1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe
Size 737KB
Sample260910-3ya6pshr5v
SHA256 1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304
MD5 2af55e53f0619d0464df703b261f9f33
SHA1 d19ee507f24c8ce649c0946cdc0b663b2742c9ae
SHA512 d3627f0a892570f35b04a163c93418ad8d1223efb2036b0bf6b27c98844bdb8b93ef996de59f8976a1df9b3de911f59e8e096a55e04861e0981f636ce51d7397
SSDEEP 12288:32cV/KnYxigd+RhFTRtysRJo1/Rv3qsk22xIqn8V:mY/wYwgMRtyBV9V+8
TLSH
T13DF42A47FA6685E8D56AC03C8B5AA136F63278D9473066EB23941B2D3F53FD06E2D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3156	.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.jgeqfbfzehepbffnisezuyhotvbnzdvu.__selfdelete__.exe

Executes dropped EXE 3 IoCs

pid	Process
816	SecurityHealthService.exe
3156	.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.jgeqfbfzehepbffnisezuyhotvbnzdvu.__selfdelete__.exe
2216	SecurityHealthService.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
1	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	SecurityHealthService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	SecurityHealthService.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityHealthService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SecurityHealthService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe
2216	SecurityHealthService.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3600	1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	SecurityHealthService.exe
Token: SeLockMemoryPrivilege	2216	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2596	3600	1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe	89
PID 3600 wrote to memory of 816	3600	1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe	91
PID 3600 wrote to memory of 3156	3600	1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe	92
PID 3156 wrote to memory of 4280	3156	.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.jgeqfbfzehepbffnisezuyhotvbnzdvu.__selfdelete__.exe	94

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2596	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe
"C:\Users\Admin\AppData\Local\Temp\1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\system32\attrib.exe
  "attrib" C:\Users\Admin\AppData\Roaming\System32
  2⤵
  - Views/modifies file attributes
  PID:2596
- C:\Users\Admin\AppData\Roaming\System32\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Roaming\System32\SecurityHealthService.exe"
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Users\Admin\AppData\Local\Temp\.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.jgeqfbfzehepbffnisezuyhotvbnzdvu.__selfdelete__.exe
  "C:\Users\Admin\AppData\Local\Temp\.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.jgeqfbfzehepbffnisezuyhotvbnzdvu.__selfdelete__.exe" 548 C:\Users\Admin\AppData\Local\Temp\.1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304.tmdmfwvqemsprelmfixqzjimqlmvnnir.__relocated__.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c exit
    3⤵
    - Executes a command shell one-liner
    PID:4280

C:\Users\Admin\AppData\Roaming\System32\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\System32\SecurityHealthService.exe -k netsvcs -p -s Winmgmt
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stats.log

Path C:\Users\Admin\AppData\Roaming\Docker\stats.log
Size 45B
SHA256 0048d802fa9129f5d81194d4e967e08c1f38b5bb5d58db91f3406387cd0243a8
MD5 0a0805182534ae03d7cb44c7a5bb2745
SHA1 79545c5e2f54ac9d3cc2e200097475e96dc73ea3
SHA512 81dd4dc2aa521e627060da298ccfb7e34afff1429199b105bdee463cf342b302f376a96df94c11a12bd1793ad21545951f789d0494c24fc2d44c4cda6657185c
MD5 SHA1 SHA512

Submit Download

SecurityHealthService.exe

Path C:\Users\Admin\AppData\Roaming\System32\SecurityHealthService.exe
Size 737KB
SHA256 1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304
MD5 2af55e53f0619d0464df703b261f9f33
SHA1 d19ee507f24c8ce649c0946cdc0b663b2742c9ae
SHA512 d3627f0a892570f35b04a163c93418ad8d1223efb2036b0bf6b27c98844bdb8b93ef996de59f8976a1df9b3de911f59e8e096a55e04861e0981f636ce51d7397
SSDEEP 12288:32cV/KnYxigd+RhFTRtysRJo1/Rv3qsk22xIqn8V:mY/wYwgMRtyBV9V+8
TLSH
T13DF42A47FA6685E8D56AC03C8B5AA136F63278D9473066EB23941B2D3F53FD06E2D340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-12-0x0000028AAFC00000-0x0000028AAFC13000-memory.dmp

Download

memory/2216-13-0x0000028AAFC00000-0x0000028AAFC13000-memory.dmp

Download

memory/3156-9-0x00007FF70D820000-0x00007FF70D8DD000-memory.dmp

Download

memory/3600-8-0x00007FF68DD20000-0x00007FF68DDDD000-memory.dmp

Download