Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-04-2024 03:18
General
-
Target
cac39c240d4505de246ff2ed9ababc80452585ad6cffd5e6a4382cf151660b0a.exe
-
Size
403KB
-
MD5
9de470c870a05277fefe0352b8b4907a
-
SHA1
4370f97cb5316d5c09dc9169c820022b137e05cc
-
SHA256
cac39c240d4505de246ff2ed9ababc80452585ad6cffd5e6a4382cf151660b0a
-
SHA512
c4e2c4e84c989719e9edb3be3ae2ef2d6c51cf821a42e61ad7ffb60cf87c2c40abca84a24621a6f856f13269bcc21e2b4396b1167e11a60615429343b8fb7183
-
SSDEEP
6144:d7w/PZV2ercTNwDTnfXbnPymRg85RuP6uKGdgXWdVXnKZIv:d7iZEeSNaTnPzPs85RGndVXKKv
Score
10/10
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 18 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 18 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac39c240d4505de246ff2ed9ababc80452585ad6cffd5e6a4382cf151660b0a.exe"C:\Users\Admin\AppData\Local\Temp\cac39c240d4505de246ff2ed9ababc80452585ad6cffd5e6a4382cf151660b0a.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 9322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2368 -ip 23681⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
4.0MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
4.0MB
-
Filesize
7.7MB