Static task
static1
Behavioral task
behavioral1
Sample
sc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sc.exe
Resource
win10v2004-20231215-en
General
-
Target
sc.exe
-
Size
1.5MB
-
MD5
b20a040ed56c85c8d2780a9c1d0596b6
-
SHA1
d22756a52aaca953b2fb61c99c080ac1a690dd19
-
SHA256
bc0df7d2adc5cdaac2ce31dd66359720648bf8f0820177b81b89c59a08953498
-
SHA512
4ed5f51fa78c9a08657f0f919364e11a90af03ff667fa395438c7faf40782d3d4cbbf887b595a343ad1fa5c91c67a72f74f97e75594a4a63f1f0077ebe6ce676
-
SSDEEP
24576:rSMoMkIc2xNjB0jPqbO+pc6ASsuWL2xQQUhi0OsRi94KRFBIwm1MB1vcrni1F0c:rhcIbl0jR7Q04tJ94KR41M+n7Jl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sc.exe
Files
-
sc.exe.exe windows:6 windows x64 arch:x64
d6ef040785dd44855c4e9243e1a2b1bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetDiskFreeSpaceExW
GetComputerNameW
GlobalMemoryStatusEx
GetSystemWindowsDirectoryW
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetFullPathNameW
Thread32Next
Thread32First
OpenProcess
CreateToolhelp32Snapshot
QueueUserAPC
Module32FirstW
Module32NextW
VirtualFreeEx
OpenThread
WaitForSingleObject
GetBinaryTypeW
GetWriteWatch
ResetWriteWatch
GlobalGetAtomNameW
HeapQueryInformation
ReadProcessMemory
IsDebuggerPresent
CreateRemoteThread
RaiseException
SetUnhandledExceptionFilter
CheckRemoteDebuggerPresent
OutputDebugStringW
GetSystemInfo
QueryDosDeviceW
GetModuleHandleExW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetSystemDirectoryW
K32GetModuleInformation
K32GetMappedFileNameW
VirtualQuery
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleA
lstrlenW
CreateFileA
LocalAlloc
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetCurrentThread
CreateEventW
SetEvent
SwitchToThread
LoadLibraryW
QueryInformationJobObject
GetFileAttributesW
Process32NextW
Process32FirstW
WaitForMultipleObjects
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
GetLocaleInfoEx
GetComputerNameExW
LocalSize
PeekNamedPipe
GetFileSizeEx
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
LocalFree
FormatMessageA
SetLastError
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
CreateThread
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
AllocConsole
SetThreadContext
lstrcpyW
GetConsoleWindow
CreateProcessW
VirtualAllocEx
GetThreadContext
lstrcatW
GetLastError
ResumeThread
GetEnvironmentVariableW
GetModuleFileNameW
TerminateProcess
GetShortPathNameW
WriteProcessMemory
GetModuleFileNameA
CreateDirectoryW
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
GetModuleHandleW
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetTempPathW
Sleep
GetCurrentProcessId
GetProcAddress
CloseHandle
GetModuleHandleA
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
FormatMessageW
VirtualFree
user32
DestroyWindow
MessageBoxA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetWindowTextW
UnregisterClassW
GetKeyState
SetWindowsHookExW
GetWindowThreadProcessId
GetShellWindow
FindWindowW
GetWindowRect
MessageBoxW
GetSystemMetrics
DispatchMessageW
PeekMessageW
BlockInput
TranslateMessage
PostQuitMessage
GetDesktopWindow
RegisterClassExW
WindowFromPoint
ShowWindow
GetCapture
GetMonitorInfoW
ClientToScreen
IsChild
GetForegroundWindow
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
LoadCursorW
ScreenToClient
CreateWindowExW
AdjustWindowRectEx
DefWindowProcW
GetWindowLongW
UpdateWindow
IsIconic
SetForegroundWindow
ReleaseCapture
GetDC
GetClientRect
SetWindowLongW
SetCursor
SetCapture
MonitorFromWindow
SetCursorPos
ReleaseDC
EnumDisplayMonitors
SetWindowPos
gdi32
GetDeviceCaps
GetObjectW
DeleteDC
GetBitmapBits
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject
advapi32
RegSetKeyValueW
RegCreateKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
EnumServicesStatusExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
GetUserNameW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegDeleteKeyW
RegCloseKey
RegOpenKeyW
shell32
SHGetSpecialFolderPathW
ShellExecuteA
ShellExecuteW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SysFreeString
SafeArrayGetElement
SafeArrayGetUBound
SysAllocString
msvcp140
?_Xinvalid_argument@std@@YAXPEBD@Z
_Equivalent
_To_wide
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_C_error@std@@YAXH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord60
ord45
ord211
ord46
ord217
ord50
ord143
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord22
ord41
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
ws2_32
ntohl
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
getpeername
htons
getsockopt
getsockname
gethostname
recv
connect
bind
WSAGetLastError
closesocket
send
shlwapi
StrChrW
PathCombineW
StrStrIW
PathRemoveExtensionW
PathFindFileNameW
StrCmpW
StrCmpNIW
StrCmpIW
PathGetDriveNumberW
wnsprintfW
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
userenv
UnloadUserProfile
mpr
WNetGetProviderNameW
iphlpapi
GetAdaptersInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
powrprof
GetPwrCapabilities
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
strchr
memcpy
memset
_CxxThrowException
__std_terminate
memcmp
memmove
strrchr
__C_specific_handler
__current_exception
__current_exception_context
wcsstr
__std_exception_destroy
memchr
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
_pclose
fgets
_get_stream_buffer_pointers
__stdio_common_vfwprintf
ftell
fopen_s
__stdio_common_vswprintf_s
_popen
fputc
__acrt_iob_func
fflush
_lseeki64
fclose
fgetc
fseek
__stdio_common_vfprintf
fwrite
fgetpos
setvbuf
_set_fmode
fputs
fopen
feof
_wfopen
__p__commode
__stdio_common_vsscanf
_fseeki64
fread
_read
_write
_close
_open
ungetc
__stdio_common_vsprintf
__stdio_common_vswprintf
fsetpos
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
realloc
_callnewh
free
calloc
api-ms-win-crt-utility-l1-1-0
rand
qsort
srand
api-ms-win-crt-filesystem-l1-1-0
_access
_unlink
_fstat64
remove
_wremove
_stat64
_unlock_file
_lock_file
rename
api-ms-win-crt-string-l1-1-0
isxdigit
strtok_s
tolower
_strdup
strncmp
isupper
_stricmp
strncpy
strspn
_wcsicmp
strpbrk
strcspn
toupper
strcmp
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
_localtime64_s
strftime
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_beginthreadex
_initterm
_get_narrow_winmain_command_line
__sys_nerr
_invalid_parameter_noinfo
terminate
_resetstkoflw
_set_app_type
_seh_filter_exe
_cexit
_getpid
_crt_atexit
_register_onexit_function
_initialize_onexit_table
system
_initialize_narrow_environment
_configure_narrow_argv
exit
strerror
api-ms-win-crt-convert-l1-1-0
atoi
strtoull
strtoul
strtod
_wcstoui64_l
strtol
strtoll
api-ms-win-crt-math-l1-1-0
fmodf
__setusermatherr
ceilf
acosf
sqrtf
_dsign
_dclass
sinf
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_get_current_locale
___lc_codepage_func
localeconv
Sections
.text Size: 998KB - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 372KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ