Analysis
- max time kernel
150s - max time network
91s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/04/2021, 13:58
General
- Target ScHost.exe
- Size 593KB
- Sample210410-pgp8lfsa66
- SHA256 0a8ddf7be1e8bcaefd7fca87ee9adc6aabd53dee30c69b726beb0554b1746c6d
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScHost.exe"C:\Users\Admin\AppData\Local\Temp\ScHost.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ScHost.exe"C:\Users\Admin\AppData\Local\Temp\ScHost.exe" 12⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1660-63-0x0000000002050000-0x0000000002052000-memory.dmp
memory/1660-62-0x000007FEF2490000-0x000007FEF3526000-memory.dmp
memory/1964-60-0x0000000002090000-0x0000000002092000-memory.dmp
memory/1964-59-0x000007FEF2570000-0x000007FEF3606000-memory.dmp