Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TT-SWIFT-ERROR.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
TT-SWIFT-ERROR.exe
Resource
win10v2004-20240226-en
10 signatures
150 seconds
General
-
Target
TT-SWIFT-ERROR.exe
-
Size
618KB
-
MD5
adc47f20cba61f1a2f8171791a455d09
-
SHA1
62508fbdde7bfb78e927495bb96d78ceb832a1ae
-
SHA256
b089fa2bc45c847783b8eb957d9d1023f707a96073f2657d6a838eaf5619949b
-
SHA512
49ee25101729fe1d351d6b96861be96c0fe273ecc3c3378fc42848ef1d46f6e6128982b695de7a8639b1529791c541f4ad2077c93c11155dc0d5ebbe63e8414c
-
SSDEEP
12288:4JMa5WyV/cXi7Cc8oZJfLyXrCt9vFjMRL9fPzDYUE8P8ITjEQ:4OS/kJoMIFCRhfgq8+j7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
TT-SWIFT-ERROR.exepid process 2868 TT-SWIFT-ERROR.exe 2868 TT-SWIFT-ERROR.exe 2868 TT-SWIFT-ERROR.exe 2868 TT-SWIFT-ERROR.exe 2868 TT-SWIFT-ERROR.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TT-SWIFT-ERROR.exedescription pid process Token: SeDebugPrivilege 2868 TT-SWIFT-ERROR.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
TT-SWIFT-ERROR.exedescription pid process target process PID 2868 wrote to memory of 3020 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 3020 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 3020 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 3020 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2548 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2548 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2548 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2548 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2536 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2536 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2536 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2536 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2556 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2556 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2556 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2556 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2632 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2632 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2632 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe PID 2868 wrote to memory of 2632 2868 TT-SWIFT-ERROR.exe TT-SWIFT-ERROR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2868-1-0x0000000074860000-0x0000000074F4E000-memory.dmpFilesize
6.9MB
-
memory/2868-0-0x0000000000370000-0x0000000000410000-memory.dmpFilesize
640KB
-
memory/2868-2-0x0000000004EE0000-0x0000000004F20000-memory.dmpFilesize
256KB
-
memory/2868-3-0x0000000000440000-0x0000000000452000-memory.dmpFilesize
72KB
-
memory/2868-4-0x0000000000460000-0x000000000046C000-memory.dmpFilesize
48KB
-
memory/2868-5-0x00000000049B0000-0x0000000004A34000-memory.dmpFilesize
528KB
-
memory/2868-6-0x0000000074860000-0x0000000074F4E000-memory.dmpFilesize
6.9MB