Analysis

  • max time kernel
    112s
  • max time network
    117s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2023, 11:52

General

  • Target

    2854319baf4234aaa1fb4e994a9f25407511239049a7aceea4a7295d666928e2.exe

  • Size

    1.4MB

  • MD5

    265a21d257fff5a0c8a61e9afc5966ff

  • SHA1

    427c6ace9acb6f40a057defa09a8103e0441e600

  • SHA256

    2854319baf4234aaa1fb4e994a9f25407511239049a7aceea4a7295d666928e2

  • SHA512

    d7da9a669e8aa98c9cea0ad1e2a5db03ad1e70afe642dd445dbbd3180d8780b9d02ea4c1f4187ea861e615dc480df6e3c956c4d0c89ad92fa50d845dbca501f4

  • SSDEEP

    24576:zyznYmPZGUre3xmDV5lBojoBN4i1xnqXf1HqgRVCjzAQ:GrYSZGkhBoaNlxI1XC

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2854319baf4234aaa1fb4e994a9f25407511239049a7aceea4a7295d666928e2.exe
    "C:\Users\Admin\AppData\Local\Temp\2854319baf4234aaa1fb4e994a9f25407511239049a7aceea4a7295d666928e2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp8VC05.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp8VC05.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bW7nF91.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bW7nF91.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qj3ee99.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qj3ee99.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Mq36LP1.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Mq36LP1.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4616
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tp5551.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tp5551.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3284
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:2572
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 568
                  7⤵
                  • Program crash
                  PID:624
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 148
                6⤵
                • Program crash
                PID:940

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp8VC05.exe

            Filesize

            1.3MB

            MD5

            f1a7f03bfbb59bf487ef259d076a19ab

            SHA1

            42dd1de8a9d431a1c558d65d6468a2070b762671

            SHA256

            012c9526092e4f3200b87ad6b1f2596c64beda212b9b4b94d495399b22a35ef3

            SHA512

            e79a73ca5287c9300b9a25d2a576d89aec6173d590cdab113a4663ecdf30d3da06f92c3ea0b7da3d0a1ccbd79500321881a30f6c6948cf825bdab61616016ff8

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp8VC05.exe

            Filesize

            1.3MB

            MD5

            f1a7f03bfbb59bf487ef259d076a19ab

            SHA1

            42dd1de8a9d431a1c558d65d6468a2070b762671

            SHA256

            012c9526092e4f3200b87ad6b1f2596c64beda212b9b4b94d495399b22a35ef3

            SHA512

            e79a73ca5287c9300b9a25d2a576d89aec6173d590cdab113a4663ecdf30d3da06f92c3ea0b7da3d0a1ccbd79500321881a30f6c6948cf825bdab61616016ff8

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bW7nF91.exe

            Filesize

            871KB

            MD5

            b903f0f37d77996561706308693fb116

            SHA1

            a1dd2a5cac7cd19c7236a2e5afadeb67235f3fd4

            SHA256

            d8ba5c74b13e0215c8670028a30fc330d0fa22e485767c97e265eabfa3ac5dc7

            SHA512

            bae47f56f922c2339fac095f8de6c8552b4816996f192eee92359d8514197b1bc5ae889436d4f792ea64e66b2e9e6954bf90503ee3428a4185757540cfd01a77

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bW7nF91.exe

            Filesize

            871KB

            MD5

            b903f0f37d77996561706308693fb116

            SHA1

            a1dd2a5cac7cd19c7236a2e5afadeb67235f3fd4

            SHA256

            d8ba5c74b13e0215c8670028a30fc330d0fa22e485767c97e265eabfa3ac5dc7

            SHA512

            bae47f56f922c2339fac095f8de6c8552b4816996f192eee92359d8514197b1bc5ae889436d4f792ea64e66b2e9e6954bf90503ee3428a4185757540cfd01a77

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qj3ee99.exe

            Filesize

            483KB

            MD5

            ca955a58396ae9a4cfd4ca877ab4f260

            SHA1

            e93abfd2b3ae9d611bd4bc963759ab631ab41c74

            SHA256

            3974802820fbbfca4ae2fd7df79328e26383626d2dca3f40a2b294f518114e71

            SHA512

            41deed27324c55cad9b8c5c300617e6256a65aca6a7e541f057b10caf42dbfe276a8fd9855857e0ce2094d9bd67032a567b9e02de5b6de5f49ca2f7394d4fadd

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qj3ee99.exe

            Filesize

            483KB

            MD5

            ca955a58396ae9a4cfd4ca877ab4f260

            SHA1

            e93abfd2b3ae9d611bd4bc963759ab631ab41c74

            SHA256

            3974802820fbbfca4ae2fd7df79328e26383626d2dca3f40a2b294f518114e71

            SHA512

            41deed27324c55cad9b8c5c300617e6256a65aca6a7e541f057b10caf42dbfe276a8fd9855857e0ce2094d9bd67032a567b9e02de5b6de5f49ca2f7394d4fadd

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Mq36LP1.exe

            Filesize

            12KB

            MD5

            efe503df4660f601e259680649479d25

            SHA1

            c4584f364de6895d181e008838cecbf5edb44569

            SHA256

            b77c5f97f9ff6bbeb61277e064d66b21f5427b6b8c366c7a0f9028aad8413b1e

            SHA512

            65c12cf1a5b9844c35f43c60e16c4bce44c8878aa367b8dfae398867180283d702fbdaf2f8b5563b6a3f0268f8d4644115ee27694e8d0244e415804aa1a308f4

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Mq36LP1.exe

            Filesize

            12KB

            MD5

            efe503df4660f601e259680649479d25

            SHA1

            c4584f364de6895d181e008838cecbf5edb44569

            SHA256

            b77c5f97f9ff6bbeb61277e064d66b21f5427b6b8c366c7a0f9028aad8413b1e

            SHA512

            65c12cf1a5b9844c35f43c60e16c4bce44c8878aa367b8dfae398867180283d702fbdaf2f8b5563b6a3f0268f8d4644115ee27694e8d0244e415804aa1a308f4

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tp5551.exe

            Filesize

            1.4MB

            MD5

            93729dd51f21b7c2d4737f47d39e63c2

            SHA1

            e358d85a6562c9150cc265ed63c6e8eec0d68b0a

            SHA256

            990009f12a3aa835f9dbfa414f45f70c8c2b142d1f8507bf54acd4daad01add1

            SHA512

            278004db2da54e0c8de3ae0c4f326068d7f2bf2e7e78f0de4caf43cd1455b2474136cf652e4043606f29f7385b1f3c5b740a4c9de6b777a82a977a939f786d50

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tp5551.exe

            Filesize

            1.4MB

            MD5

            93729dd51f21b7c2d4737f47d39e63c2

            SHA1

            e358d85a6562c9150cc265ed63c6e8eec0d68b0a

            SHA256

            990009f12a3aa835f9dbfa414f45f70c8c2b142d1f8507bf54acd4daad01add1

            SHA512

            278004db2da54e0c8de3ae0c4f326068d7f2bf2e7e78f0de4caf43cd1455b2474136cf652e4043606f29f7385b1f3c5b740a4c9de6b777a82a977a939f786d50

          • memory/2572-35-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2572-38-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2572-39-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2572-41-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/4616-31-0x00007FFAFF980000-0x00007FFB0036C000-memory.dmp

            Filesize

            9.9MB

          • memory/4616-29-0x00007FFAFF980000-0x00007FFB0036C000-memory.dmp

            Filesize

            9.9MB

          • memory/4616-28-0x00000000008E0000-0x00000000008EA000-memory.dmp

            Filesize

            40KB