Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 06:45

General

  • Target

    7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e.exe

  • Size

    1.1MB

  • MD5

    25bf2c82e23392efb173fb9725062f56

  • SHA1

    cb3603fe653cc538c8accfd51acea453be8405b1

  • SHA256

    7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e

  • SHA512

    fc58c5838ee581adcacc3cacc6697ae63aa001e34cfa2a269bdcba75f4fbd36f17c02149ba39e6d4c275b7f0e07edd1d61ab73a3b6894e2ca130f18b4446f9df

  • SSDEEP

    24576:6yW2TNKlLzmhM08em3kSbTgUPPk2pCAW6rwrdPd3Ikf6bzJn:BW2UZ010D8mbWZ7Ydb

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 16 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e.exe
    "C:\Users\Admin\AppData\Local\Temp\7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2219427.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2219427.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2456
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2432
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3012
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 268
                  8⤵
                  • Program crash
                  PID:1688
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 268
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe

    Filesize

    1.0MB

    MD5

    57cd6fbb645fea28935866da70b2dfe3

    SHA1

    679f1529f9fb55a07c9d58611dfb21b12135c541

    SHA256

    2a09cde0a30cbf993954137c7bf44a562ae5fabfe4d9def2c4474b65e87691f3

    SHA512

    08997af7e073c1fca7675c9703388461257019da9d5b76da1b6cd9b933e8aae3f7c35b2e3caf30b14fb65f6edca3b73a55b00c04c8de9a415e32e40352caf150

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe

    Filesize

    1.0MB

    MD5

    57cd6fbb645fea28935866da70b2dfe3

    SHA1

    679f1529f9fb55a07c9d58611dfb21b12135c541

    SHA256

    2a09cde0a30cbf993954137c7bf44a562ae5fabfe4d9def2c4474b65e87691f3

    SHA512

    08997af7e073c1fca7675c9703388461257019da9d5b76da1b6cd9b933e8aae3f7c35b2e3caf30b14fb65f6edca3b73a55b00c04c8de9a415e32e40352caf150

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe

    Filesize

    874KB

    MD5

    32675f6adb30435fb98ae6f014163a8b

    SHA1

    9bf5c3453fa8169e316c727d2c5aab420dbdb30e

    SHA256

    d0a0f22312e147e0f9ceb9ec792933a4eabc928f63a7a06e78007ae09642985a

    SHA512

    5f4e3378194c158d1d7ca69f07418ac61639187222cb4b023b4c8ddf83f60e87ac8ae21db93f341b998a1f7cc45dd047285a0244ee2e2011791b98343d6c918e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe

    Filesize

    874KB

    MD5

    32675f6adb30435fb98ae6f014163a8b

    SHA1

    9bf5c3453fa8169e316c727d2c5aab420dbdb30e

    SHA256

    d0a0f22312e147e0f9ceb9ec792933a4eabc928f63a7a06e78007ae09642985a

    SHA512

    5f4e3378194c158d1d7ca69f07418ac61639187222cb4b023b4c8ddf83f60e87ac8ae21db93f341b998a1f7cc45dd047285a0244ee2e2011791b98343d6c918e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe

    Filesize

    690KB

    MD5

    106161fcd240c611b1c5a210d8e5f92d

    SHA1

    ba01f0a2448130a6dcda7e1d11b996ec548b77c4

    SHA256

    26575182180b09228c8a8da0034042f28eb7c8985356b755a196b2974bfff632

    SHA512

    17be718a8c6f4d16d2a3f277b284264fe39bde85297fe0c51115300c127cb4c43c42c468f49e09dcfd9db07cbea823ae99411bb169ef8b60c199d3fb56e3811a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe

    Filesize

    690KB

    MD5

    106161fcd240c611b1c5a210d8e5f92d

    SHA1

    ba01f0a2448130a6dcda7e1d11b996ec548b77c4

    SHA256

    26575182180b09228c8a8da0034042f28eb7c8985356b755a196b2974bfff632

    SHA512

    17be718a8c6f4d16d2a3f277b284264fe39bde85297fe0c51115300c127cb4c43c42c468f49e09dcfd9db07cbea823ae99411bb169ef8b60c199d3fb56e3811a

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe

    Filesize

    387KB

    MD5

    05e5c47f6a0ca91dbdcdf9988267f7de

    SHA1

    5a476d67c97f7c4ecc9ac3a2f82af71d7a342a6e

    SHA256

    090a80eebc60f71119793c08783ffa0364ef1b1bd1473698ca9ede670807e6c1

    SHA512

    d9aff90682a1fbc67d32964dbbb03ab55dc316f108a8953a0e4c0f0b032a2ad10238f34568454b6ca7d4bfd4a06b4a4d23ad2adae5ab03a30d56f3ee3183e8f3

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe

    Filesize

    387KB

    MD5

    05e5c47f6a0ca91dbdcdf9988267f7de

    SHA1

    5a476d67c97f7c4ecc9ac3a2f82af71d7a342a6e

    SHA256

    090a80eebc60f71119793c08783ffa0364ef1b1bd1473698ca9ede670807e6c1

    SHA512

    d9aff90682a1fbc67d32964dbbb03ab55dc316f108a8953a0e4c0f0b032a2ad10238f34568454b6ca7d4bfd4a06b4a4d23ad2adae5ab03a30d56f3ee3183e8f3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2219427.exe

    Filesize

    11KB

    MD5

    817b8fd52c65af45a2a8c422d055d532

    SHA1

    e8204336f5c8ecd2e3c0ff32b6f4a52cdef8d70c

    SHA256

    655fe5a470d9092f10056b63276ed320c54d9a1fbd723c38e58887c706260b25

    SHA512

    fb0fc0f269614041f855352a55cf9856b8d254ccd31d5a4176872c6ea359e8786c35186ec9a111d8c6da806dc9dcc72f0f9171ffc101474b1eca7cec52ed0a14

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2219427.exe

    Filesize

    11KB

    MD5

    817b8fd52c65af45a2a8c422d055d532

    SHA1

    e8204336f5c8ecd2e3c0ff32b6f4a52cdef8d70c

    SHA256

    655fe5a470d9092f10056b63276ed320c54d9a1fbd723c38e58887c706260b25

    SHA512

    fb0fc0f269614041f855352a55cf9856b8d254ccd31d5a4176872c6ea359e8786c35186ec9a111d8c6da806dc9dcc72f0f9171ffc101474b1eca7cec52ed0a14

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe

    Filesize

    1.0MB

    MD5

    57cd6fbb645fea28935866da70b2dfe3

    SHA1

    679f1529f9fb55a07c9d58611dfb21b12135c541

    SHA256

    2a09cde0a30cbf993954137c7bf44a562ae5fabfe4d9def2c4474b65e87691f3

    SHA512

    08997af7e073c1fca7675c9703388461257019da9d5b76da1b6cd9b933e8aae3f7c35b2e3caf30b14fb65f6edca3b73a55b00c04c8de9a415e32e40352caf150

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z7323439.exe

    Filesize

    1.0MB

    MD5

    57cd6fbb645fea28935866da70b2dfe3

    SHA1

    679f1529f9fb55a07c9d58611dfb21b12135c541

    SHA256

    2a09cde0a30cbf993954137c7bf44a562ae5fabfe4d9def2c4474b65e87691f3

    SHA512

    08997af7e073c1fca7675c9703388461257019da9d5b76da1b6cd9b933e8aae3f7c35b2e3caf30b14fb65f6edca3b73a55b00c04c8de9a415e32e40352caf150

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe

    Filesize

    874KB

    MD5

    32675f6adb30435fb98ae6f014163a8b

    SHA1

    9bf5c3453fa8169e316c727d2c5aab420dbdb30e

    SHA256

    d0a0f22312e147e0f9ceb9ec792933a4eabc928f63a7a06e78007ae09642985a

    SHA512

    5f4e3378194c158d1d7ca69f07418ac61639187222cb4b023b4c8ddf83f60e87ac8ae21db93f341b998a1f7cc45dd047285a0244ee2e2011791b98343d6c918e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z8486945.exe

    Filesize

    874KB

    MD5

    32675f6adb30435fb98ae6f014163a8b

    SHA1

    9bf5c3453fa8169e316c727d2c5aab420dbdb30e

    SHA256

    d0a0f22312e147e0f9ceb9ec792933a4eabc928f63a7a06e78007ae09642985a

    SHA512

    5f4e3378194c158d1d7ca69f07418ac61639187222cb4b023b4c8ddf83f60e87ac8ae21db93f341b998a1f7cc45dd047285a0244ee2e2011791b98343d6c918e

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe

    Filesize

    690KB

    MD5

    106161fcd240c611b1c5a210d8e5f92d

    SHA1

    ba01f0a2448130a6dcda7e1d11b996ec548b77c4

    SHA256

    26575182180b09228c8a8da0034042f28eb7c8985356b755a196b2974bfff632

    SHA512

    17be718a8c6f4d16d2a3f277b284264fe39bde85297fe0c51115300c127cb4c43c42c468f49e09dcfd9db07cbea823ae99411bb169ef8b60c199d3fb56e3811a

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z1367557.exe

    Filesize

    690KB

    MD5

    106161fcd240c611b1c5a210d8e5f92d

    SHA1

    ba01f0a2448130a6dcda7e1d11b996ec548b77c4

    SHA256

    26575182180b09228c8a8da0034042f28eb7c8985356b755a196b2974bfff632

    SHA512

    17be718a8c6f4d16d2a3f277b284264fe39bde85297fe0c51115300c127cb4c43c42c468f49e09dcfd9db07cbea823ae99411bb169ef8b60c199d3fb56e3811a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe

    Filesize

    387KB

    MD5

    05e5c47f6a0ca91dbdcdf9988267f7de

    SHA1

    5a476d67c97f7c4ecc9ac3a2f82af71d7a342a6e

    SHA256

    090a80eebc60f71119793c08783ffa0364ef1b1bd1473698ca9ede670807e6c1

    SHA512

    d9aff90682a1fbc67d32964dbbb03ab55dc316f108a8953a0e4c0f0b032a2ad10238f34568454b6ca7d4bfd4a06b4a4d23ad2adae5ab03a30d56f3ee3183e8f3

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z6342153.exe

    Filesize

    387KB

    MD5

    05e5c47f6a0ca91dbdcdf9988267f7de

    SHA1

    5a476d67c97f7c4ecc9ac3a2f82af71d7a342a6e

    SHA256

    090a80eebc60f71119793c08783ffa0364ef1b1bd1473698ca9ede670807e6c1

    SHA512

    d9aff90682a1fbc67d32964dbbb03ab55dc316f108a8953a0e4c0f0b032a2ad10238f34568454b6ca7d4bfd4a06b4a4d23ad2adae5ab03a30d56f3ee3183e8f3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q2219427.exe

    Filesize

    11KB

    MD5

    817b8fd52c65af45a2a8c422d055d532

    SHA1

    e8204336f5c8ecd2e3c0ff32b6f4a52cdef8d70c

    SHA256

    655fe5a470d9092f10056b63276ed320c54d9a1fbd723c38e58887c706260b25

    SHA512

    fb0fc0f269614041f855352a55cf9856b8d254ccd31d5a4176872c6ea359e8786c35186ec9a111d8c6da806dc9dcc72f0f9171ffc101474b1eca7cec52ed0a14

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\r1011576.exe

    Filesize

    700KB

    MD5

    8576a988a9f11933cdac9360d085753e

    SHA1

    04bc686ac9d07c282465986eae8a38365c0b6cf0

    SHA256

    142a30d5109c9ed0623360c51793f2bb6332b11d6abd967f5e5e9c700bed6bd2

    SHA512

    0eb148d0e9b979057dbfae3443894c279513077e0fe0b2e2012cc14f798b944338bd9839f0a8040742ebadf6d92f4424f156d75414618530d58a25f282050d7c

  • memory/2456-49-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

    Filesize

    9.9MB

  • memory/2456-51-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

    Filesize

    9.9MB

  • memory/2456-48-0x00000000011C0000-0x00000000011CA000-memory.dmp

    Filesize

    40KB

  • memory/2456-50-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

    Filesize

    9.9MB

  • memory/3012-65-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-68-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-66-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-64-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-62-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-61-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-63-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/3012-70-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3012-72-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB