1cb9d296560c97aa2e7f6fee983774a235fbfd641446b6670dce0daba46e013d

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
277s
max time network
240s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift-0509.msi
Size 11.4MB
Sample261002-esslsstw7r
SHA256 1cb9d296560c97aa2e7f6fee983774a235fbfd641446b6670dce0daba46e013d
MD5 50460a7ff24a39097e0ad0ddaf74ecfe
SHA1 73cab87d0bf99f9520e57b4e712df9f52df9c36d
SHA512 11bed65b992cd6b34acf1141d4ea87309b3e2756099985fa5b7f7f980f5afcd7f31ca57401633bda1b4bcbce01d13116a7d9bf4a3130395c9c178e3269fad830
SSDEEP 196608:SRtmvruXT5ZGkRthFz7BGC92Pn19CQOhyWjp6LMIoFH4VYCLEhGuGT:hyXnJex199OgWgEH4ju
TLSH
T19CC6332171828A33C277063A61A7E7369B75BC245B3582CB775D73ED2F302C0A67AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
3512	MSI6A45.tmp

Loads dropped DLL 11 IoCs

pid	Process
2708	MsiExec.exe
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp
3512	MSI6A45.tmp

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5536	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSI6A45.tmp

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Duxbury\SWIFT\AddinExpress.MSO.2005.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots1234.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\exclamation.png	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\GuideWord.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\LineNums.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\GuideDots.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Microsoft.Vbe.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\RefPageNemeth.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Reset.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\AcronymAdd.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\BulletSecondary.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\DBT.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots1.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots2456.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\TNEmbed.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Uncontracted.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\DBTServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\FontTermination.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\BulletPrimary.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\linearmath.png	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Documentation\EN\SWIFT.chm	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Symbol Help.bmp	msiexec.exe
File opened for modification	\??\c:\program files (x86)\duxbury\swift\adxloader.dll.manifest	MSI6A45.tmp
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\RefPageNumber.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots145.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots234.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\math.png	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\YellowHighlight.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\adxloader.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\ExactTranslation.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\SWIFT.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Emphasis.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Exercise.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\RefPageNumberEmbed.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\CBCInline.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Microsoft.Word.Document.xml	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\adxregistrator.bat	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Embossit.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Italian.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\AddinExpress.WD.2005.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Latin.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Spanish.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\DBTDebug.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\German.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Rename.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Acronym.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\adxregistrator.exe	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Body.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots15.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\French.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\adxloader.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\adxloader64.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\codes.png	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots1235.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Dots2345.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\ExactTranslation.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Help.bmp	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Office.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Headings.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\RedFont.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\stdole.dll	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\Add.ico	msiexec.exe
File created	C:\Program Files (x86)\Duxbury\SWIFT\Images\BlueFont.ico	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{5F1C945D-49D5-4903-AAB2-890FFCA1E4F2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A45.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5e31.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF41FAB11704D4F42E.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5e2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5e2f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF14D59D0824DF1F70.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6459.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF05863EDD6526EC77.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A1F545BBC0714BE.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5536	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI6A45.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSI6A45.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns\SWIFT.AddinModule\ADXStartMode = "FIRSTSTART"	MSI6A45.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	MSI6A45.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSI6A45.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns\SWIFT.AddinModule	MSI6A45.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Word\AddIns	MSI6A45.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45587590-2E95-32DA-8EEB-93000C1C49E2}\ProgId	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45587590-2E95-32DA-8EEB-93000C1C49E2}\Implemented Categories	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06A72419-28A2-3BB1-8176-4C62ADD00ACD}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	MSI6A45.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D549C1F55D943094AA2B98F0CF1A4E2F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B25FEA6F-FA83-3BD6-B500-6B4D5C9EE01A}\Implemented Categories	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99DC26C9-E548-31D4-91F8-8E74791CE48D}\InprocServer32\5.9.0.22693\CodeBase = "file:///C:/Program Files (x86)/Duxbury/SWIFT/SWIFT.DLL"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9A035E3-C7E0-3008-904A-FC29C894EA49}\ProgId	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}\InprocServer32\ = "mscoree.dll"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{452D6FD6-FDAD-3CF1-A48C-3078433F1BC4}\InprocServer32\5.9.0.22693\CodeBase = "file:///C:/Program Files (x86)/Duxbury/SWIFT/SWIFT.DLL"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B25FEA6F-FA83-3BD6-B500-6B4D5C9EE01A}	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}\InprocServer32\Assembly = "SWIFT, Version=5.9.0.22693, Culture=neutral, PublicKeyToken=2ae2332475c25800"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{568A3A84-2677-3265-8F2F-A28F997D46E1}\ProgId\ = "SWIFT.TextSelectionDialog"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F11B2FAD-6C99-35C1-BDC3-A2FADCCD8F40}\InprocServer32\5.9.0.22693\Class = "SWIFT.AdvancedStyleViewer"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}\ProgId	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55902BEF-BC20-4ECE-B56A-0B085A551233}\InprocServer32	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8641C8FF-088C-394B-A02D-E9539AE8236F}\InprocServer32\5.9.0.22693\RuntimeVersion = "v4.0.30319"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79A58A84-82CC-3DD9-A413-29D91EC9FA69}\InprocServer32\5.9.0.22693\CodeBase = "file:///C:/Program Files (x86)/Duxbury/SWIFT/SWIFT.DLL"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A72419-28A2-3BB1-8176-4C62ADD00ACD}\ProgId	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.AddinModule\CLSID\ = "{55902BEF-BC20-4ECE-B56A-0B085A551233}"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.DocumentBuilder\CLSID\ = "{08A0530C-A956-3E8D-8FB2-4E6F67F6AF9D}"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E95A895-1ADF-38C1-9541-6E86C4E5CCD2}\ = "SWIFT.OpenInDBTDocumentBuilder"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C61D1321-402A-33B1-B2E8-BF10DC2C059D}\Implemented Categories	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.Word.ParamPassed	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C885FFB4-4843-3204-AAEB-AB5D5A7F2E56}\InprocServer32\Class = "SWIFT.Acronyms.TaskPane"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.OpenInDBTDocumentBuilder	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{568A3A84-2677-3265-8F2F-A28F997D46E1}\Implemented Categories	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30B69E67-EBB6-347E-B6D1-D5EE4A28E83F}\InprocServer32\5.9.0.22693	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49FA129D-C061-3A79-AFEF-55B817401490}\InprocServer32\Class = "SWIFT.Styles.WordStylesLister"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\140224E6BAB0DD84CA041E3BA1A22D52	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{452D6FD6-FDAD-3CF1-A48C-3078433F1BC4}\InprocServer32\5.9.0.22693	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9A035E3-C7E0-3008-904A-FC29C894EA49}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Duxbury/SWIFT/SWIFT.DLL"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCA5876A-97B9-3F05-8A72-91B67E393F56}\InprocServer32\Assembly = "SWIFT, Version=5.9.0.22693, Culture=neutral, PublicKeyToken=2ae2332475c25800"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F11B2FAD-6C99-35C1-BDC3-A2FADCCD8F40}\InprocServer32\5.9.0.22693\RuntimeVersion = "v4.0.30319"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E95A895-1ADF-38C1-9541-6E86C4E5CCD2}	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52CF6F10-1245-322B-AF5E-8848D1153C08}\InprocServer32\ = "mscoree.dll"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3BCAB4D4-008A-3654-8C75-C68DA46D2E19}\ = "SWIFT.VersionInfo.VersionInfoDialog"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8806A6B5-6FCA-384A-BAD8-AAB206263AD1}\InprocServer32\Assembly = "SWIFT, Version=5.9.0.22693, Culture=neutral, PublicKeyToken=2ae2332475c25800"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.EmbossDirectDocumentBuilder\CLSID\ = "{8641C8FF-088C-394B-A02D-E9539AE8236F}"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.Word.ParamPassed\ = "SWIFT.Word.ParamPassed"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.Acronyms.AcronymTableCreateDialog\ = "SWIFT.Acronyms.AcronymTableCreateDialog"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A72419-28A2-3BB1-8176-4C62ADD00ACD}\InprocServer32\ = "mscoree.dll"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8806A6B5-6FCA-384A-BAD8-AAB206263AD1}\InprocServer32\5.9.0.22693\RuntimeVersion = "v4.0.30319"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F11B2FAD-6C99-35C1-BDC3-A2FADCCD8F40}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35622320-FE60-34BA-9EDB-591F214B874E}\InprocServer32	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35622320-FE60-34BA-9EDB-591F214B874E}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCA5876A-97B9-3F05-8A72-91B67E393F56}\InprocServer32\5.9.0.22693	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AE7EAB02-A1D1-3A2E-834D-29A4F207C90B}\InprocServer32\Assembly = "SWIFT, Version=5.9.0.22693, Culture=neutral, PublicKeyToken=2ae2332475c25800"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E95A895-1ADF-38C1-9541-6E86C4E5CCD2}\InprocServer32\5.9.0.22693\RuntimeVersion = "v4.0.30319"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}\InprocServer32\5.9.0.22693\RuntimeVersion = "v4.0.30319"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9A035E3-C7E0-3008-904A-FC29C894EA49}\ProgId	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55902BEF-BC20-4ECE-B56A-0B085A551233}\InprocServer32\Assembly = "SWIFT, Version=5.9.0.22693, Culture=neutral, PublicKeyToken=2ae2332475c25800"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A72419-28A2-3BB1-8176-4C62ADD00ACD}\InprocServer32	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A72419-28A2-3BB1-8176-4C62ADD00ACD}\Implemented Categories	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30B69E67-EBB6-347E-B6D1-D5EE4A28E83F}\InprocServer32\ThreadingModel = "Both"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7365CE20-0AB7-3DB6-80E3-F8BA5C7108D5}\InprocServer32\5.9.0.22693\Class = "SWIFT.Localization.Serialization.entryType"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55902BEF-BC20-4ECE-B56A-0B085A551233}\InprocServer32\5.9.0.22693\CodeBase = "file:///C:/Program Files (x86)/Duxbury/SWIFT/SWIFT.DLL"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F11B2FAD-6C99-35C1-BDC3-A2FADCCD8F40}\InprocServer32\ThreadingModel = "Both"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50097E6B-A42F-37F2-A621-68B6046EF1E6}\InprocServer32\5.9.0.22693\Class = "SWIFT.Localization.StringLocalizer"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWIFT.Localization.Serialization.entryType\ = "SWIFT.Localization.Serialization.entryType"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}\InprocServer32\5.9.0.22693	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D549C1F55D943094AA2B98F0CF1A4E2F\CompleteInstall	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C61D1321-402A-33B1-B2E8-BF10DC2C059D}\InprocServer32\Class = "SWIFT.EntryGuard"	MSI6A45.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52CF6F10-1245-322B-AF5E-8848D1153C08}\InprocServer32\Class = "SWIFT.Styles.TaskPane"	MSI6A45.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6B9E758-BCB8-331F-B9B0-3DF439241D88}	MSI6A45.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4068	msiexec.exe
4068	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5536	msiexec.exe
Token: SeSecurityPrivilege	4068	msiexec.exe
Token: SeCreateTokenPrivilege	5536	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5536	msiexec.exe
Token: SeLockMemoryPrivilege	5536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5536	msiexec.exe
Token: SeMachineAccountPrivilege	5536	msiexec.exe
Token: SeTcbPrivilege	5536	msiexec.exe
Token: SeSecurityPrivilege	5536	msiexec.exe
Token: SeTakeOwnershipPrivilege	5536	msiexec.exe
Token: SeLoadDriverPrivilege	5536	msiexec.exe
Token: SeSystemProfilePrivilege	5536	msiexec.exe
Token: SeSystemtimePrivilege	5536	msiexec.exe
Token: SeProfSingleProcessPrivilege	5536	msiexec.exe
Token: SeIncBasePriorityPrivilege	5536	msiexec.exe
Token: SeCreatePagefilePrivilege	5536	msiexec.exe
Token: SeCreatePermanentPrivilege	5536	msiexec.exe
Token: SeBackupPrivilege	5536	msiexec.exe
Token: SeRestorePrivilege	5536	msiexec.exe
Token: SeShutdownPrivilege	5536	msiexec.exe
Token: SeDebugPrivilege	5536	msiexec.exe
Token: SeAuditPrivilege	5536	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5536	msiexec.exe
Token: SeChangeNotifyPrivilege	5536	msiexec.exe
Token: SeRemoteShutdownPrivilege	5536	msiexec.exe
Token: SeUndockPrivilege	5536	msiexec.exe
Token: SeSyncAgentPrivilege	5536	msiexec.exe
Token: SeEnableDelegationPrivilege	5536	msiexec.exe
Token: SeManageVolumePrivilege	5536	msiexec.exe
Token: SeImpersonatePrivilege	5536	msiexec.exe
Token: SeCreateGlobalPrivilege	5536	msiexec.exe
Token: SeCreateTokenPrivilege	5536	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5536	msiexec.exe
Token: SeLockMemoryPrivilege	5536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5536	msiexec.exe
Token: SeMachineAccountPrivilege	5536	msiexec.exe
Token: SeTcbPrivilege	5536	msiexec.exe
Token: SeSecurityPrivilege	5536	msiexec.exe
Token: SeTakeOwnershipPrivilege	5536	msiexec.exe
Token: SeLoadDriverPrivilege	5536	msiexec.exe
Token: SeSystemProfilePrivilege	5536	msiexec.exe
Token: SeSystemtimePrivilege	5536	msiexec.exe
Token: SeProfSingleProcessPrivilege	5536	msiexec.exe
Token: SeIncBasePriorityPrivilege	5536	msiexec.exe
Token: SeCreatePagefilePrivilege	5536	msiexec.exe
Token: SeCreatePermanentPrivilege	5536	msiexec.exe
Token: SeBackupPrivilege	5536	msiexec.exe
Token: SeRestorePrivilege	5536	msiexec.exe
Token: SeShutdownPrivilege	5536	msiexec.exe
Token: SeDebugPrivilege	5536	msiexec.exe
Token: SeAuditPrivilege	5536	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5536	msiexec.exe
Token: SeChangeNotifyPrivilege	5536	msiexec.exe
Token: SeRemoteShutdownPrivilege	5536	msiexec.exe
Token: SeUndockPrivilege	5536	msiexec.exe
Token: SeSyncAgentPrivilege	5536	msiexec.exe
Token: SeEnableDelegationPrivilege	5536	msiexec.exe
Token: SeManageVolumePrivilege	5536	msiexec.exe
Token: SeImpersonatePrivilege	5536	msiexec.exe
Token: SeCreateGlobalPrivilege	5536	msiexec.exe
Token: SeCreateTokenPrivilege	5536	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5536	msiexec.exe
Token: SeLockMemoryPrivilege	5536	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5536	msiexec.exe
5536	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5536	msiexec.exe
4068	msiexec.exe
2708	MsiExec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2708	4068	msiexec.exe	91
PID 4068 wrote to memory of 3092	4068	msiexec.exe	96
PID 4068 wrote to memory of 3512	4068	msiexec.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\swift-0509.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53D564BD4B1BC9DBD034D843DEDDA770 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2708
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3092
- C:\Windows\Installer\MSI6A45.tmp
  "C:\Windows\Installer\MSI6A45.tmp" /install="C:\Program Files (x86)\Duxbury\SWIFT\SWIFT.dll" /scope="perMachine"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5e30.rbs

Path C:\Config.Msi\e5a5e30.rbs
Size 181KB
SHA256 2b697497b965b5c696def61d2c038eb8b523eb103c34fb704829301ced75f315
MD5 6ee9527a4d914aadad26001e4268a854
SHA1 32436f040d550393767b2657702a1fb2170f54fa
SHA512 b771af1786be38f1288e23e679de22923cc2ebf0b918fe4074dc2cdb4e90c19e916073adee22f94584179cfd3b338ba40a90c33e671cbd91835fe1e0601b5735
SSDEEP 3072:8JDLZbxrdIYMldkxLn+vbRUmTxfJsUF6H1rDd:8Jv5fIYMlmxLnqUmvsGCtd
TLSH
T1C0047C107BD2C0B3E2A31932A6B5876166B5BF365B3280CB774C4A695B717D1BA3C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files (x86)\Duxbury\SWIFT\AddinExpress.MSO.2005.dll
Size 4.1MB
SHA256 e9a2a4bf72a95b969b47c7e45d9f86bf3af9b266c9a4bfe8f8738d069a8ccd9d
MD5 350ddb8f9c97104030ff71bf1cbfb995
SHA1 6bfe2046dddc524733cac70842ede669cd480d1e
SHA512 3acdb43200ad463311199023953bcad4527775f78164f05d681268cf3f00b24e058de0fb4a386446d838467c6e64f7cdc6efffc29a5ae55dc3cd670c21b74611
SSDEEP 24576:lrcoIxUtL01DXWcmRTdD34MLEiMe4hXzxzCC4xrH3ytK+UFvggPUS7VnwUbuB1:JtgJSJ34DP/H+ogPjbi
TLSH
T1C2167013ABECBCEAC4395371B33783D6C3ADEC4A5211C24E58C4612A29BD6537A177C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.WD.2005.dll

Path C:\Program Files (x86)\Duxbury\SWIFT\AddinExpress.WD.2005.dll
Size 681KB
SHA256 5729aa39022bb9a20230aff39784b268341441865f9dbbdb47444024eb3ec4a0
MD5 b4dcc45bd6cad2aeb5e509e9a76551bd
SHA1 e645036df6bba493c13e2cbf353cac1f19f0518e
SHA512 aae70eb59fbe9b88c72e62b9081999db513ad2f413e40ea64f86f72ae875d385257b231b4e8869bb9916a2c6369e2b2cd237f91fbe9fd48097640edf1f252e32
SSDEEP 12288:miw7MUOOaGWCzShFhb4aAqiydHhFljQfe:IHb1WhTNiydBXjQfe
TLSH
T1A3E4391227E87DA3D47E17BD63B65281C3B8EC16A243E74F45D4A0A61CB6352BE007E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DBTDebug.dll

Path C:\Program Files (x86)\Duxbury\SWIFT\DBTDebug.dll
Size 46KB
SHA256 66e2068f56b419e440f7e8fc3ad08045e57374584f5670d9fe5b472001223f3d
MD5 39ff6a3db93defe7a0eadddd0a181f73
SHA1 3e930b474dc022dc1b1fb26aa86da643be16ffdf
SHA512 a80864903af5be939bbc49fefe40b9e3318ac3c1e1fe250e60ef1f5d4dd763a6761b5223158a7e5442413383eaf68632afc49da855c178ffa6f3c05a417e4768
SSDEEP 768:pqzEx1trfvxjLa7p3jxFjGPYmCmPILll94mL9rA+Mtx:pL7trf5i7pzvigTf94n
TLSH
T1B2235C41BBF84903D9FF4BB5A8B0A5144AF67A466432E3ED1DD440ED0EA3BC04B517AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DBTServer.dll

Path C:\Program Files (x86)\Duxbury\SWIFT\DBTServer.dll
Size 61KB
SHA256 76364dcec8018e3ce9eb846b911c9b1836e2b67300f3049f9bd5352aa234d3cd
MD5 0ccc491a3507e53cf6da312ee3ff3310
SHA1 dba42f3ea6387797d79b3037ba820cfabc10edea
SHA512 7d71bf92253b1d8ed779556cf0e1e705ed4a9626c1ab5f84cf341de98bf840c190b448cbf2e7303a26361e38793c8c12f47cb9d4f32472f9d1bc3b082c6b0424
SSDEEP 1536:hIMt67Z43zxLjTnNOQoraNVOHEbpE1O1C4:ttE87NOQc0VOHEbEO1C4
TLSH
T11D535C10A7EC0227EBFE5B7DB5F640161B72B21B6626E39B1D8490DD1AA37C191303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWIFT.dll

Path C:\Program Files (x86)\Duxbury\SWIFT\SWIFT.dll
Size 256KB
SHA256 88730db24c782ab5dd8b20cbb8ac51b85c11f3a9c9ea555684df96ed90f3339d
MD5 01879faf85b86ed922108a421d7d4e71
SHA1 54e66e681234e1c3b82026ca05a3b69cbcdad8e1
SHA512 b93fed16029c8dd198cae5093dbc0fb04ea570ecfb28302fee5a9e93e6d2a872d98d3648427e3f093cba759bdc1c9918b8a3f893f28de7a68e4f1ed207502674
SSDEEP 6144:14b3ZNZtIiCaqrA5rLZ95P+yYAJ+4LyUuUOHSmOCVQx0qaPFkLvJDfMnAJfe3r+f:14b3ZNZtIiCaqrA5rLZ95P+yYAJ+4Ly4
TLSH
T1A644D65033FC5D1BE2BF6BB4B57451544BB2BA97A93AC7CE1C8014DE08E1B409DA1BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB5E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB5E8.tmp
Size 159KB
SHA256 eb73c5e8556418506e5b990c43ba2c3c4668f276d1403ddb83a53ce6d4c8b2c0
MD5 662bfa4da36051d9580e483eb170747c
SHA1 2a265a993fc3c978bdf7ba351d13686c9da3397d
SHA512 43798d2da8b7f7625cc55cadadda60164a746b9b646d605aa8c2cff951c974b890e03f48e0b94e53a5366119ed118e60ee8efcfc55f037c76722143ac849070c
SSDEEP 3072:pMkbTc2Yh4W6freQH7TBGfm8AB8dPdjsrVyr/fsn:pMoThYMfrN+m8ZQ8Xsn
TLSH
T1D0F38D223290C472D66F1A3955B187765F7ABD51CAB0848B7BDC4A3D9F74382DB3830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6A45.tmp

Path C:\Windows\Installer\MSI6A45.tmp
Size 167KB
SHA256 c279c4abde5aa07cdf3e40c851c4569d7d4833c3a89f4a430a7e94370eb49121
MD5 9bc68ef340f85730aa670fdc2b5a3f08
SHA1 3d0a15609a7de02387dc439048d3bda09c54ebfe
SHA512 9e40b5b2a612ccd284edeecc50b1edcadba65eeadf1d4d72e2e9d2414e4b12242b2b3503def2764497c82e42fa89aca285a41f4291cc33a9e63771c0b14b8d32
SSDEEP 3072:bJDLZbxrdIYMldkxLn+vbRUmTxfJsUF6H1rD:bJv5fIYMlmxLnqUmvsGCt
TLSH
T1B3F37C607BD6C472E1A2193255F487A26A29BF325B32D0CB775C4AA85F307D1BA3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5e31.msi

Path C:\Windows\Installer\e5a5e31.msi
Size 11.4MB
SHA256 1cb9d296560c97aa2e7f6fee983774a235fbfd641446b6670dce0daba46e013d
MD5 50460a7ff24a39097e0ad0ddaf74ecfe
SHA1 73cab87d0bf99f9520e57b4e712df9f52df9c36d
SHA512 11bed65b992cd6b34acf1141d4ea87309b3e2756099985fa5b7f7f980f5afcd7f31ca57401633bda1b4bcbce01d13116a7d9bf4a3130395c9c178e3269fad830
SSDEEP 196608:SRtmvruXT5ZGkRthFz7BGC92Pn19CQOhyWjp6LMIoFH4VYCLEhGuGT:hyXnJex199OgWgEH4ju
TLSH
T19CC6332171828A33C277063A61A7E7369B75BC245B3582CB775D73ED2F302C0A67AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 8ac8b785f010de923fe3564a961dccb297978541bb05404254595475ab5ceb0e
MD5 2a8250701f160b81db3247e0dd7a2685
SHA1 348c6b7b8a1d66e413f657c47e655a933d461d4c
SHA512 d91ea6174000322e284ec11ec487566163c63923dd4861a373ba260a6409292b1df27fbe5563419ff697a746b14d10d601b9b5aa114ff1efeec73d360c9a396e
SSDEEP 24576:9Fo3DMPKdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+3:CHc
TLSH
T1E357B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{cf75a9c4-1842-4640-b635-8fbae5ec9ca7}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cf75a9c4-1842-4640-b635-8fbae5ec9ca7}_OnDiskSnapshotProp
Size 6KB
SHA256 43771166e5124897531b638a6fa86111046ac8d52e34ac56fd2c40cb854e07f2
MD5 37630983a08aa5c47fe14edb5ddfa6c3
SHA1 e6291ce90666ceeb49672d1c9af521c1194f1ea1
SHA512 9884a4d2081823286cc216966f4b53e2fa1afa17bee7e6df8e45b4b80fdaad7727dc8775ab428d72e23760bf686a73b94ac9564d0b78ca214d065f2a16383b42
SSDEEP 96:FJKnPaZxvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:3KnPeb++uVmN
TLSH
T1E9D187085AF54711E2B3AB3228F14557A477B911EF33CB8E0198238E6670910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path \??\c:\program files (x86)\duxbury\swift\adxloader.dll.manifest
Size 310B
SHA256 1be96ed0e7f0cc4252f9d17828cb568bf9c2f4f977d90dd556b917283a2c804e
MD5 4106800857daf16f5eaedf1f5a8ffa5e
SHA1 899888a131cfcda171974c41b29d8089d0e4dfad
SHA512 3c1c944544db1d9ca2c9c5110f432afeabd3b92f201bb9b262ec6bb5ce0d402ab038e95f96d47ac9b01ab4161305cac839d040e86302602ad342b48a372d9e32
TLSH
T113E07D03528C5F534A22861AFAD0C41552BC26D6E8080A09B566727EB54445847F31B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3512-102-0x0000000007540000-0x000000000789B000-memory.dmp

Download

memory/3512-103-0x0000000007990000-0x0000000007A78000-memory.dmp

Download

memory/3512-104-0x0000000007A80000-0x0000000007AF2000-memory.dmp

Download

memory/3512-85-0x0000000005B90000-0x0000000005FB8000-memory.dmp

Download

memory/3512-109-0x0000000006450000-0x0000000006460000-memory.dmp

Download

memory/3512-97-0x0000000006240000-0x0000000006254000-memory.dmp

Download

memory/3512-101-0x0000000006470000-0x000000000651C000-memory.dmp

Download

memory/3512-93-0x0000000006270000-0x00000000062B4000-memory.dmp

Download

memory/3512-88-0x0000000005B50000-0x0000000005B5A000-memory.dmp

Download

memory/3512-87-0x0000000005FC0000-0x0000000006052000-memory.dmp

Download

memory/3512-86-0x0000000006580000-0x0000000006B3A000-memory.dmp

Download