Analysis
-
max time kernel
130s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 07:52
Static task
static1
Behavioral task
behavioral1
Sample
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
Resource
win7-20240508-en
General
-
Target
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
-
Size
403KB
-
MD5
587836f85c22ef84c73ab53f38fdfadc
-
SHA1
ace7921fbf7745a7698a957fcbf0177c80a3fac8
-
SHA256
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd
-
SHA512
fe0f06bc7db5b5c005d2815f5fcd599708f257c7f669f1f3edb51dc0a3ba031396961eb3768c5c5f31139845d74ce0d7071a3a209a3e08f57855bf69f0e1f5a5
-
SSDEEP
6144:4VaWw7kqYDOfOwABVIiXSAn1em15X9gIieE0bbtbt:4VaX7LYKfNAMiXqAtgyEqbt
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-5-0x0000000002920000-0x000000000293A000-memory.dmp healer behavioral2/memory/1488-7-0x0000000004EE0000-0x0000000004EF8000-memory.dmp healer behavioral2/memory/1488-8-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-15-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-35-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-34-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-31-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-29-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-27-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-25-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-23-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-21-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-19-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-17-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-13-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-11-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral2/memory/1488-9-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer -
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3772 1488 WerFault.exe 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exepid process 1488 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe 1488 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exedescription pid process Token: SeDebugPrivilege 1488 32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe"C:\Users\Admin\AppData\Local\Temp\32b4960fc0149d34a1352a9fd2cdd3bdc88691908644fa477646817617ceb6cd.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1488 -ip 14881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-3-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1488-2-0x00000000008B0000-0x00000000008DD000-memory.dmpFilesize
180KB
-
memory/1488-1-0x00000000008F0000-0x00000000009F0000-memory.dmpFilesize
1024KB
-
memory/1488-4-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1488-5-0x0000000002920000-0x000000000293A000-memory.dmpFilesize
104KB
-
memory/1488-6-0x0000000005010000-0x00000000055B4000-memory.dmpFilesize
5.6MB
-
memory/1488-7-0x0000000004EE0000-0x0000000004EF8000-memory.dmpFilesize
96KB
-
memory/1488-8-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-15-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-35-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-34-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-31-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-29-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-27-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-25-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-23-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-21-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-19-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-17-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-13-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-11-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-9-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1488-37-0x00000000008F0000-0x00000000009F0000-memory.dmpFilesize
1024KB
-
memory/1488-40-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1488-39-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB