Analysis
- max time kernel
111s - max time network
240s - platform
windows10-1703_x64 - resource
win10-20230831-en - resource tags
- submitted
04/09/2023, 01:26
General
- Target q3837275.exe
- Size 18KB
- Sample230904-btqbaada2w
- SHA256 6be677a5ada91a91bb7a10fc4857c79d92bd87fff3b24c724791cc674b93c917
Score
10/10
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 1 IoCs
- Healer
Healer an antivirus disabler dropper.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Windows security modification 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\q3837275.exe"C:\Users\Admin\AppData\Local\Temp\q3837275.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2724-0-0x0000000000E90000-0x0000000000E9A000-memory.dmp
memory/2724-1-0x00007FFEAE490000-0x00007FFEAEE7C000-memory.dmp
memory/2724-3-0x00007FFEAE490000-0x00007FFEAEE7C000-memory.dmp