Overview

overview

9

Static

static

5

SecurityHe...ay.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 04:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecurityHealthSystray.exe
  • Size 89.0MB
  • Sample261014-epa8caysdy
  • SHA256 de5f62db19205b40064ab88342ae8ab6f4acabc5cf637f443fc1f053d8bc0bbb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionimpactransomwareupx

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3296
    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
      1⤵
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /d /q /c vssadmin delete shadows /all /quiet
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:3264
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x000000000000050C
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3464
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4904

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ~fs_intro.gif
          • Path C:\Users\Admin\AppData\Local\Temp\~fs_intro.gif
          • Size 3.7MB
          • SHA256 361386a4351fdc589f2e396172c711c25581a6de9b58d4bfe325ebf14e585963
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1304-0-0x00007FF772E70000-0x00007FF772FD8000-memory.dmp
          Download

          memory/1304-14-0x00007FF772E70000-0x00007FF772FD8000-memory.dmp
          Download

          memory/1304-15-0x00007FF772E70000-0x00007FF772FD8000-memory.dmp
          Download

          memory/1304-19-0x00007FF772E70000-0x00007FF772FD8000-memory.dmp
          Download