f147e2d045770497aa61ddf717a899c1bbdeace7751aad721405425feb009ac4

Analysis

user interaction
yes
max time kernel
38s
max time network
38s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/09/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
driver.sys
Size 27KB
Sample260910-pxv8laxtav
SHA256 f147e2d045770497aa61ddf717a899c1bbdeace7751aad721405425feb009ac4
MD5 7fdd08cc697ba488fefa9e3b10f8e59a
SHA1 3f57c930ae28d355c496ccc6a66571201eb641de
SHA512 869e9bcfb1e2471b76e22173e12930fb470254cee7179946755dfcdaf27270443e78eb21bc27380543f92d1be3482bf4f473d2b90d45fd5356d19508c7937577
SSDEEP 384:O4nNCZEBFzsykX+MyCPhxKwAhMyMtCTWo5Hqvyfg5kGAiCCXKUHeM3:O4ngKDw9X+ihKaygiWoIvy+AvCx
TLSH
T18AC2E797B1CC34B9CC58A939C5AC837B4776F9689BA094CFA5A0D497C7C11E0333D266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\driver.sys
1⤵
- Executes a command shell one-liner
PID:5048
- C:\Users\Admin\AppData\Local\Temp\driver.sys
  C:\Users\Admin\AppData\Local\Temp\driver.sys
  2⤵
  PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads