Analysis
- max time kernel
142s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
04/07/2023, 07:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20230703-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
swift copy.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target swift copy.exe
- Size 373KB
- Sample230704-htsvqsda2x
- SHA256 848381fda2649822f40e32ef646c19fd790e77f75e30e3d7cf4dee3bf8c5e427
- MD5 7fb2c368227ebf7174f51d00e2238d9e
- SHA1 b5f47eb1e8cae7c7bebc4d6227807090024a257d
- SHA512 49adbcef3ea4e7bd8ce7baded6325beec77beb1885032dd8c958a5bf4479dedd36e521e0de9514a96c0742543a775ccf5bbcd8d522e67adc79f1d003683c4887
- SSDEEP 6144:vYa6E4kuRcv5dsOf2SpQQHBpXxPvocrOJMKalDrGKQFPzXsKCUcZcLoSaK/2efMI:vYi/j2S6SDRocKxeZQFbsK48l/2efv
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation swift copy.exe - Loads dropped DLL 1 IoCs
pid Process 4620 swift copy.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tpyuenjscxhd = "C:\\Users\\Admin\\AppData\\Roaming\\wgplueajfoxtdm\\irnwgck.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\swift copy.exe\"" swift copy.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4620 set thread context of 408 4620 swift copy.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe 408 swift copy.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4620 swift copy.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 408 swift copy.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4620 wrote to memory of 408 4620 swift copy.exe 79 PID 4620 wrote to memory of 408 4620 swift copy.exe 79 PID 4620 wrote to memory of 408 4620 swift copy.exe 79 PID 4620 wrote to memory of 408 4620 swift copy.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsm7D60.tmp\cpbbjjcx.dll
- Size 277KB
- SHA256 19ebfb7361d8d0e8f00dcedea2f6c52d0749db48dbd25a557f19c58bee90999a
- MD5 8bc1c89baddde657fb64476fd3c7bcbe
- SHA1 c720c7ce950102ab1c5ae45ff8694bf7679ed04a
- SHA512 6580dba10667854e4c2ccfa207ff36950a80b77dcea7b7ab582bba289b41fbc981086e29c5d6249bf9dacd1a26081be7529fe7a3728eb26b835bfd48180c4aec
- SSDEEP 6144:JyL7uptL3AQZIODJuJXliwZ81A+ByuiKazolv:JyPutD1ZIODJuJXjuiKaUlv
- MD5 SHA1 SHA512 SSDEEP