Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

swift-copy.exe

windows7-x64

3

swift-copy.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    134s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2023, 07:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    swift-copy.exe

  • Size

    6KB

  • MD5

    3cac4d7c5a529353dfb7359b4dbc462f

  • SHA1

    cc6d47b507661c461f4a7e1a3f50399f12531e9f

  • SHA256

    3d22844322dd416de699efbdacce8c3ef36e3ca745e4aab6f8e730d8753c0848

  • SHA512

    911d5a4a9905efc15cfd30360113159a0f1c0967d7a77977da98b7405c7662bb037292bd6bf67ae1747f44e948571e2d2f789f199b82466c8533ad0d06b9117c

  • SSDEEP

    48:6tPof0vWVuF97+VykI1QpI/LRNMIE+f9P3W4A4u5P6spsmqBHUkZ4tiOllSpvqF9:x+HkI1QgzNfPmrk0KwnSplFnU

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\swift-copy.exe
    "C:\Users\Admin\AppData\Local\Temp\swift-copy.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1972
      2⤵
      • Program crash
      PID:2380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4156 -ip 4156
    1⤵
      PID:4216

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4156-132-0x0000000000040000-0x0000000000048000-memory.dmp

      Filesize

      32KB

      Download