8e9e314efdddb511aae612b5494c09e6a5ea2559b4682c7413aee02dfbde3161

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CDM 2.04.16 WHQL Certified/i386/ftser2k.sys
Size 70KB
Sample261027-ec1mga1vbw
SHA256 8e9e314efdddb511aae612b5494c09e6a5ea2559b4682c7413aee02dfbde3161
MD5 23220a4709cc5785f9633ba71416145c
SHA1 cf86f7bf5ab5edd2ab147975e4b3c0c79a86e0dc
SHA512 68849d9ec6705347e2627fa6a5b64707f6bf030f1b57111970fb961a63e0a79f1434c59a33554d12943e70b91325a6be1eee02bad711d3c5e4466ee69521bbf0
SSDEEP 1536:1+NRSBEZsYxZomK+5fQjQA/vvWlNad47PnaRg:E5xZomK+YXYaSP
TLSH
T1326308512AE04272E4F37AB0643D7A318A2FB5D15B3AD2DF124046F96DA17D0FE2136B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4712	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\i386\ftser2k.sys"
1⤵
- Executes a command shell one-liner
PID:4712
- C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\i386\ftser2k.sys
  "C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\i386\ftser2k.sys"
  2⤵
  PID:4848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-0-0x0000000000010000-0x0000000000026000-memory.dmp

Download