Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03-05-2024 04:49
General
-
Target
e9e2ae90ae67fc81bb7708d0245f72257130ae28bf5ca6b07f67ba65d0fd80d1.exe
-
Size
176KB
-
MD5
576abebf526a42663e085fe6de8903c7
-
SHA1
d35c836896ec76504c45c30c37a5960fc75ae956
-
SHA256
e9e2ae90ae67fc81bb7708d0245f72257130ae28bf5ca6b07f67ba65d0fd80d1
-
SHA512
504ca39058929213a79a34023039f51d17e38ad38f3db715bb35b108949fa05623998583c091768f718537ddd0a1aaf23c25cfa2877c03facafcb1fb479d62ba
-
SSDEEP
3072:CDKW1LgppLRHMY0TBfJvjcTp5XfUy6hDwe:CDKW1Lgbdl0TBBvjc/sBD
Score
10/10
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e2ae90ae67fc81bb7708d0245f72257130ae28bf5ca6b07f67ba65d0fd80d1.exe"C:\Users\Admin\AppData\Local\Temp\e9e2ae90ae67fc81bb7708d0245f72257130ae28bf5ca6b07f67ba65d0fd80d1.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
6.9MB