Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 07:52
Static task
static1
Behavioral task
behavioral1
Sample
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
Resource
win7-20240508-en
General
-
Target
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
-
Size
403KB
-
MD5
587836f85c22ef84c73ab53f38fdfadc
-
SHA1
ace7921fbf7745a7698a957fcbf0177c80a3fac8
-
SHA256
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd
-
SHA512
fe0f06bc7db5b5c005d2815f5fcd599708f257c7f669f1f3edb51dc0a3ba031396961eb3768c5c5f31139845d74ce0d7071a3a209a3e08f57855bf69f0e1f5a5
-
SSDEEP
6144:4VaWw7kqYDOfOwABVIiXSAn1em15X9gIieE0bbtbt:4VaX7LYKfNAMiXqAtgyEqbt
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-5-0x0000000000860000-0x000000000087A000-memory.dmp healer behavioral1/memory/1708-6-0x0000000002420000-0x0000000002438000-memory.dmp healer behavioral1/memory/1708-7-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-8-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-10-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-12-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-18-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-26-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-34-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-33-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-30-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-28-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-24-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-22-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-20-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-17-0x0000000002420000-0x0000000002432000-memory.dmp healer behavioral1/memory/1708-14-0x0000000002420000-0x0000000002432000-memory.dmp healer -
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exepid process 1708 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe 1708 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription pid process Token: SeDebugPrivilege 1708 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe"C:\Users\Admin\AppData\Local\Temp\32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-1-0x0000000000880000-0x0000000000980000-memory.dmpFilesize
1024KB
-
memory/1708-2-0x00000000002A0000-0x00000000002CD000-memory.dmpFilesize
180KB
-
memory/1708-3-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1708-4-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1708-5-0x0000000000860000-0x000000000087A000-memory.dmpFilesize
104KB
-
memory/1708-6-0x0000000002420000-0x0000000002438000-memory.dmpFilesize
96KB
-
memory/1708-7-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-8-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-10-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-12-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-18-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-26-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-34-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-33-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-30-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-28-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-24-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-22-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-20-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-17-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-14-0x0000000002420000-0x0000000002432000-memory.dmpFilesize
72KB
-
memory/1708-37-0x00000000002A0000-0x00000000002CD000-memory.dmpFilesize
180KB
-
memory/1708-38-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1708-36-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB