Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe
-
Size
391KB
-
MD5
0a84386b85b39b57e8da53f7b5db5a37
-
SHA1
c99c7c6739f611afa1ca9ebe723ea0b145075bac
-
SHA256
37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1
-
SHA512
3d137be1532fdfd6edce769f5c0b7c9d32aedad3ff944bca8a6f23e354962079f4889ed50d520350b2856a2e71199b4e3cab3a3ed5fa4cf4d83fba02039ee314
-
SSDEEP
6144:A+ISz1iadJyThR1deYrPvhIZc6c0kp5OogMqa97/QQa:Aw5rdmh3kYj5IvKp5JgMT8Qa
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 18 IoCs
resource yara_rule behavioral2/memory/3444-4-0x00000000026D0000-0x00000000026EA000-memory.dmp healer behavioral2/memory/3444-6-0x0000000005140000-0x0000000005150000-memory.dmp healer behavioral2/memory/3444-9-0x0000000002BA0000-0x0000000002BB8000-memory.dmp healer behavioral2/memory/3444-10-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-11-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-13-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-15-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-17-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-19-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-21-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-25-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-27-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-23-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-29-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-31-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-33-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-35-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer behavioral2/memory/3444-37-0x0000000002BA0000-0x0000000002BB2000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 18 IoCs
resource yara_rule behavioral2/memory/3444-4-0x00000000026D0000-0x00000000026EA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-6-0x0000000005140000-0x0000000005150000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-9-0x0000000002BA0000-0x0000000002BB8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-10-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-11-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-13-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-15-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-17-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-19-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-21-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-25-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-27-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-23-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-29-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-31-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-33-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-35-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/memory/3444-37-0x0000000002BA0000-0x0000000002BB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3148 3444 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3444 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe 3444 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3444 37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe"C:\Users\Admin\AppData\Local\Temp\37dd6fe30ecd67cfc661fa3581ea9388f5a87a16022227bd3a62a6bcb829ffb1.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 9962⤵
- Program crash
PID:3148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3444 -ip 34441⤵PID:628