Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
Resource
win7-20241010-en
General
-
Target
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
-
Size
231KB
-
MD5
8fc9fbe1333f245626222530134b3a30
-
SHA1
164f848e9c6acf60f76909ddac9543881a071527
-
SHA256
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580
-
SHA512
0b0fd9798a18683c9447b0ab4ede32021a64db92d698af9cb04c385be81daf8fb843efc8113b389f95a21687d6cf796b2a2780a56011431c25debab34b634252
-
SSDEEP
6144:fhWelMxhqLD5BFwn3dnXuo2SuC6UyhXT:ft6hqLVoVh2B
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral2/memory/4472-5-0x0000000002400000-0x000000000241A000-memory.dmp healer behavioral2/memory/4472-7-0x0000000002430000-0x0000000002448000-memory.dmp healer behavioral2/memory/4472-19-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-35-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-33-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-31-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-29-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-27-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-25-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-23-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-21-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-17-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-15-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-13-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-11-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-9-0x0000000002430000-0x0000000002442000-memory.dmp healer behavioral2/memory/4472-8-0x0000000002430000-0x0000000002442000-memory.dmp healer -
Healer family
-
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1524 4472 WerFault.exe 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exepid process 4472 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe 4472 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exedescription pid process Token: SeDebugPrivilege 4472 61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe"C:\Users\Admin\AppData\Local\Temp\61b37790de3e424c5fdc457f3746cd5068a268dbdfee3b2159fe9643d5c35580N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 10002⤵
- Program crash
PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4472 -ip 44721⤵PID:2288