Analysis
- max time kernel
119s - max time network
123s - platform
windows7_x64 - resource
win7v20201028 - submitted
08/04/2021, 12:47
General
- Target ScHost.exe
- Size 344KB
- Sample210408-ml5ss1bfa6
- SHA256 b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScHost.exe"C:\Users\Admin\AppData\Local\Temp\ScHost.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ScHost.exe"C:\Users\Admin\AppData\Local\Temp\ScHost.exe" 12⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-62-0x000007FEF2730000-0x000007FEF37C6000-memory.dmp
memory/788-63-0x0000000000A10000-0x0000000000A12000-memory.dmp
memory/1100-60-0x0000000000A90000-0x0000000000A92000-memory.dmp
memory/1100-59-0x000007FEF2810000-0x000007FEF38A6000-memory.dmp