Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
10/06/2024, 11:01
General
- Target swift copy_pdf.exe
- Size 1.2MB
- Sample240610-m4llmagh89
- SHA256 0480998cf63ac0cb1673f87a018e64f29dba03a02eee4d1d15afa701cbe82e35
Malware Config
Signatures
- Suspicious use of SetThreadContext 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\swift copy_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\PresentationHost.exe"C:\Windows\SysWOW64\PresentationHost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut4788.tmp
memory/116-38-0x000001E146400000-0x000001E1464D4000-memory.dmp
memory/1328-12-0x0000000001360000-0x0000000001364000-memory.dmp
memory/1560-26-0x00000000004D0000-0x000000000050F000-memory.dmp
memory/1560-21-0x00000000004D0000-0x000000000050F000-memory.dmp
memory/1560-29-0x00000000004D0000-0x000000000050F000-memory.dmp
memory/1560-27-0x0000000002430000-0x00000000024CE000-memory.dmp
memory/1560-25-0x00000000026F0000-0x0000000002A3A000-memory.dmp
memory/1560-22-0x00000000004D0000-0x000000000050F000-memory.dmp
memory/3152-18-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3152-17-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3152-15-0x0000000001600000-0x000000000194A000-memory.dmp
memory/3152-24-0x0000000004A00000-0x0000000004A1F000-memory.dmp
memory/3152-23-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3152-19-0x0000000004A00000-0x0000000004A1F000-memory.dmp
memory/3152-13-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3152-14-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3152-16-0x0000000000400000-0x0000000000443000-memory.dmp
memory/3480-28-0x000000000EB80000-0x0000000011C0D000-memory.dmp
memory/3480-30-0x0000000008C10000-0x0000000008D21000-memory.dmp
memory/3480-31-0x0000000008C10000-0x0000000008D21000-memory.dmp
memory/3480-20-0x000000000EB80000-0x0000000011C0D000-memory.dmp
memory/3480-39-0x0000000008C10000-0x0000000008D21000-memory.dmp