Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-01-2025 05:46

General

  • Target

    7cb4eefce766b16e13bf5705089f3cb079f2c4504fdd14bd3b3ff24700dfc8ed.exe

  • Size

    2.7MB

  • MD5

    ecd3fafc639d674205c96d25bbd817dc

  • SHA1

    21a485bd832ac5c63e41681e7f1c717d7c2b0008

  • SHA256

    7cb4eefce766b16e13bf5705089f3cb079f2c4504fdd14bd3b3ff24700dfc8ed

  • SHA512

    ebed7e764a55ef5aca0dc49ce24750aa8f506b284743925605c92b5688bee679d58fcd6dab4a5d19eb80cf5ddeaef7ddb9798a906ad8c985089eb37fb27940fa

  • SSDEEP

    49152:LfHmM1Bix3gi9HE7Ny3vxLDZI+5sfQG0gMdh7mp/HB:LHmM1BiWi9HYuvxLD2KsfvrMr7m5H

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cb4eefce766b16e13bf5705089f3cb079f2c4504fdd14bd3b3ff24700dfc8ed.exe
    "C:\Users\Admin\AppData\Local\Temp\7cb4eefce766b16e13bf5705089f3cb079f2c4504fdd14bd3b3ff24700dfc8ed.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies Windows Defender notification settings
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Windows security modification
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2776-0-0x0000000001090000-0x0000000001350000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-1-0x0000000001090000-0x0000000001350000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-2-0x0000000001090000-0x0000000001350000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-4-0x0000000001090000-0x0000000001350000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-6-0x0000000001090000-0x0000000001350000-memory.dmp

    Filesize

    2.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.