Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
19/09/2023, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
g3089245.exe
Resource
win7-20230831-en
7 signatures
300 seconds
General
-
Target
g3089245.exe
-
Size
242KB
-
MD5
d1139a672dbbf2080d65e428ab2a5e89
-
SHA1
ba26ec755852555edba81f15f9937884666845c5
-
SHA256
2f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
-
SHA512
5d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
SSDEEP
3072:e2NG6IBtVVzkEmJth+9p1ORs+NJ2uvHJ5TMi473cceipyEAeAg0FujD26fQUl3BQ:eDvJm09zORs+z/TMify9DAOu+QQR8/
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 5 IoCs
resource yara_rule behavioral1/memory/2436-2-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2436-3-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2436-5-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2436-7-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2436-9-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2980 set thread context of 2436 2980 g3089245.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2436 AppLaunch.exe 2436 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2436 AppLaunch.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28 PID 2980 wrote to memory of 2436 2980 g3089245.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\g3089245.exe"C:\Users\Admin\AppData\Local\Temp\g3089245.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-