016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0

Analysis

max time kernel
217s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe
Size

333KB
MD5

59718e10ab8973add6082a88429acf2f
SHA1

996e942c8be550db9600d5d544f1c09ef41c3047
SHA256

016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0
SHA512

83b81ebf0864d6d2ba8902c576416f3b02ede7ed9962af9a0ed8b9e54f4002001d37422262ab8379a13acc69d8ec80b6dae5d48c89e856c52394ac3fc0d6bb50
SSDEEP

3072:ntX/KAx6vl3bg7fdZEXIYznzaAOT4XUlA/2lRvmAWHFa4inrFhVXXjofmcNdmJte:ntXjx6vSb7VGZM3tnrbVHKyt8DNdRI

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

swiftfix.exe

pid process

2624 swiftfix.exe

pid	process
2624	swiftfix.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

swiftfix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe"	swiftfix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exeswiftfix.exe

description	pid	process
Token: SeDebugPrivilege	3524	016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe
Token: SeDebugPrivilege	2624	swiftfix.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe

description	pid	process	target process
PID 3524 wrote to memory of 2624	3524	016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe	swiftfix.exe
PID 3524 wrote to memory of 2624	3524	016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe	swiftfix.exe

C:\Users\Admin\AppData\Local\Temp\016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe
"C:\Users\Admin\AppData\Local\Temp\016006b4e10e6833e36780f68777b7265f105b21a09cbab4f0be8fc45c2e12c0.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\Temp\swiftfix.exe
"C:\Windows\Temp\swiftfix.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\swiftfix.exe

Filesize
17KB

MD5
c5d67a98b53d07c90b6bf8a54d87cca3

SHA1
4cf957464a178b219184308d9110bab3efc3fd78

SHA256
23b36cbe0d774877af73bce1eb468db5026f8b4b5b83650baa6fb13beba3e9ac

SHA512
7dc2223c4a196d70744617411b0202ab64bcb1dd53aea90d7a71cb3d353b0fa708fdf8acb289c93cc742f77cfdba5aaee069adfcce91368457b8443899c075c8

Download Submit
C:\Windows\Temp\swiftfix.exe

Filesize
17KB

MD5
c5d67a98b53d07c90b6bf8a54d87cca3

SHA1
4cf957464a178b219184308d9110bab3efc3fd78

SHA256
23b36cbe0d774877af73bce1eb468db5026f8b4b5b83650baa6fb13beba3e9ac

SHA512
7dc2223c4a196d70744617411b0202ab64bcb1dd53aea90d7a71cb3d353b0fa708fdf8acb289c93cc742f77cfdba5aaee069adfcce91368457b8443899c075c8

Download Submit
memory/2624-134-0x0000000000000000-mapping.dmp

Download
memory/2624-137-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2624-138-0x00007FF809570000-0x00007FF80A031000-memory.dmp

Filesize
10.8MB

Download
memory/2624-139-0x00007FF809570000-0x00007FF80A031000-memory.dmp

Filesize
10.8MB

Download
memory/3524-133-0x0000000000E80000-0x0000000000EDA000-memory.dmp

Filesize
360KB

Download