Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
Resource
win7-20241010-en
General
-
Target
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
-
Size
231KB
-
MD5
8fc9fbe1333f245626222530134b3a30
-
SHA1
164f848e9c6acf60f76909ddac9543881a071527
-
SHA256
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580
-
SHA512
0b0fd9798a18683c9447b0ab4ede32021a64db92d698af9cb04c385be81daf8fb843efc8113b389f95a21687d6cf796b2a2780a56011431c25debab34b634252
-
SSDEEP
6144:fhWelMxhqLD5BFwn3dnXuo2SuC6UyhXT:ft6hqLVoVh2B
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/516-4-0x0000000001F10000-0x0000000001F2A000-memory.dmp healer behavioral1/memory/516-5-0x0000000001F90000-0x0000000001FA8000-memory.dmp healer behavioral1/memory/516-27-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-33-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-31-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-29-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-25-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-23-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-19-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-17-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-15-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-13-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-12-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-9-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-7-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-6-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer behavioral1/memory/516-22-0x0000000001F90000-0x0000000001FA2000-memory.dmp healer -
Healer family
-
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exepid process 516 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe 516 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription pid process Token: SeDebugPrivilege 516 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe"C:\Users\Admin\AppData\Local\Temp\61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516