Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/06/2026, 06:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
klr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
klr.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target klr.exe
- Size 265KB
- Sample260622-g3f2vsas8w
- SHA256 4ee3511d715d4177f36658adab6e8c5114d3e129a5a7b96c99cc469effab8616
- MD5 47eb3099e6aea06f22c6037f7f1df663
- SHA1 f821ca00c914443374f39704d157fccdeaf87775
- SHA512 b9cbb86f59aad2f875e5cf04d8bbb153320d193b48e43d2a89d3bcc5772b6001a507812f84d752ca9e7648c6a1fa3e3203cafe51bdf4e7bc0953660db6d4b454
- SSDEEP 6144:lmpTEguy4gpjb/6l6ZaXyrWpAKhhvOjHJx:lmWP6bSlI2yrihhm
- TLSH T14E447C4763E525F9E0B78238C9A54B46E771F8221330ABDF07A0865E1F237D1AD39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" WinSysKdrv.exe - Executes dropped EXE 2 IoCs
pid Process 2040 WinSysKdrv.exe 5380 EmbeddedDriverService.sys - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 2040 WinSysKdrv.exe 2040 WinSysKdrv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe Token: SeDebugPrivilege 2040 WinSysKdrv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\klr.exe"C:\Users\Admin\AppData\Local\Temp\klr.exe"1⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
- Executes dropped EXE
PID:5380
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
- Size 147KB
- SHA256 b47a2609a644adee63f9425c7539dd51e963733e7390e4cad667e1985baba2aa
- MD5 ee32c790c506bc8faeac05590a1472a5
- SHA1 e69a156811756c2af3c18dd12f7a1daa278b4a18
- SHA512 6512ef88fa238fcfa6512469159f8c2e71d2fd901bffa084ba4803a70ff0325a26da547850fbc71445537cc4b5d78e28df5516b400d2c8c56770136d4000a692
- SSDEEP 3072:HkHTmrWph2Pe4Kh62FgFeOWXeTLnZz8EN9lDt:AyrWpAKhhvOjHJ
- TLSH T15EE35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH