35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
R6 Paster Six external/x64/Release/BeDaisy.sys
Size 18KB
Sample260804-er487scf87
SHA256 35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b
MD5 4c0c465499d6ee54352570d2807d12d8
SHA1 332a6b3bf722e97780d09328d420fc8815f8e514
SHA512 53124eadac016c0ad5c2937d09a8a37a4fabda32b56bb3fb90defdab9fa2ba149841056f992e0fb7154308aa71b4f5352a5dcbb5d7ddecf0b5aa036f1899c5ce
SSDEEP 384:e2regI48Iq1qhvYoP6MUMv5g5M/b0475a:eaUi/UMvTJa
TLSH
T15C822CC3A39C58E5E31DC1BB46661A27D1B2BC25272377DF0251C13A2757AE8753AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\R6 Paster Six external\x64\Release\BeDaisy.sys"
1⤵
- Executes a command shell one-liner
PID:4048
- C:\Users\Admin\AppData\Local\Temp\R6 Paster Six external\x64\Release\BeDaisy.sys
  "C:\Users\Admin\AppData\Local\Temp\R6 Paster Six external\x64\Release\BeDaisy.sys"
  2⤵
  PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads