Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 10:28
General
-
Target
82ee3ccfb84ddb30ef63e858078b076491198b7ec50d177599e90608558fb9c5N.exe
-
Size
324KB
-
MD5
29bc14be987cab753de3cb6a0dbfbd00
-
SHA1
8e61780a08ac433c4047235721ce23f70a84f472
-
SHA256
82ee3ccfb84ddb30ef63e858078b076491198b7ec50d177599e90608558fb9c5
-
SHA512
780226e18c3e8a932b1241aa50eaceda0db7cb619fea8dc9319d8d101b515feb1faa91dc3cad89deb925b48488e718de1630f3721500741ec52b4e02c0038d16
-
SSDEEP
6144:Kiy+bnr+Bp0yN90QEFWNK+ex4dus0Q+Et8+F6A:mMrNy90jyKlkUQ+Byv
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ee3ccfb84ddb30ef63e858078b076491198b7ec50d177599e90608558fb9c5N.exe"C:\Users\Admin\AppData\Local\Temp\82ee3ccfb84ddb30ef63e858078b076491198b7ec50d177599e90608558fb9c5N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b3145VF.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b3145VF.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c16Qj60.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c16Qj60.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 10523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2548 -ip 25481⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
226KB
MD5ab6c6a198619dad141ff2c95a016c201
SHA1ac080f52426968725abd742028683515ba26a585
SHA256f37991d982e8b80326679cd293d78465537c62d58db80db92001c4bcb3347701
SHA51257cd509c7908f72b987ff78259b4d912aea520437e4c00253365a4664ff48ec61e44939d5e47b213f80cae8942138298f6372edeee404b01e8f3b765d88bd97e
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
736KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
736KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB