{"Id":"c734bcff-aaaa-4450-a9a9-25ee52aa7ff1","Tags":["ktes.sys"],"Verified":"FALSE","Author":"Guus Verbeek","Created":"2023-06-05","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create ktes.sys binPath=C:\\windows\\temp\\ktes.sys type=kernel && sc.exe start ktes.sys","Description":"BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"ktes.sys","MD5":"","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"5ed22c0033aed380aa154e672e8db3a2d4c195c4","SHA256":"","Signature":"","LoadsDespiteHVCI":"TRUE"}]}