Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 15:39
General
- Target 2026-08-04_5f07ac0a2be31206e58ec549e4d92ffc_conti.exe
- Size 260KB
- Sample260804-s3pjsa1xey
- SHA256 52127887530448bc9a124c05a422eb7d21b7b85923f83ca2ff7b32042443ea32
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 7 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f07ac0a2be31206e58ec549e4d92ffc_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f07ac0a2be31206e58ec549e4d92ffc_conti.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\SecurityHealth'; $Shortcut.Description = 'Microsoft Security Health Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe"C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "MicrosoftSecurityHealthCheck" /tr "C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe" /sc onlogon /ru "WLQWINKU\Admin" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"2⤵
- Executes dropped EXE
-
-
C:\PROGRA~3\MICROS~1\SECURI~1\SecHealthMon.exeC:\PROGRA~3\MICROS~1\SECURI~1\SECHEA~2.EXE1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\SecurityHealth'; $Shortcut.Description = 'Microsoft Security Health Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe"C:\ProgramData\Microsoft\SecurityHealth\SecHealthMon.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "MicrosoftSecurityHealthCheck" /tr "C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe" /sc onlogon /ru "WLQWINKU\Admin" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exeC:\ProgramData\Microsoft\SecurityHealth\SecHealthSvc.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
SecHealthMon.exe
StartupProfileData-NonInteractive
SecurityHealth.lnk
memory/1072-55-0x00007FF7B5950000-0x00007FF7B5998000-memory.dmp
memory/1072-39-0x00007FF7B5950000-0x00007FF7B5998000-memory.dmp
memory/1464-45-0x00007FF7C8B30000-0x00007FF7C8B78000-memory.dmp
memory/1468-43-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-32-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-34-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-33-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-31-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-30-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-29-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-24-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-25-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-26-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-27-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1468-28-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/1724-58-0x00007FF7C8B30000-0x00007FF7C8B78000-memory.dmp
memory/2052-44-0x00007FF7B5950000-0x00007FF7B5998000-memory.dmp
memory/4160-7-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-2-0x00007FFCE1F5F000-0x00007FFCE1F60000-memory.dmp
memory/4160-13-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-12-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-8-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-17-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-9-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-11-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-10-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4160-6-0x000002DB1D5F0000-0x000002DB1D612000-memory.dmp
memory/4160-3-0x00007FFCE1DD0000-0x00007FFCE2774000-memory.dmp
memory/4536-66-0x00007FF7C8B30000-0x00007FF7C8B78000-memory.dmp
memory/4996-56-0x00007FF7C8B30000-0x00007FF7C8B78000-memory.dmp
memory/5672-38-0x00007FF782930000-0x00007FF782978000-memory.dmp
memory/5672-65-0x00007FF782930000-0x00007FF782978000-memory.dmp
memory/5792-62-0x00007FF7B5950000-0x00007FF7B5998000-memory.dmp