fd4a1eb46a25b5e687957300aab62074cf36a7905bbbd0cb0809c150d5f5facc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Z1RO/driver.sys
Size 8KB
Sample260720-xbl2ssdv4y
SHA256 fd4a1eb46a25b5e687957300aab62074cf36a7905bbbd0cb0809c150d5f5facc
MD5 64459649af479f7d4ab915e8d2dc177d
SHA1 e723c78eff93834f8ec6ea3fefaa4996d3b7fe72
SHA512 c0d076a765399394c7a9e2e3c1ec9a161469ad8942688d68ca1802f81b3ffe5040c7f78f9581ce620cbd24460acdb6dce67872f3ec3c18542aaf3ddb85d7bb83
SSDEEP 96:UU8fjUHmSWDb22zvqLcSHWj7nVQOJT0VzvDBhhJ:tWP22zvqYYcTVQ7zbzh
TLSH
T19102C8B061179DC4E25DE17ECA9746A9B6B5F01003924FEF8965CA6E1F12FC12C3BA80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1668	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Z1RO\driver.sys
1⤵
- Executes a command shell one-liner
PID:1668
- C:\Users\Admin\AppData\Local\Temp\Z1RO\driver.sys
  C:\Users\Admin\AppData\Local\Temp\Z1RO\driver.sys
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads