b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7

Analysis

max time kernel
62s
max time network
125s
platform
windows10_x64
resource
win10v20201028
submitted
08/04/2021, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScHost.exe
Size 344KB
Sample210408-ml5ss1bfa6
SHA256 b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7
MD5 d840022368e5c69eb49c091f9e99b09c
SHA1 ca0dba6fa569c23cc8643a0711e889d057f59b37
SHA512 ec4dafb832cc57f77836bad4a899ad08fb993871fb81900ab4f2237979fc4f431169188adf5b2953dafaf33e07c1867a6a8ff26da21e33058ab79fac7a86ee11
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	ScHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4172	4700	ScHost.exe	77
PID 4700 wrote to memory of 4172	4700	ScHost.exe	77

C:\Users\Admin\AppData\Local\Temp\ScHost.exe
"C:\Users\Admin\AppData\Local\Temp\ScHost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\ScHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ScHost.exe" 1
  2⤵
  PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4172-117-0x0000000001460000-0x0000000001462000-memory.dmp

Download

memory/4700-114-0x0000000002FD0000-0x0000000002FD2000-memory.dmp