzM=
edeuu22xD1rTFu+ci/JLpyGuIybyPzM=
pP8hbRJZqelZrXS+HWDm+H+g
8STQ6HSb4lE4XmOOvw==
hr/lDpXMc4jYF/80
zQ/HzrVdryLZMvhEZ+Y=
HV4gPCecmZPFL8v1N6x1
LEf38qRZvLgqVfTXPa19
7euZ5pxpp2ZtrYb1N6x1
iqU5LgL782FBXmOOvw==
gtbwN+MldLRNoQZhh8l/
WUgMbA3KHBFYvlM6xk7m+H+g
b1zuBfz/FgrL92U4
Q6jeIxKBj5a+66DmTJCE7LZkK/eC/Q==
5BnV1pTXMa+W8aXGFVdhe4GQhg==
0UIRgvizzg8=
Cf/BDgD1/4JpqGQveZhw
+SPb0ojBEZzzTLk=
1ihEmlgPYYcJPPhEZ+Y=
va9ioKotR8gDObM=
66NR6ZvZGVfLLgOkSXLm+H+g
s7Ftp5/JE9zxPsv1N6x1
OZjAEbHmQr57flVNog==
SWYQJhbPGKdlXmOOvw==
D2UxQCXKFoVIoSu9IHUrWw==
ISLrKBL7AbPbCiJc5FAkMhM=
yhErdYm07KzDN9oFHKpi
vL5nTlhRf7GT9w==
p/wcbinhJe3eP90FHKpi
JCG1tJvLI+MUMwHVtw==
YKGzBi9gqWJ7tXgqW9cve4GQhg==
GzDd8t2F3lM7nzQw0Urm+H+g
gHo/fQEoa6tAVjiEqA==
zQ7U6cY1RYcJPPhEZ+Y=
BEEFEwEwYhkxlEUD+TMJnhs=
wfubpSsNjM5t4sOGqWbFp+K6pc/n9Q==
NntHSf0ybNuawX/q4Blh68nzK/eC/Q==
BVRywXVfdfjPK+DImLD3SQBQ2Js=
pOOyL/izzg8=
2c2Sxo8iuKv0L78=
wRU0iU8CRLSS9Q==
+Sjk78IvKRNv364HcZ4l+bAXxhes
pauloeamanda.com
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 4 460 wscript.exe 10 460 wscript.exe 21 460 wscript.exe 34 460 wscript.exe 47 460 wscript.exe -
Executes dropped EXE 1 IoCs
pid Process 584 bin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation bin.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WvtFvwPcPZ.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WvtFvwPcPZ.js wscript.exe -
Loads dropped DLL 1 IoCs
pid Process 996 NAPSTAT.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 584 set thread context of 1344 584 bin.exe 16 PID 996 set thread context of 1344 996 NAPSTAT.EXE 16 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NAPSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 584 bin.exe 584 bin.exe 584 bin.exe 584 bin.exe 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1344 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 584 bin.exe 584 bin.exe 584 bin.exe 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE 996 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 584 bin.exe Token: SeDebugPrivilege 996 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1444 wrote to memory of 460 1444 wscript.exe 27 PID 1444 wrote to memory of 460 1444 wscript.exe 27 PID 1444 wrote to memory of 460 1444 wscript.exe 27 PID 1444 wrote to memory of 584 1444 wscript.exe 28 PID 1444 wrote to memory of 584 1444 wscript.exe 28 PID 1444 wrote to memory of 584 1444 wscript.exe 28 PID 1444 wrote to memory of 584 1444 wscript.exe 28 PID 1344 wrote to memory of 996 1344 Explorer.EXE 30 PID 1344 wrote to memory of 996 1344 Explorer.EXE 30 PID 1344 wrote to memory of 996 1344 Explorer.EXE 30 PID 1344 wrote to memory of 996 1344 Explorer.EXE 30 PID 996 wrote to memory of 972 996 NAPSTAT.EXE 33 PID 996 wrote to memory of 972 996 NAPSTAT.EXE 33 PID 996 wrote to memory of 972 996 NAPSTAT.EXE 33 PID 996 wrote to memory of 972 996 NAPSTAT.EXE 33 PID 996 wrote to memory of 972 996 NAPSTAT.EXE 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Swift_049949_pdf.js2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WvtFvwPcPZ.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:460
-
-
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:972
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD526db0806c0871f293a77e5d5676e2fd8
SHA17c17ccce454d81bb999c04d45e9e4913969a73ee
SHA2562c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66
SHA5120dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f
-
Filesize
185KB
MD526db0806c0871f293a77e5d5676e2fd8
SHA17c17ccce454d81bb999c04d45e9e4913969a73ee
SHA2562c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66
SHA5120dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f
-
Filesize
10KB
MD53589411aa8a0eb5b2130b6f012c5e15e
SHA117f11b37cea60cbad8a275b67cbdf4c87fc8f4b9
SHA2560a9e55b1f39f811950237ab0022fd1540a3d6ce359d1d6305b73d8995b59243b
SHA512a7a40aee84ef42b35b1f1a8e0e3a7441a8a6779eb1f2e02eb5c43cdae9f168b8829b783f08f8c5be0ebb091437e532cc52bf64dd16b6e67d6e6acb9f7c959395
-
Filesize
849KB
MD587f9e5a6318ac1ec5ee05aa94a919d7a
SHA17a9956e8de89603dba99772da29493d3fd0fe37d
SHA2567705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c
SHA512c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2