Overview

overview

10

Static

static

3

d2ec308c83...12.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    21s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-01-2025 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2ec308c83a3256727c6045efb99ea27a19ee06d2966083a0bf99b3300106712.exe

  • Size

    2.7MB

  • MD5

    db47ecf2f847ff342c418327eef7186c

  • SHA1

    57196f1d6eeb3ca5ae6bf8b537ff62784a5c113f

  • SHA256

    d2ec308c83a3256727c6045efb99ea27a19ee06d2966083a0bf99b3300106712

  • SHA512

    34ffb69e6d6e4d24d96b20af0b2ecbe818a52594f468bccb15979c5ba3ee85f98895add607ad375bdd15231de71d82478b6a09b03ca9c45383a7d1c6ee24468f

  • SSDEEP

    49152:3dK5/5dc7MIAyxy2QjGhzwcJdAud+EscXQzA:3dK5Rdc7MIDvFbdnd+Es2QzA

Score
10/10
healerdefense_evasiondiscoverydropperevasiontrojan

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2ec308c83a3256727c6045efb99ea27a19ee06d2966083a0bf99b3300106712.exe
    "C:\Users\Admin\AppData\Local\Temp\d2ec308c83a3256727c6045efb99ea27a19ee06d2966083a0bf99b3300106712.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies Windows Defender notification settings
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Windows security modification
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3892
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1820
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2976
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3320
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    f83149158a82a4339f0e499dd7897c88

    SHA1

    533962d636eb76865baa36a71725be3f4cbc78dc

    SHA256

    9570920e827603190603f2fed8037a423814c59a48693a0ce724910d8e6c9234

    SHA512

    bff6d676e004c4cd2d51ee6631dcff8151e0a3366a3974267f7612ef1fa9cc1ffad34d662174904ef6cba264bc6531135f36dd9d1850e35696ab3e7491e924d8

    Download Submit

  • memory/3320-20-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-24-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-21-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-22-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-23-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-14-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-16-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-26-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-15-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3320-25-0x0000023123650000-0x0000023123651000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3892-2-0x0000000000600000-0x00000000008C2000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3892-0-0x0000000000600000-0x00000000008C2000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3892-1-0x0000000000600000-0x00000000008C2000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3892-7-0x0000000000600000-0x00000000008C2000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/3892-4-0x0000000000600000-0x00000000008C2000-memory.dmp

    Filesize

    2.8MB

    Download