Loading ...

Play interactive tourEdit tour

Analysis Report swift_7974.exe

Overview

General Information

Sample Name:swift_7974.exe
MD5:475e1f8a737a1137a0935909184f8824
SHA1:15b9a691f4490c3c562e8bf5639f999c4cf95313
SHA256:0310713073d73da7a45ff957b3fdba84d8d6da70a91a8404c66561007d505d08

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • swift_7974.exe (PID: 4028 cmdline: 'C:\Users\user\Desktop\swift_7974.exe' MD5: 475E1F8A737A1137A0935909184F8824)
    • schtasks.exe (PID: 1336 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • swift_7974.exe (PID: 5288 cmdline: C:\Users\user\Desktop\swift_7974.exe MD5: 475E1F8A737A1137A0935909184F8824)
    • swift_7974.exe (PID: 3688 cmdline: C:\Users\user\Desktop\swift_7974.exe MD5: 475E1F8A737A1137A0935909184F8824)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.1197046321.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.809000099.0000000003819000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000005.00000002.1199051636.0000000002D10000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000005.00000002.1199051636.0000000002D10000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          Process Memory Space: swift_7974.exe PID: 4028JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.swift_7974.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview


              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\swift_7974.exe' , ParentImage: C:\Users\user\Desktop\swift_7974.exe, ParentProcessId: 4028, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp', ProcessId: 1336

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\iupISfIFOx.exeVirustotal: Detection: 16%Perma Link
              Source: C:\Users\user\AppData\Roaming\iupISfIFOx.exeReversingLabs: Detection: 18%
              Multi AV Scanner detection for submitted fileShow sources
              Source: swift_7974.exeVirustotal: Detection: 16%Perma Link
              Source: swift_7974.exeReversingLabs: Detection: 18%
              Source: 5.2.swift_7974.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: swift_7974.exe, 00000000.00000002.808171948.0000000002810000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: swift_7974.exeString found in binary or memory: http://www.cutebits.com/ExpSok
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: swift_7974.exe, 00000000.00000002.812905478.0000000005866000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

              System Summary:

              barindex
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D9E580_2_070D9E58
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D86600_2_070D8660
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D9B200_2_070D9B20
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D89F00_2_070D89F0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D8F8C0_2_070D8F8C
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D5D190_2_070D5D19
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D5D280_2_070D5D28
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D9BD10_2_070D9BD1
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D8A480_2_070D8A48
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D8A8D0_2_070D8A8D
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D30320_2_070D3032
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A3A5F20_2_07A3A5F2
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A389800_2_07A38980
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A3C8300_2_07A3C830
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A34E280_2_07A34E28
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A389710_2_07A38971
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_02B2F4305_2_02B2F430
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_02B2F7305_2_02B2F730
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_02B2F4205_2_02B2F420
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052034C85_2_052034C8
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052091E05_2_052091E0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_0520E0285_2_0520E028
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05201D205_2_05201D20
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_0520EC405_2_0520EC40
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052028005_2_05202800
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05207B085_2_05207B08
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05206BE05_2_05206BE0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052027F05_2_052027F0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052070735_2_05207073
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_0520E3705_2_0520E370
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05206FC45_2_05206FC4
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_052038F05_2_052038F0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05206BD05_2_05206BD0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_0520BA105_2_0520BA10
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_05207AF85_2_05207AF8
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B4CE05_2_062B4CE0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B52A05_2_062B52A0
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062BD3CC5_2_062BD3CC
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B507F5_2_062B507F
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B4E2D5_2_062B4E2D
              Source: swift_7974.exe, 00000000.00000002.816649836.00000000074A0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.816649836.00000000074A0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.808347705.000000000285E000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDriverUpdater.dll< vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000000.772710795.000000000051C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameQxfboEprjJ.exe. vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.816274210.0000000007180000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCyrus.exe4 vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.808171948.0000000002810000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameeFQVJDajAUIIwGJYpIYct.exe4 vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.817187855.00000000079C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs swift_7974.exe
              Source: swift_7974.exe, 00000000.00000002.816513862.0000000007450000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs swift_7974.exe
              Source: swift_7974.exe, 00000004.00000002.804211116.00000000001BC000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameQxfboEprjJ.exe. vs swift_7974.exe
              Source: swift_7974.exe, 00000005.00000002.1197046321.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameeFQVJDajAUIIwGJYpIYct.exe4 vs swift_7974.exe
              Source: swift_7974.exe, 00000005.00000002.1202205871.0000000006220000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs swift_7974.exe
              Source: swift_7974.exe, 00000005.00000000.805306489.0000000000A5C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameQxfboEprjJ.exe. vs swift_7974.exe
              Source: swift_7974.exe, 00000005.00000002.1201755653.0000000005E80000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs swift_7974.exe
              Source: swift_7974.exe, 00000005.00000002.1197498448.0000000000BE7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs swift_7974.exe
              Source: swift_7974.exeBinary or memory string: OriginalFilenameQxfboEprjJ.exe. vs swift_7974.exe
              Source: swift_7974.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: iupISfIFOx.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/4@0/0
              Source: C:\Users\user\Desktop\swift_7974.exeFile created: C:\Users\user\AppData\Roaming\iupISfIFOx.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_01
              Source: C:\Users\user\Desktop\swift_7974.exeFile created: C:\Users\user\AppData\Local\Temp\tmp1E19.tmpJump to behavior
              Source: swift_7974.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\swift_7974.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\5e7364da399b604ae01baff696551080\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\5e7364da399b604ae01baff696551080\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\swift_7974.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: swift_7974.exeVirustotal: Detection: 16%
              Source: swift_7974.exeReversingLabs: Detection: 18%
              Source: C:\Users\user\Desktop\swift_7974.exeFile read: C:\Users\user\Desktop\swift_7974.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\swift_7974.exe 'C:\Users\user\Desktop\swift_7974.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exe
              Source: unknownProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exe
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exeJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exeJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: swift_7974.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: swift_7974.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

              Data Obfuscation:

              barindex
              .NET source code contains potential unpackerShow sources
              Source: swift_7974.exe, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: iupISfIFOx.exe.0.dr, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.0.swift_7974.exe.4a0000.0.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.2.swift_7974.exe.4a0000.0.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 4.2.swift_7974.exe.140000.0.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 4.0.swift_7974.exe.140000.0.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.swift_7974.exe.9e0000.0.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.2.swift_7974.exe.9e0000.1.unpack, Speccy/ChoosePlayer.cs.Net Code: delegate1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_004A80C8 push es; ret 0_2_004A80D6
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_070D077C pushad ; retf 0_2_070D077D
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 0_2_07A3CDE5 push FFFFFF8Bh; iretd 0_2_07A3CDE7
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 4_2_001480C8 push es; ret 4_2_001480D6
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_009E80C8 push es; ret 5_2_009E80D6
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B370B push ss; retf 5_2_062B370D
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B0040 push es; iretd 5_2_062B0E78
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B108D push es; iretd 5_2_062B10B8
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B10E1 push es; iretd 5_2_062B1170
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B2150 pushad ; ret 5_2_062B215D
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B1E04 push 0000001Ah; retf 5_2_062B1E06
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_062B1E53 push 0000001Ah; retf 5_2_062B1E55
              Source: initial sampleStatic PE information: section name: .text entropy: 7.61010132234
              Source: initial sampleStatic PE information: section name: .text entropy: 7.61010132234

              Source: C:\Users\user\Desktop\swift_7974.exeFile created: C:\Users\user\AppData\Roaming\iupISfIFOx.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp'

              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\swift_7974.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\swift_7974.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Source: C:\Users\user\Desktop\swift_7974.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeWindow / User API: threadDelayed 993Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 4280Thread sleep time: -33000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 4280Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 3312Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -1844674407370954s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5556Thread sleep count: 96 > 30Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5556Thread sleep count: 993 > 30Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -59500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -88968s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -57718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -57532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -56812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -113252s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55938s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -83250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -54812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -54532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -54312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -54126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -53438s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -52718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -78798s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -52032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -51094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -50126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -48906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -48000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -46626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -45626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -45218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -42626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -42406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -41094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -40812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -60609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -39718s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -57189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -36532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -54468s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -36094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -53859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -35406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -35218s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -34500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -33406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -48000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -31126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -59812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -59594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58438s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -84609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -53000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -52312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -51812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -77439s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -49500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -49312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -48406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -47500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -46406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -45000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -44312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -40032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -39312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -38406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -37938s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -37000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -36812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -35626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -33812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -33126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -31312s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -30812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -30626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -58906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -57500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -55220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -53688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -51406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -49032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -48626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exe TID: 5592Thread sleep time: -45406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\swift_7974.exeLast function: Thread delayed
              Source: swift_7974.exe, 00000005.00000002.1201755653.0000000005E80000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: swift_7974.exe, 00000005.00000002.1201755653.0000000005E80000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: swift_7974.exe, 00000005.00000002.1201755653.0000000005E80000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: swift_7974.exe, 00000005.00000002.1201755653.0000000005E80000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\swift_7974.exeProcess information queried: ProcessInformationJump to behavior

              Source: C:\Users\user\Desktop\swift_7974.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\swift_7974.exeMemory written: C:\Users\user\Desktop\swift_7974.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\iupISfIFOx' /XML 'C:\Users\user\AppData\Local\Temp\tmp1E19.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exeJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeProcess created: C:\Users\user\Desktop\swift_7974.exe C:\Users\user\Desktop\swift_7974.exeJump to behavior
              Source: swift_7974.exe, 00000005.00000002.1198658601.00000000016C0000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: swift_7974.exe, 00000005.00000002.1198658601.00000000016C0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: swift_7974.exe, 00000005.00000002.1198658601.00000000016C0000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: swift_7974.exe, 00000005.00000002.1198658601.00000000016C0000.00000002.00000001.sdmpBinary or memory string: Progmanlock

              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Users\user\Desktop\swift_7974.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Users\user\Desktop\swift_7974.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeCode function: 5_2_0520AD14 GetUserNameW,5_2_0520AD14
              Source: C:\Users\user\Desktop\swift_7974.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.1197046321.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.809000099.0000000003819000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1199051636.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: swift_7974.exe PID: 4028, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: swift_7974.exe PID: 3688, type: MEMORY
              Source: Yara matchFile source: 5.2.swift_7974.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\swift_7974.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Users\user\Desktop\swift_7974.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: Yara matchFile source: 00000005.00000002.1199051636.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: swift_7974.exe PID: 3688, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.1197046321.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.809000099.0000000003819000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1199051636.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: swift_7974.exe PID: 4028, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: swift_7974.exe PID: 3688, type: MEMORY
              Source: Yara matchFile source: 5.2.swift_7974.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Scheduled Task1Process Injection112Masquerading1Credential Dumping2Virtualization/Sandbox Evasion13Application Deployment SoftwareEmail Collection1Data Encrypted1Standard Cryptographic Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Replication Through Removable MediaScheduled Task1Port MonitorsScheduled Task1Software Packing13Credentials in Registry1Process Discovery2Remote ServicesData from Local System2Exfiltration Over Other Network MediumFallback ChannelsExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              External Remote ServicesWindows Management InstrumentationAccessibility FeaturesPath InterceptionDisabling Security Tools1Input CaptureApplication Window Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationCustom Cryptographic ProtocolExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingVirtualization/Sandbox Evasion13Credentials in FilesAccount Discovery1Logon ScriptsInput CaptureData EncryptedMultiband CommunicationSIM Card SwapPremium SMS Toll Fraud
              Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessProcess Injection112Account ManipulationSystem Owner/User Discovery1Shared WebrootData StagedScheduled TransferStandard Cryptographic ProtocolManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceObfuscated Files or Information2Brute ForceSecurity Software Discovery211Third-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
              Spearphishing AttachmentScriptingPath InterceptionScheduled TaskSoftware PackingTwo-Factor Authentication InterceptionFile and Directory Discovery1Pass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Spearphishing via ServiceThird-party SoftwareLogon ScriptsProcess InjectionIndicator BlockingBash HistorySystem Information Discovery114Remote Desktop ProtocolClipboard DataExfiltration Over Alternative ProtocolStandard Application Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph