0a8ddf7be1e8bcaefd7fca87ee9adc6aabd53dee30c69b726beb0554b1746c6d

Analysis

max time kernel
13s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
10/04/2021, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScHost.exe
Size 593KB
Sample210410-pgp8lfsa66
SHA256 0a8ddf7be1e8bcaefd7fca87ee9adc6aabd53dee30c69b726beb0554b1746c6d
MD5 2b04b457e7e5074575dddf7e9391c014
SHA1 9bba9653bb3685854eb0d0aee4a07ea63d0ab7ac
SHA512 bec0ebc42b46ccfe70ccb14582c5484faf76a6ec823889e58467b4139c4b8dd3e43cad8cbe4b547264b5a55bd438e481524298ee7f4293aa357c2af13b749905
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	ScHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3096	4776	ScHost.exe	77
PID 4776 wrote to memory of 3096	4776	ScHost.exe	77

C:\Users\Admin\AppData\Local\Temp\ScHost.exe
"C:\Users\Admin\AppData\Local\Temp\ScHost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\ScHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ScHost.exe" 1
  2⤵
  PID:3096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3096-117-0x0000000003140000-0x0000000003142000-memory.dmp

Download

memory/4776-114-0x00000000029A0000-0x00000000029A2000-memory.dmp