Analysis
- max time kernel
12s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SwiftTunnel-Setup-3.9.7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SwiftTunnel-Setup-3.9.7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target SwiftTunnel-Setup-3.9.7.exe
- Size 19.3MB
- Sample261101-2kh4qade37
- SHA256 8ee00507d493f44b28fb53a740e9c43d545105b6fa1d23bd8dfb3a317c9ca140
- MD5 f842ea4821f26c27f66657313563b340
- SHA1 ecfea5d119a47f512cd88444372cbd61e48f46f3
- SHA512 ec3a52fd542869fcc9ca254f2e787212877f851c3d241806a59141d864d5519b1a8098411bbda55bbc99bdeab70f0314beb077f280c03493d1dcd2907e3d23ee
- SSDEEP 393216:omz1YY2qyocX5dJLAa/3nBYxdVnWFTdK+sHYXRNtbSAnxaheKppIHH:oO1tBqM+3BYxvWddPqwRNtbUheVH
- TLSH T1781712137E4698ACD54ACC74827687625B2178EA0B21A9EF01C5663CFEF97F01B393D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1296 swifttunnel-desktop.exe 1296 swifttunnel-desktop.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files\SwiftTunnel\resources\drivers\WinpkFilter-x64.msi msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\mullvad-split-tunnel.sys msiexec.exe File created C:\Program Files\SwiftTunnel\resources\swifty.png msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd.cat msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd.sys msiexec.exe File created C:\Program Files\SwiftTunnel\swifttunnel-desktop.exe msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\WinpkFilter-arm64.msi msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\arm64\win10\ndisrd.cat msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\wintun.dll msiexec.exe File created C:\Program Files\SwiftTunnel\resources\lite\swifttunnel-lite.exe msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\arm64\win10\ndisrd.sys msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\arm64\win10\ndisrd_lwf.inf msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winfw.dll msiexec.exe File created C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd_lwf.inf msiexec.exe File created C:\Program Files\SwiftTunnel\resources\lite\.gitignore msiexec.exe File created C:\Program Files\SwiftTunnel\swifttunnel_msi_actions.dll msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e59b56b.msi msiexec.exe File opened for modification C:\Windows\Installer\e59b56b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF19D2173EBD247CA7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{4582A327-F575-4EB0-B8B6-ECAC2651E8B6} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF31B96E41F208A84C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBA7C.tmp msiexec.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 6104 powershell.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 244 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5648 msiexec.exe 5648 msiexec.exe 5648 msiexec.exe 5648 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3140 msiexec.exe Token: SeIncreaseQuotaPrivilege 3140 msiexec.exe Token: SeSecurityPrivilege 5648 msiexec.exe Token: SeCreateTokenPrivilege 3140 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3140 msiexec.exe Token: SeLockMemoryPrivilege 3140 msiexec.exe Token: SeIncreaseQuotaPrivilege 3140 msiexec.exe Token: SeMachineAccountPrivilege 3140 msiexec.exe Token: SeTcbPrivilege 3140 msiexec.exe Token: SeSecurityPrivilege 3140 msiexec.exe Token: SeTakeOwnershipPrivilege 3140 msiexec.exe Token: SeLoadDriverPrivilege 3140 msiexec.exe Token: SeSystemProfilePrivilege 3140 msiexec.exe Token: SeSystemtimePrivilege 3140 msiexec.exe Token: SeProfSingleProcessPrivilege 3140 msiexec.exe Token: SeIncBasePriorityPrivilege 3140 msiexec.exe Token: SeCreatePagefilePrivilege 3140 msiexec.exe Token: SeCreatePermanentPrivilege 3140 msiexec.exe Token: SeBackupPrivilege 3140 msiexec.exe Token: SeRestorePrivilege 3140 msiexec.exe Token: SeShutdownPrivilege 3140 msiexec.exe Token: SeDebugPrivilege 3140 msiexec.exe Token: SeAuditPrivilege 3140 msiexec.exe Token: SeSystemEnvironmentPrivilege 3140 msiexec.exe Token: SeChangeNotifyPrivilege 3140 msiexec.exe Token: SeRemoteShutdownPrivilege 3140 msiexec.exe Token: SeUndockPrivilege 3140 msiexec.exe Token: SeSyncAgentPrivilege 3140 msiexec.exe Token: SeEnableDelegationPrivilege 3140 msiexec.exe Token: SeManageVolumePrivilege 3140 msiexec.exe Token: SeImpersonatePrivilege 3140 msiexec.exe Token: SeCreateGlobalPrivilege 3140 msiexec.exe Token: SeRestorePrivilege 5648 msiexec.exe Token: SeTakeOwnershipPrivilege 5648 msiexec.exe Token: SeRestorePrivilege 5648 msiexec.exe Token: SeTakeOwnershipPrivilege 5648 msiexec.exe Token: SeShutdownPrivilege 3140 msiexec.exe Token: SeIncreaseQuotaPrivilege 3140 msiexec.exe Token: SeSecurityPrivilege 5648 msiexec.exe Token: SeCreateTokenPrivilege 3140 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3140 msiexec.exe Token: SeLockMemoryPrivilege 3140 msiexec.exe Token: SeIncreaseQuotaPrivilege 3140 msiexec.exe Token: SeMachineAccountPrivilege 3140 msiexec.exe Token: SeTcbPrivilege 3140 msiexec.exe Token: SeSecurityPrivilege 3140 msiexec.exe Token: SeTakeOwnershipPrivilege 3140 msiexec.exe Token: SeLoadDriverPrivilege 3140 msiexec.exe Token: SeSystemProfilePrivilege 3140 msiexec.exe Token: SeSystemtimePrivilege 3140 msiexec.exe Token: SeProfSingleProcessPrivilege 3140 msiexec.exe Token: SeIncBasePriorityPrivilege 3140 msiexec.exe Token: SeCreatePagefilePrivilege 3140 msiexec.exe Token: SeCreatePermanentPrivilege 3140 msiexec.exe Token: SeBackupPrivilege 3140 msiexec.exe Token: SeRestorePrivilege 3140 msiexec.exe Token: SeShutdownPrivilege 3140 msiexec.exe Token: SeDebugPrivilege 3140 msiexec.exe Token: SeAuditPrivilege 3140 msiexec.exe Token: SeSystemEnvironmentPrivilege 3140 msiexec.exe Token: SeChangeNotifyPrivilege 3140 msiexec.exe Token: SeRemoteShutdownPrivilege 3140 msiexec.exe Token: SeUndockPrivilege 3140 msiexec.exe Token: SeSyncAgentPrivilege 3140 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3140 msiexec.exe 5648 msiexec.exe 3140 msiexec.exe 5648 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3140 4256 SwiftTunnel-Setup-3.9.7.exe 88 PID 5648 wrote to memory of 1296 5648 msiexec.exe 90 PID 1296 wrote to memory of 5804 1296 swifttunnel-desktop.exe 91 PID 4256 wrote to memory of 3140 4256 SwiftTunnel-Setup-3.9.7.exe 88 PID 5648 wrote to memory of 1296 5648 msiexec.exe 90 PID 1296 wrote to memory of 5804 1296 swifttunnel-desktop.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwiftTunnel-Setup-3.9.7.exe"C:\Users\Admin\AppData\Local\Temp\SwiftTunnel-Setup-3.9.7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\ProgramData\SwiftTunnelInstallerCache\SwiftTunnel-Installer-df4947b0af4185086b84af360bc51e70dc0f62c3d25c3f5f41d92f2260406bd2.msi /qn /norestart REBOOT=ReallySuppress2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Program Files\SwiftTunnel\swifttunnel-desktop.exe"C:\Program Files\SwiftTunnel\swifttunnel-desktop.exe" --install-driver2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\System32\pnputil.exe"C:\Windows\System32\pnputil.exe" /enum-drivers3⤵PID:5804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32/WindowsPowerShell/v1.0/powershell.exe" -NoProfile -NonInteractive -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); $ErrorActionPreference = 'Stop' $bindings = @( Get-NetAdapterBinding -ComponentID 'nt_ndisrd' -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq $true } | Sort-Object -Property Name -Unique ) if ($bindings.Count -eq 0) { Write-Output 'No enabled WinpkFilter bindings found during uninstall cleanup.' exit 0 } $disabled = New-Object System.Collections.Generic.List[string] $failures = New-Object System.Collections.Generic.List[string] foreach ($binding in $bindings) { $adapterName = [string]$binding.Name if ([string]::IsNullOrWhiteSpace($adapterName)) { continue } try { Disable-NetAdapterBinding -Name $adapterName -ComponentID 'nt_ndisrd' -Confirm:$false -ErrorAction Stop | Out-Null Start-Sleep -Milliseconds 500 $verification = Get-NetAdapterBinding -Name $adapterName -ComponentID 'nt_ndisrd' -ErrorAction SilentlyContinue | Select-Object -First 1 if ($verification -and $verification.Enabled) { $failures.Add($adapterName + ': binding still enabled after Disable-NetAdapterBinding') continue } $disabled.Add($adapterName) } catch { $failures.Add($adapterName + ': ' + $_.Exception.Message) } } if ($disabled.Count -gt 0) { Write-Output ('Disabled WinpkFilter binding on adapters: ' + ($disabled -join ', ')) } if ($failures.Count -gt 0) { Write-Error ('Failed to disable WinpkFilter binding on adapters: ' + ($failures -join '; ')) exit 1 } "3⤵
- Hide Artifacts: Ignore Process Interrupts
PID:6104
-
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns3⤵
- Gathers network information
PID:244
-
-
C:\Windows\System32\pnputil.exe"C:\Windows\System32\pnputil.exe" /enum-drivers3⤵PID:5716
-
-
C:\Windows\system32\netcfg.exe"netcfg" /l "C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd_lwf.inf" /c s /i nt_ndisrd3⤵PID:2824
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd_lwf.inf" "9" "4c6f6cd13" "0000000000000174" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10"1⤵PID:2368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd.cat
- Size 11KB
- SHA256 43fe8866894919cb8b7b4729ce8910d7d4c416260465edda6fce68396de83629
- MD5 ec34c19917391131a1bee7eb573108f9
- SHA1 6b51b1c02cfc21f1ffa8e01662c0f77826936626
- SHA512 cab41c901ead9ab6a71c4889e8d99aba6e05bfb33cbd0e91c21528309176df5855a7f505c18806f54316b1df4809742d860a4d9a7b7a4d5d932f71ef99552554
- SSDEEP 192:rCkITkxiz+KJCpfNEwm1ahYCTzxOhJNlOCgX01k9z3AUEsv:WluK71ah3TzxIPaR9zXES
- TLSH T1364208A245684082FD6BBC2053E8F99B7D3D23CB585044AA62EFF3550CA73C9F72852D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd.sys
- Size 69KB
- SHA256 8623a9c34531cf73de4286ad518b84af03a331c78959769a1ca38723e3258984
- MD5 3774a434fca6f4be006118d1e460a173
- SHA1 39bfd5523b1536748de45c9a4f890469343b7446
- SHA512 5d8474820b9e25038e1f6466f0834954b509e47873db914d4959cfb3787ae735a37b3aa6d480bb00d281627573632808e4ef7a60ec6234e0f6dc36aebfce4215
- SSDEEP 1536:IMszehJhh4Fg4hDZYOIstp3/uHV/paOZozzN9qQIItIFxU2Ukz89r:IvFg4Msp3/u1/pEzzfqQIjxUpkw9
- TLSH T109639DA7AA6004C6ED6A8478D3F1EA1BEE71B592172087CF0374D1590F277D1AB3D329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SwiftTunnel\resources\drivers\winpkfilter\x64\win10\ndisrd_lwf.inf
- Size 2KB
- SHA256 71dbe4b33f3654f3e37d27f507d1cd6ade70fb9c1a327435155c6c71dd137654
- MD5 66bee67ad9ccd9bc09a786c9acbf573e
- SHA1 fbf680d65a71159e718187549cc41996f6ee32d4
- SHA512 01e9d04e83cf27058a3b3c529f558a9bf8f45c0d105c1c584d78851143b8ed305bbc4048655f92a11bca02aa72194630b1d7b18435f6ca0269c18bf513692184
- TLSH T13C51323C4EC53A3014A7D39BB74E2CC2E43C6084858D024873ED44A2D78F9EDB32C969
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\SwiftTunnel\swifttunnel-desktop.exe
- Size 19.9MB
- SHA256 f5d943a621d1cf1f37f46dc799662baa0201b11471038842c4177894e3705ebe
- MD5 acd971e6e07837ec3bef2ec83b26d74a
- SHA1 d8a5e006b8ddb758a98177bb86773b8bd4e753b0
- SHA512 431a24bd2d95e667511f6fcc0b5ddca8802d70abd9b32ca883f05baea4316ab30f117d108ec50ce97a5e4141eebffb030fcef173e7042284fc744caf93e49cae
- SSDEEP 196608://X5u3MKDxq9BvlAyPdZN1Jcc9y5kKveBg:/xu3MKDSBXVZN1Ja/GBg
- TLSH T1BC2708117A6B98ADD597C87083478AB34E2130DB1A36B9BF44C446393F7DBF46F29218
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SwiftTunnelInstallerCache\SwiftTunnel-Installer-df4947b0af4185086b84af360bc51e70dc0f62c3d25c3f5f41d92f2260406bd2.msi
- Size 16.6MB
- SHA256 df4947b0af4185086b84af360bc51e70dc0f62c3d25c3f5f41d92f2260406bd2
- MD5 d4fc00e4ee7beda63e9c153d2fb8c7cf
- SHA1 af6308b311acf9dec84c60c0c202f8dbbea295e7
- SHA512 baf03f9d62d036b5f50140035d4742169e4556f820c39c375b068e79db802d9cd89c469f2b61b224b18a02e3492759df203b9543b128c10769a7c8b170a47394
- SSDEEP 393216:Lmz1YY2qyocX5dJLAa/3nBYxdVnWFTdK+sHYXRNtbSAnxaheKp:LO1tBqM+3BYxvWddPqwRNtbUhe
- TLSH T1B70733137EC15976E46B4DB1827347A17634BCA40F21588F13963B2EDDF02E1AA327E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SwiftTunnelInstallerCache\driver-install.log
- Size 44B
- SHA256 42408a06d5601e92000e33cf2c657bf8712dc93238e2323f8cf33fbe28abfef1
- MD5 40669360799ef86417060ffeda8d5b17
- SHA1 bd48553b8e3a6ddaad2c8742323be3f7893f9819
- SHA512 df0d11f1f240579e9ea184871dc3d3c70d47201926993efeeabc46ffa1ec2dc3ba5c0ecd543a02f7c01a22f7ee352e61d280ed8d25848609695447ce52a903e7
- MD5 SHA1 SHA512
- Path C:\ProgramData\SwiftTunnelInstallerCache\driver-install.log
- Size 87B
- SHA256 74104c676eb797f560db2a188d0946bbb064500831eef2075a16795ae155ccd8
- MD5 7bbd1875c76d0f202b69dc6d4e00f425
- SHA1 6db51045a813a54dfc7e81c6c5113e1444f000ef
- SHA512 8ff0b1aa3774e01693fdd814d8d188522542715f85769475ff6b30f9d50c5691e6d27c23e9599d308e470473534bd8fce22cefc059c132b531301e99b61fd45a
- TLSH T16DB012585420183AA940DB9DD04A03045F090C00476610E8C099D1C1404311AD062833
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ndisrd_lwf.inf_amd64_3e057a45b712eeff.ini
- Size 420B
- SHA256 5eafcb421b269a868ca5f6e8ace40e29d19dfb0616a0f8177485a4a703f4698f
- MD5 f344c53ba2b9d30029f2e3ddd3f21874
- SHA1 a8e7a297004995abfcf1dd784a67137e335480ff
- SHA512 83a372ee105ca9480122cd422b8e55a8109a2184f4651c48462ff1fb220f973fe1e4f8abae1299a4e1776a6794b12a1a2dc9ad37fe8e1ff8ba3dcfed74d695f9
- TLSH T11DE0E5BB2263D5DF8545A756116E3BA2CC0C631F564A38E230C862A18F0ECB0FD422CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_04ecdnd2.f4h.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH