9dbb45724a5136a6e7487660cbedf6051d1b398e1c4be20bc47c8426413d0c06

Analysis

max time kernel
149s
max time network
156s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msdv98se.sys
Size 55KB
Sample260815-pyyecafh96
SHA256 9dbb45724a5136a6e7487660cbedf6051d1b398e1c4be20bc47c8426413d0c06
MD5 f75a35e8f4331a875d3ff8ab4eadef9b
SHA1 bfc3cf16e4765a597325342599d8facbe6d3df78
SHA512 a2cb07be4e28dae1b0d39ce8e8edaa8478f6173b57c8f2f634ec87834aee323bf24bcb628702f1de3b25e74ef8f6beef6369501fb7143d9d6617e5487324d261
SSDEEP 1536:j9krdmj4yXc50WJx7scHLvWbdGiAv1UN:jCdmj4ucxJ1HL06v2
TLSH
T17D436D0173508837C46F83708D5FB775A2B3B9365A2A66AB7F0067683E74551FF28263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\msdv98se.sys
1⤵
- Executes a command shell one-liner
PID:1964
- C:\Users\Admin\AppData\Local\Temp\msdv98se.sys
  C:\Users\Admin\AppData\Local\Temp\msdv98se.sys
  2⤵
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-0-0x0000000000010000-0x000000000001DE00-memory.dmp

Download