Analysis
- max time kernel
142s - max time network
34s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
03/04/2023, 05:56
General
- Target Project UAE_UNIVERSITY.exe
- Size 646KB
- Sample230403-gm2nmada94
- SHA256 d5fc5fba51a492858f45d0f86b010ac6ab2bc68be94fc2c8a776b7eaf3acaac3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project UAE_UNIVERSITY.exe"C:\Users\Admin\AppData\Local\Temp\Project UAE_UNIVERSITY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project UAE_UNIVERSITY.exe"C:\Users\Admin\AppData\Local\Temp\Project UAE_UNIVERSITY.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1284-60-0x0000000001F00000-0x0000000001F38000-memory.dmp
memory/1284-55-0x0000000004AE0000-0x0000000004B20000-memory.dmp
memory/1284-56-0x0000000000310000-0x0000000000324000-memory.dmp
memory/1284-57-0x0000000000360000-0x000000000036C000-memory.dmp
memory/1284-58-0x0000000005540000-0x00000000055BC000-memory.dmp
memory/1284-59-0x0000000000400000-0x0000000000406000-memory.dmp
memory/1284-65-0x0000000004AE5000-0x0000000004B03000-memory.dmp
memory/1284-54-0x0000000000210000-0x00000000002B6000-memory.dmp
memory/2004-66-0x0000000000820000-0x0000000000B23000-memory.dmp
memory/2004-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2004-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2004-67-0x0000000000400000-0x000000000042F000-memory.dmp