File name:

SecurityHealthService.exe

Full analysis: https://app.any.run/tasks/4d316779-0c30-438c-8bc0-f72090d679c1
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: November 13, 2024, 10:34:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
remote
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

73C088A54FD675BE63AE50E1415BCE9B

SHA1:

968CA108CE1D803F69CC3E1833D6D56615342169

SHA256:

E9CB28657A6DCD7E0F17F6E4F7D128351C389784BB027FDABA7F669794EDC846

SSDEEP:

12288:5slkp9aPcvH4ZYBiC93uRtocgfJduZ944TyZ3vYrT/sgmeLmhR:5slG9aPVc/f/uZ944TyxQr7sgBLGR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XWORM has been detected (SURICATA)

      • Windows Security Health Host.exe (PID: 5084)

  • SUSPICIOUS

    • Hides command output

      • cmd.exe (PID: 6204)
      • cmd.exe (PID: 1952)

    • Process drops legitimate windows executable

      • SecurityHealthService.exe (PID: 7052)
      • cmd.exe (PID: 1952)

    • Starts a Microsoft application from unusual location

      • SecurityHealthService.exe (PID: 7052)

    • Starts CMD.EXE for commands execution

      • SecurityHealthService.exe (PID: 7052)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6204)
      • cmd.exe (PID: 1952)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6204)

    • The process creates files with name similar to system file names

      • cmd.exe (PID: 1952)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 1952)

    • The executable file from the user directory is run by the CMD process

      • Windows Security Health Host.exe (PID: 4348)

    • Connects to unusual port

      • Windows Security Health Host.exe (PID: 5084)

    • Contacting a server suspected of hosting an CnC

      • Windows Security Health Host.exe (PID: 5084)

    • Application launched itself

      • Windows Security Health Host.exe (PID: 4348)

  • INFO

    • Reads the computer name

      • SecurityHealthService.exe (PID: 7052)

    • Checks supported languages

      • SecurityHealthService.exe (PID: 7052)

    • Sends debugging messages

      • Windows Security Health Host.exe (PID: 4348)

    • The process uses the downloaded file

      • Windows Security Health Host.exe (PID: 4348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1995:05:05 01:27:52+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 452608
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x7074e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.18.1907.16384
ProductVersionNumber: 4.18.1907.16384
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Windows Security Health Service
FileVersion: 4.18.1907.16384 (WinBuild.160101.0800)
InternalName: SecurityHealthService
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: SecurityHealthService.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 4.18.1907.16384
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start securityhealthservice.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe conhost.exe no specs ping.exe no specs reg.exe no specs ping.exe no specs windows security health host.exe no specs #XWORM windows security health host.exe

Process information

PID
CMD
Path
Indicators
Parent process
1572ping 127.0.0.1 -n 13 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1952"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\admin\Desktop\SecurityHealthService.exe" "C:\Users\admin\Music\Windows Security Health Host.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\admin\Music\Windows Security Health Host.exe"C:\Windows\SysWOW64\cmd.exe
SecurityHealthService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2928REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\admin\Music\Windows Security Health Host.exe,"C:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4348"C:\Users\admin\Music\Windows Security Health Host.exe"C:\Users\admin\Music\Windows Security Health Host.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Service
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\music\windows security health host.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5084"C:\Users\admin\Music\Windows Security Health Host.exe"C:\Users\admin\Music\Windows Security Health Host.exe
Windows Security Health Host.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Service
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\music\windows security health host.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6148ping 127.0.0.1 -n 13 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6200ping 127.0.0.1 -n 7 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6204"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\admin\Music\Windows Security Health Host.exe,"C:\Windows\SysWOW64\cmd.exe—SecurityHealthService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7052"C:\Users\admin\Desktop\SecurityHealthService.exe" C:\Users\admin\Desktop\SecurityHealthService.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Service
Exit code:
0
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\securityhealthservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
4 339
Read events
4 324
Write events
15
Delete events
0

Modification events

(PID) Process:(2928) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe,C:\Users\admin\Music\Windows Security Health Host.exe,
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5084) Windows Security Health Host.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Windows Security Health Host_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1952cmd.exeC:\Users\admin\Music\Windows Security Health Host.exeexecutable
MD5:73C088A54FD675BE63AE50E1415BCE9B
SHA256:E9CB28657A6DCD7E0F17F6E4F7D128351C389784BB027FDABA7F669794EDC846
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
9
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1584
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1584
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.20.3.235:443
https://pastebin.com/raw/nV1XKCv3
unknown
text
19 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1584
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1584
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.176
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.178
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.160
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
pastebin.com
  • 104.20.3.235
  • 104.20.4.235
  • 172.67.19.24
malicious
self.events.data.microsoft.com
  • 52.182.143.215
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecurityHealthService.exe