AF���^]Fw����,�&,��f��e���ѓ��L��֬�Sj��.���<Mc��@�~K͂�z���(��F;(�S��a��5O B������s߅�>�Wyr�RP��Zh ��d���ׁHnA�1BܟKX���b2Y0j�))9�o|%��`���eF�=SS+�!P�\$�����[Шa�=�� �c�Ѩ�p%�H�9(��AA�����\ී������xlGbQ;*� ������Y�m�"�1��쎍l�9��}#N�2�Y⽆�i,�����zZ}1MlbP:��MS����Q���m��cI���5��֤q���[�Y?�M�@e��!���HL{�D=���xFI,˺��9ђ(����A#�ٝ�$v2vP��&�%q�?P�f���?�^���$:G�a��5 ��fV�˳o虎õ�y�,�π�$�)X��\:��b�CT�ɫ/Br�v���ܔ>��^�u�f�o��w��I�v.�]aw�o<�bM����+>��Fи���C�&� �p��i���r@\؞W���sKlhnPt��������U�Ģ^v:�M���ҷ�{���.7����@�����2�R�dÿ2CJ�aKX�qwR N+N�,R�*m9�l�xe�;��4��fܟ�ڡ�|c�pT'h��*Оt�t���]ŵ�7U䫊��1.tk��4��n�}�2T��t��U�� p���Q�/��?:�����Cv�%��L�~P���V:��[���i�{��Ғ�ѿ�Oe?,N�u�a�|ޗ�0�����4t3B�56��GW���l�,w��e^�ɳ�DH���(5�N��-��~���H2��� }p$�e4��+W�7yD���8��,�*�y�w���CSj���h��<v.z����������qS���Ҵ����T��t���_p�� ������61T<��*�Vꉔ���|.����6p�U�T�n�Ԋ� #������2<����&k�H;�~cxul��r�Ie l�fl�9IW[���P���<�� KU�� �|u�R����y����%:v��WhMT����XT}KkG��H$�c�b�*�'@�n���*B������S��לm̥�^K�`N�)�~��\��3}p6��(�B��pEl��@ m����:�\z������o�-��/P�}G+s�M�q��R��̈%9~%�����L��p� �Z��u�`R��w�������$�9\Q�뒪;�"�Ϧ�I����̙�H7(X.bl�(�F�{:�I��٩�k���A���CA8ƽ�:�dN�� k�k�ڕ���fi��]�"�!Axf�4F>��'�W#���Ц���=�z��(od�IC��. |n���ً6~s�� C�w3�e��F�f ����d�i���g��i�.h�8=�<s[l�����[��*I�"�"��\[/=N�����G�cU��M�5����$D��=��W�\�>�%��"%�R�i�w���>�����V� ���_��=�sg�$N������{���k�n�|��F���B�N�:n� �F�k��=�'� ��c�����2��e^�l���?�y��݊N�*��������-Yu�;�~�QN��g�%i���(���X�h��� w�d�'��x�#�AM���2�wr���{�M����+݅����h����>kABu�Z����E��՛�����U��ǒ�.R�-*�K�%m�ٞ�� �<��3x�?|���]����t�R�>fW� (���\��hj ��c\#Z�x�* ;�������k�%C]t�ƨ�G)�'#�l;� �������ޖ��qZ����~�ac�/}��"�ӆ�f�J]�L�c�(�������n���uh^�?��TO�o��A1���h�Lٕ��������5"�/Е��v��a����V͒+�������,Å�j�D���'�<8�&�Z-�ϖ=��h��� �����ɘ00�.�6-��.��r3&�J�i<���:2(@��g�,���Q���@��us"FҖ4�b��$:�e%I=�=F:�� 5�只�:�� ��g���n��A���p_z���3��y��(n�f��]������W��.�4�{z@�a�X-h���IF�=���}� ��¼��'�<j`�,�`��_'�'�j`��J�^ש��غ�ݎ�k(��'��O���*�ۢ1{���: ��d�mbf��!��w����n�1���߱ш�w�q��6����z� r\^b��X��s�ƕJ�13�&$0D��2C<��F����$��l�_l�+��c�DŽ���,c��n�����^��:l�o[��*�`��Z�>T�����v�do���G���3������Y�9f��? ۵�$� zs���6�K!_g�������'_k� 8�m��kjc>-�,`�U�Aݻ e�&���Cك�.RL�/0eБV�����W�q�Rn �G,���n���OH����ѕ������ߋN����)�O85���EV�Z�7�FE���z��j;�u�<0m�=�s�N�,V/��ER]���Q�]Z�v�p�GWq���6�zb@3���V�fW��FR�,f ���☆{�>[G����%��(l��u�w���o�c��:��E�F�{6�5�HY����%�vf4%�IJ��U� �"a(�;�.���� ��a�����x{bڭsKX�: �9�6Œ8�tBKo쌙L���\�n����i K-�QA?�e�O½�.��iާ��Jȗx%S����IIA��9 �%�o�6Iel]�X���N� �x����4�ڪ�ڮ��Gձ;�tɈS�<c:\���zf���Ya�X�W����u�u��?N�яV-��-ӶxyN�����PK)r�P�kDW���W�sv��f[L�M~e�!v�#V�97����P��B��$g�r�^��_�ġ؉yXυаa7�6Gm^�˪�c�x��^[#ċ�9��d&.�5����UivŮ�Xm����^�ӂ8�@�����j�Vd��h;�XrsQ�
Static task
static1
Behavioral task
behavioral1
Sample
Windows Security Health Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Windows Security Health Service.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Windows Security Health Service.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Windows Security Health Service.exe
Resource
win11-20240802-en
General
-
Target
Windows Security Health Service.exe
-
Size
8.7MB
-
MD5
ce278ecb0a5056247c09fa1bcf5d3517
-
SHA1
8a701f618d4117e2c9ca371deebbb4ebcf3ab93a
-
SHA256
145183ae0804bfc8da10501a6387169257280c10de5e152f831547a7ad485cfc
-
SHA512
f1e6ba603f0e6f9028352f543d2678498879167f3f6075ffe4b8707319bee9b1f09e4096f9525f94d5ee56c89bdef89b11df0277f8b004342311347e58e72143
-
SSDEEP
196608:o/C96QhkZOTir2uDKkxP0/lAYRyZd0Ve84ACcoddN0CssZdnGzipglX:op+kZtr2u2kxcU7z8lpgNssZdsip
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Windows Security Health Service.exe
Files
-
Windows Security Health Service.exe.exe windows:5 windows x86 arch:x86
Password: 123
c885c35c97afdcc57a637745b58f9aa6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
RegCloseKey
oleaut32
SysFreeString
gdi32
CreateFontA
shell32
ShellExecuteA
version
GetFileVersionInfoA
mscoree
_CorExeMain
Exports
Exports
Sections
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BO` Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cinema Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SwH Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.,;T Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.a!> Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ