90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2

Analysis

max time kernel
167s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe
Size

608KB
MD5

57c0268e52994413ef4d40bf7dd7bd1b
SHA1

d4f3f08a29b9bf14f0df6a14a76199c320438117
SHA256

90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2
SHA512

ec37e31337ff83aade0c5fc25985c509ffd7f637e19fb4a368fd05b1d5894abb6a54f836bc30944b1cd6075a878073f212f9e1ecd077e1ce6cb7a8f4134d6462
SSDEEP

6144:VdeLGp2lkBWkXtYUqePDfL7PX6aMRAVUxworKMk5gIrW9EE:dT0k9Y4DfL7/6pRiUNKr7sEE

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

swiftfix.exe

pid process

1736 swiftfix.exe

pid	process
1736	swiftfix.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

swiftfix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe"	swiftfix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exeswiftfix.exe

description	pid	process
Token: SeDebugPrivilege	1440	90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe
Token: SeDebugPrivilege	1736	swiftfix.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe

description	pid	process	target process
PID 1440 wrote to memory of 1736	1440	90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe	swiftfix.exe
PID 1440 wrote to memory of 1736	1440	90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe	swiftfix.exe

C:\Users\Admin\AppData\Local\Temp\90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe
"C:\Users\Admin\AppData\Local\Temp\90ca60dc8424411c71eecfcddfdb40e1fadc48e4ed287a282309b24f0cb2c5a2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\Temp\swiftfix.exe
"C:\Windows\Temp\swiftfix.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\swiftfix.exe
Filesize
17KB

MD5
c5d67a98b53d07c90b6bf8a54d87cca3

SHA1
4cf957464a178b219184308d9110bab3efc3fd78

SHA256
23b36cbe0d774877af73bce1eb468db5026f8b4b5b83650baa6fb13beba3e9ac

SHA512
7dc2223c4a196d70744617411b0202ab64bcb1dd53aea90d7a71cb3d353b0fa708fdf8acb289c93cc742f77cfdba5aaee069adfcce91368457b8443899c075c8

Download Submit
C:\Windows\Temp\swiftfix.exe
Filesize
17KB

MD5
c5d67a98b53d07c90b6bf8a54d87cca3

SHA1
4cf957464a178b219184308d9110bab3efc3fd78

SHA256
23b36cbe0d774877af73bce1eb468db5026f8b4b5b83650baa6fb13beba3e9ac

SHA512
7dc2223c4a196d70744617411b0202ab64bcb1dd53aea90d7a71cb3d353b0fa708fdf8acb289c93cc742f77cfdba5aaee069adfcce91368457b8443899c075c8

Download Submit
memory/1440-132-0x0000000000C00000-0x0000000000C9E000-memory.dmp

Filesize
632KB

Download
memory/1736-133-0x0000000000000000-mapping.dmp

Download
memory/1736-136-0x0000000000960000-0x000000000096A000-memory.dmp

Filesize
40KB

Download
memory/1736-137-0x00007FFA048D0000-0x00007FFA05391000-memory.dmp

Filesize
10.8MB

Download
memory/1736-138-0x00007FFA048D0000-0x00007FFA05391000-memory.dmp

Filesize
10.8MB

Download
memory/1736-139-0x00007FFA048D0000-0x00007FFA05391000-memory.dmp

Filesize
10.8MB

Download