35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tools/BeDaisy.sys
Size 18KB
Sample261029-ypncfscc86
SHA256 35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b
MD5 4c0c465499d6ee54352570d2807d12d8
SHA1 332a6b3bf722e97780d09328d420fc8815f8e514
SHA512 53124eadac016c0ad5c2937d09a8a37a4fabda32b56bb3fb90defdab9fa2ba149841056f992e0fb7154308aa71b4f5352a5dcbb5d7ddecf0b5aa036f1899c5ce
SSDEEP 384:e2regI48Iq1qhvYoP6MUMv5g5M/b0475a:eaUi/UMvTJa
TLSH
T15C822CC3A39C58E5E31DC1BB46661A27D1B2BC25272377DF0251C13A2757AE8753AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1652	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tools\BeDaisy.sys
1⤵
- Executes a command shell one-liner
PID:1652
- C:\Users\Admin\AppData\Local\Temp\tools\BeDaisy.sys
  C:\Users\Admin\AppData\Local\Temp\tools\BeDaisy.sys
  2⤵
  PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads