{"Id":"d3111e83-52eb-4a8c-817d-761ea72d37e2","Tags":["fgme.sys"],"Verified":"FALSE","Author":"Guus Verbeek","Created":"2023-06-05","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create fgme.sys binPath=C:\\windows\\temp\\fgme.sys type=kernel && sc.exe start fgme.sys","Description":"BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"fgme.sys","MD5":"","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"0bec69c1b22603e9a385495fbe94700ac36b28e5","SHA256":"","Signature":"","LoadsDespiteHVCI":"TRUE"}]}