Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-05-2023 16:07
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20230220-en
General
-
Target
Swift Copy.exe
-
Size
668KB
-
MD5
3c5bcd6427bdec6f9dc27f22123322a3
-
SHA1
62d8f3e059e55e55ea27de88947689f06cc2551f
-
SHA256
b9bdf17b0783f5b073ba007091604c0407e825b17ae8ae90bf53d2a2140341ba
-
SHA512
672248efce41e4eace1901cdba6716b915e3c58c559f4cc1f24b7ec9adb7e8f13db44830729561177cc216fa8eaff31ca47faccb27d60fc620ee051a4123d114
-
SSDEEP
12288:U6whh2Y4Y8WfDrYfGJ68qDC1Hei74I+9:vwhh2fqrYfGJvqD2P7
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1228-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1228-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1732-79-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1732-81-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Swift Copy.exeRegSvcs.exemsiexec.exedescription pid process target process PID 1584 set thread context of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1228 set thread context of 1300 1228 RegSvcs.exe Explorer.EXE PID 1228 set thread context of 1300 1228 RegSvcs.exe Explorer.EXE PID 1732 set thread context of 1300 1732 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Swift Copy.exeRegSvcs.exemsiexec.exepid process 1584 Swift Copy.exe 1584 Swift Copy.exe 1228 RegSvcs.exe 1228 RegSvcs.exe 1228 RegSvcs.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe 1732 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1300 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1228 RegSvcs.exe 1228 RegSvcs.exe 1228 RegSvcs.exe 1228 RegSvcs.exe 1732 msiexec.exe 1732 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Swift Copy.exeRegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1584 Swift Copy.exe Token: SeDebugPrivilege 1228 RegSvcs.exe Token: SeDebugPrivilege 1732 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1300 Explorer.EXE 1300 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1300 Explorer.EXE 1300 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Swift Copy.exeRegSvcs.exemsiexec.exedescription pid process target process PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1584 wrote to memory of 1228 1584 Swift Copy.exe RegSvcs.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1228 wrote to memory of 1732 1228 RegSvcs.exe msiexec.exe PID 1732 wrote to memory of 1776 1732 msiexec.exe cmd.exe PID 1732 wrote to memory of 1776 1732 msiexec.exe cmd.exe PID 1732 wrote to memory of 1776 1732 msiexec.exe cmd.exe PID 1732 wrote to memory of 1776 1732 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-72-0x00000000003C0000-0x00000000003D5000-memory.dmpFilesize
84KB
-
memory/1228-68-0x0000000000380000-0x0000000000395000-memory.dmpFilesize
84KB
-
memory/1228-67-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/1228-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1300-71-0x0000000003810000-0x0000000003910000-memory.dmpFilesize
1024KB
-
memory/1300-82-0x0000000003810000-0x0000000003910000-memory.dmpFilesize
1024KB
-
memory/1300-69-0x00000000048F0000-0x00000000049DC000-memory.dmpFilesize
944KB
-
memory/1300-73-0x0000000006AA0000-0x0000000006B71000-memory.dmpFilesize
836KB
-
memory/1300-88-0x0000000006C20000-0x0000000006D41000-memory.dmpFilesize
1.1MB
-
memory/1300-86-0x0000000006C20000-0x0000000006D41000-memory.dmpFilesize
1.1MB
-
memory/1300-84-0x0000000006C20000-0x0000000006D41000-memory.dmpFilesize
1.1MB
-
memory/1584-58-0x0000000005BB0000-0x0000000005C20000-memory.dmpFilesize
448KB
-
memory/1584-57-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB
-
memory/1584-54-0x0000000000130000-0x00000000001DE000-memory.dmpFilesize
696KB
-
memory/1584-56-0x00000000005C0000-0x00000000005D2000-memory.dmpFilesize
72KB
-
memory/1584-55-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/1584-59-0x0000000004210000-0x0000000004248000-memory.dmpFilesize
224KB
-
memory/1732-75-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/1732-81-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1732-80-0x00000000021C0000-0x00000000024C3000-memory.dmpFilesize
3.0MB
-
memory/1732-83-0x0000000001FA0000-0x0000000002034000-memory.dmpFilesize
592KB
-
memory/1732-79-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1732-78-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/1732-76-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB