Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 07:49
General
- Target UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe
- Size 780KB
- Sample240510-jnshfsbc6v
- SHA256 1b7afac2a9b048cdf2e40469ef11cc2830eff9223177a288a0bce06f6f508f71
Malware Config
Signatures
- Suspicious use of SetThreadContext 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe"C:\Users\Admin\AppData\Local\Temp\UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe"C:\Users\Admin\AppData\Local\Temp\UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\DevicePairingWizard.exe"C:\Windows\SysWOW64\DevicePairingWizard.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-21-0x0000000000D40000-0x0000000000D80000-memory.dmp
memory/1644-29-0x0000000002E90000-0x0000000002F2D000-memory.dmp
memory/1644-28-0x0000000000D40000-0x0000000000D80000-memory.dmp
memory/1644-27-0x0000000002E90000-0x0000000002F2D000-memory.dmp
memory/1644-26-0x0000000000D40000-0x0000000000D80000-memory.dmp
memory/1644-25-0x0000000002F40000-0x000000000328A000-memory.dmp
memory/1644-22-0x0000000000D40000-0x0000000000D80000-memory.dmp
memory/2956-8-0x00000000060E0000-0x00000000060EE000-memory.dmp
memory/2956-7-0x00000000053E0000-0x00000000053F8000-memory.dmp
memory/2956-9-0x00000000060F0000-0x0000000006104000-memory.dmp
memory/2956-10-0x0000000002830000-0x00000000028BC000-memory.dmp
memory/2956-1-0x00000000003B0000-0x0000000000476000-memory.dmp
memory/2956-13-0x0000000074BDE000-0x0000000074BDF000-memory.dmp
memory/2956-2-0x0000000005410000-0x00000000059B4000-memory.dmp
memory/2956-15-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2956-3-0x0000000004E60000-0x0000000004EF2000-memory.dmp
memory/2956-4-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2956-5-0x0000000004E30000-0x0000000004E3A000-memory.dmp
memory/2956-6-0x00000000050A0000-0x000000000513C000-memory.dmp
memory/2956-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp
memory/3088-38-0x000001DC85BD0000-0x000001DC85C9D000-memory.dmp
memory/3500-30-0x0000000002480000-0x0000000002520000-memory.dmp
memory/3500-39-0x0000000002480000-0x0000000002520000-memory.dmp
memory/3500-31-0x0000000002480000-0x0000000002520000-memory.dmp
memory/4356-23-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-17-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-16-0x0000000001610000-0x000000000195A000-memory.dmp
memory/4356-14-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-11-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-18-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-20-0x0000000001530000-0x000000000154E000-memory.dmp
memory/4356-24-0x0000000001530000-0x000000000154E000-memory.dmp
memory/4356-19-0x0000000000400000-0x0000000000444000-memory.dmp