Analysis
-
max time kernel
93s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16-04-2024 19:12
General
-
Target
11150c9d8a2f9a1e63873093679df9e9e296de205d569d2b6a12b9e1024679e6.exe
-
Size
404KB
-
MD5
ecac473f9b84e214e12d32f6d8eef9df
-
SHA1
e8eaf5de5f10a90985e3d4f52f9886817e8f2442
-
SHA256
11150c9d8a2f9a1e63873093679df9e9e296de205d569d2b6a12b9e1024679e6
-
SHA512
ea1a0d8e87374c788de2a8d0cad75e256efca2c66cd159413ee170513facd04681adf782bfd2c46e202b0da5dcc15a2333d5142a38e388ba3816cb49a4a49fc6
-
SSDEEP
6144:waRaszDv9nooP9L6rxmbWDa6B99c4YYNE4p1WGjnwY7Q1TCV+4:waRX5ooP92rx4S9XTndwYsTCVH
Score
10/10
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11150c9d8a2f9a1e63873093679df9e9e296de205d569d2b6a12b9e1024679e6.exe"C:\Users\Admin\AppData\Local\Temp\11150c9d8a2f9a1e63873093679df9e9e296de205d569d2b6a12b9e1024679e6.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 9562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3420 -ip 34201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
180KB
-
Filesize
4.0MB
-
Filesize
7.7MB