59080957de2519f5013be8ccf0b9012dc97ad692e69578cb3f60148c528bdbb1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CVE-2026-36425-main/Drivers/ardrv_14.sys
Size 17KB
Sample260802-enppcacg86
SHA256 59080957de2519f5013be8ccf0b9012dc97ad692e69578cb3f60148c528bdbb1
MD5 77bdf1dada2014c98e4e50b2765fbd05
SHA1 11e24f2debc92df1dd0574a7de14ae7903b1ca5f
SHA512 c99b9c1bf55d71c4fcc19e65c98e60e035f9dedd2f5fc8af592f326e42e9e3f032af23f9dcf0f13676df076ded6dd2ed5f07727d2eabc23bad7bb743d0b68770
SSDEEP 192:P/l8U56apCCZQyEzw9l0HNX8Lk0fOEExZZnYe+PjP8srcQqwBjtlAhSJ3:3l/5rCCZQ1zY0Huk0oZZnYPL1tqOUhY
TLSH
T110826C9B875E209BFAD3C97592E28777EC30BAE0A75505EF0165C2811E82FF05739318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
412	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_14.sys
1⤵
- Executes a command shell one-liner
PID:412
- C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_14.sys
  C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_14.sys
  2⤵
  PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-0-0x0000000000010000-0x0000000000018000-memory.dmp

Download