0480998cf63ac0cb1673f87a018e64f29dba03a02eee4d1d15afa701cbe82e35

Analysis

max time kernel
146s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift copy_pdf.exe
Size 1.2MB
Sample240610-m4llmagh89
SHA256 0480998cf63ac0cb1673f87a018e64f29dba03a02eee4d1d15afa701cbe82e35
MD5 3a27c49f428e334435ba520ccb837986
SHA1 374a7c3234887307d3ada0f654efd7c4b07a4dff
SHA512 658f0c5ef01510e9bb148af757e7593c1d15a394b487ec012cbdd70b012dc6b190417f6d3b917177fb49b091c3db50064c07fe95569b3e6bfe9d2b71dc761309
SSDEEP 24576:/AHnh+eWsN3skA4RV1Hom2KXMmHazYFBibNJMRFWj5:ih+ZkldoPK8YazYFkTMDO
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2836 set thread context of 1564	2836	swift copy_pdf.exe	28
PID 1564 set thread context of 1140	1564	svchost.exe	20
PID 1564 set thread context of 1988	1564	svchost.exe	29
PID 1988 set thread context of 1140	1988	PresentationHost.exe	20

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe
1988	PresentationHost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2836	swift copy_pdf.exe
1564	svchost.exe
1140	Explorer.EXE
1140	Explorer.EXE
1988	PresentationHost.exe
1988	PresentationHost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2836	swift copy_pdf.exe
2836	swift copy_pdf.exe
1140	Explorer.EXE
1140	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2836	swift copy_pdf.exe
2836	swift copy_pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1564	2836	swift copy_pdf.exe	28
PID 2836 wrote to memory of 1564	2836	swift copy_pdf.exe	28
PID 2836 wrote to memory of 1564	2836	swift copy_pdf.exe	28
PID 2836 wrote to memory of 1564	2836	swift copy_pdf.exe	28
PID 2836 wrote to memory of 1564	2836	swift copy_pdf.exe	28
PID 1140 wrote to memory of 1988	1140	Explorer.EXE	29
PID 1140 wrote to memory of 1988	1140	Explorer.EXE	29
PID 1140 wrote to memory of 1988	1140	Explorer.EXE	29
PID 1140 wrote to memory of 1988	1140	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1564
- C:\Windows\SysWOW64\PresentationHost.exe
  "C:\Windows\SysWOW64\PresentationHost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

fricandeaux

Path C:\Users\Admin\AppData\Local\Temp\fricandeaux
Size 265KB
SHA256 3c4d9cf49c270fcdc81165915478fd27205c2b8cf5ddd7d337c426eb46529703
MD5 720fd7932cf3dbabcab23eebf118bc6a
SHA1 21cbeb81da3f6c5da9f58ff83f4d44653867892a
SHA512 f88371f6cf4b5fb7f974359e7e88f851e41cc78c3aa09bdf62ef5cc8f79dfb5d77e527d9b8890c93f7f951e178e4a717672994379fb0b448c04bb9cae5a12c63
SSDEEP 6144:V9+T0eW/OSEvsFTdoy90xvSBHwjfyAZ1qfvWjxRJ:KYeW21m0xqLmqWjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-27-0x0000000008E50000-0x000000000B1EF000-memory.dmp

Download

memory/1140-19-0x0000000008E50000-0x000000000B1EF000-memory.dmp

Download

memory/1140-18-0x0000000000100000-0x0000000000200000-memory.dmp

Download

memory/1564-14-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-22-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-17-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1564-16-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-13-0x0000000000820000-0x0000000000B23000-memory.dmp

Download

memory/1564-12-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-23-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1564-15-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1988-21-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/1988-20-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/1988-24-0x0000000002900000-0x0000000002C03000-memory.dmp

Download

memory/1988-25-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/1988-26-0x0000000000410000-0x00000000004AE000-memory.dmp

Download

memory/1988-28-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2836-11-0x0000000000160000-0x0000000000164000-memory.dmp

Download