Analysis

  • max time kernel
    126s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2023, 02:34

General

  • Target

    ae2e7968e9d135045969af3b12d83a29ff86931702e55070d5481a48703c34a9.exe

  • Size

    877KB

  • MD5

    5f29ad2125f6e2868eda7233f6fdd03b

  • SHA1

    70355b3a9113833992d42ebe2153f029237a693d

  • SHA256

    ae2e7968e9d135045969af3b12d83a29ff86931702e55070d5481a48703c34a9

  • SHA512

    0a69b180290ec29839499f9549c4ba796cc77a6c6bc4d021dec986e686fb06925a8e4f4f8dc268e98c5019bd946b24fc00fd8edeb616a208483d0e9adfc1a396

  • SSDEEP

    12288:1MrYy90nztyT6A1o4FhlEpdbCpBf1CdX+zqX5Jpjvk9l+VcCKD5BkdU44HChHEgJ:hycyP1LwKCXDpjvrE/kAih/rAJZ4P

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae2e7968e9d135045969af3b12d83a29ff86931702e55070d5481a48703c34a9.exe
    "C:\Users\Admin\AppData\Local\Temp\ae2e7968e9d135045969af3b12d83a29ff86931702e55070d5481a48703c34a9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KR5rX80.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KR5rX80.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rg5QB67.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rg5QB67.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IX4GP13.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IX4GP13.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dh93jA1.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dh93jA1.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4100
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2YN3973.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2YN3973.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:228
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                  PID:1124
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  6⤵
                    PID:2720
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    6⤵
                      PID:224
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 568
                        7⤵
                        • Program crash
                        PID:3584
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 140
                      6⤵
                      • Program crash
                      PID:4736

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KR5rX80.exe

                  Filesize

                  737KB

                  MD5

                  b7aaf55af27d4a3c181ac18ee65a58bf

                  SHA1

                  7885d435cd40bb35c6b3ec4106d4025106ae5126

                  SHA256

                  8097e1e428c44aef4fafabbe421b2c1970eb2eb680e1d25100528f18e1927332

                  SHA512

                  7268b9b46ac0bd4b78c3e2ad11c01f46858d5272beeb8dcd01cbb434b3bed2c572931a7a56f40a3b0c7c2f83b805ecb561e30c285b9ac120d981875054f0652c

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KR5rX80.exe

                  Filesize

                  737KB

                  MD5

                  b7aaf55af27d4a3c181ac18ee65a58bf

                  SHA1

                  7885d435cd40bb35c6b3ec4106d4025106ae5126

                  SHA256

                  8097e1e428c44aef4fafabbe421b2c1970eb2eb680e1d25100528f18e1927332

                  SHA512

                  7268b9b46ac0bd4b78c3e2ad11c01f46858d5272beeb8dcd01cbb434b3bed2c572931a7a56f40a3b0c7c2f83b805ecb561e30c285b9ac120d981875054f0652c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rg5QB67.exe

                  Filesize

                  490KB

                  MD5

                  4d44a2ba3feda8c26d63ae09ccde75aa

                  SHA1

                  a77dc164e9128e1e92047ed13eb984d59f4c723c

                  SHA256

                  dc5bb17b44268b9ddb288e0bf0fd0d9f9a43f08067d8bd1ba4762ddf7fbed4d5

                  SHA512

                  8289f4712737af707ea3d1e2baf94ce9496681eea2ed3f1de266d588b6ce06c5c8aba6e68e9d55091d4997e5cd2215a9aa8b87d44a0cf4d69fbc409618195326

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rg5QB67.exe

                  Filesize

                  490KB

                  MD5

                  4d44a2ba3feda8c26d63ae09ccde75aa

                  SHA1

                  a77dc164e9128e1e92047ed13eb984d59f4c723c

                  SHA256

                  dc5bb17b44268b9ddb288e0bf0fd0d9f9a43f08067d8bd1ba4762ddf7fbed4d5

                  SHA512

                  8289f4712737af707ea3d1e2baf94ce9496681eea2ed3f1de266d588b6ce06c5c8aba6e68e9d55091d4997e5cd2215a9aa8b87d44a0cf4d69fbc409618195326

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IX4GP13.exe

                  Filesize

                  293KB

                  MD5

                  e2b98d6f8c393cb6b0ee25d801a61d95

                  SHA1

                  877c429c5225231a7ff7f4c3f3dabf8df8b4d5b4

                  SHA256

                  9e1056499a931a07e17d4983723fe26c3c09191edd743ad9e3cec9777ce4492d

                  SHA512

                  ecd6aad8a9032fe3aa7bf5d8a618b4522ac5d797650c0c636e268a5e5d31e76bda9540731c34df7666c1faf831c925252defe07923a9b6217848448c1cb255fa

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IX4GP13.exe

                  Filesize

                  293KB

                  MD5

                  e2b98d6f8c393cb6b0ee25d801a61d95

                  SHA1

                  877c429c5225231a7ff7f4c3f3dabf8df8b4d5b4

                  SHA256

                  9e1056499a931a07e17d4983723fe26c3c09191edd743ad9e3cec9777ce4492d

                  SHA512

                  ecd6aad8a9032fe3aa7bf5d8a618b4522ac5d797650c0c636e268a5e5d31e76bda9540731c34df7666c1faf831c925252defe07923a9b6217848448c1cb255fa

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dh93jA1.exe

                  Filesize

                  12KB

                  MD5

                  d93eab621ecd3f27091fe302a5491945

                  SHA1

                  2240ceaa448d7bc1aae00641cb9998a189deb872

                  SHA256

                  2442573c4b240c8ff33d508c571d6e82d32643893f64e078f419b49b18613ea7

                  SHA512

                  f8a3cf1d092520029a6dae181042c4104fd3785354c91f832d9612fa436651abb5933f8e142941d999b41b8adac5bbfeccd837508f6abd1449e7172ca9152816

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dh93jA1.exe

                  Filesize

                  12KB

                  MD5

                  d93eab621ecd3f27091fe302a5491945

                  SHA1

                  2240ceaa448d7bc1aae00641cb9998a189deb872

                  SHA256

                  2442573c4b240c8ff33d508c571d6e82d32643893f64e078f419b49b18613ea7

                  SHA512

                  f8a3cf1d092520029a6dae181042c4104fd3785354c91f832d9612fa436651abb5933f8e142941d999b41b8adac5bbfeccd837508f6abd1449e7172ca9152816

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2YN3973.exe

                  Filesize

                  285KB

                  MD5

                  192e97ba8aba31ccb719acf64cc6d0af

                  SHA1

                  68f86fe734182995edb61351ee44ee08f00d1f6a

                  SHA256

                  523fac9407dd3be6a16d97d2d587bfc94e40c3f208daced37dc40cd8cc088ad2

                  SHA512

                  01870f270dac29a3484a0a7b199da1decfe83a0c35a6a9c97ad38a8ec742839e375b153481bf4e0f07819e43c43e707aaa2edf2b70ea7a2a1138109d4327dbc1

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2YN3973.exe

                  Filesize

                  285KB

                  MD5

                  192e97ba8aba31ccb719acf64cc6d0af

                  SHA1

                  68f86fe734182995edb61351ee44ee08f00d1f6a

                  SHA256

                  523fac9407dd3be6a16d97d2d587bfc94e40c3f208daced37dc40cd8cc088ad2

                  SHA512

                  01870f270dac29a3484a0a7b199da1decfe83a0c35a6a9c97ad38a8ec742839e375b153481bf4e0f07819e43c43e707aaa2edf2b70ea7a2a1138109d4327dbc1

                • memory/224-35-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-39-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-38-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-41-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/4100-31-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4100-29-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4100-28-0x00000000003B0000-0x00000000003BA000-memory.dmp

                  Filesize

                  40KB