Driver intelligenceMaliciousVerified

MSqPq.sys

BlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.

UUID / 8198f5af-4b40-4800-a22a-4a7cf957ef37ADDED / 2023-06-05AUTHOR / Guus Verbeek

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

MSqPq.sysSample 1 · HVCI TRUE

MD5: 97539c78d6e2b5356ce79e40bcd4d570
SHA1: f6793243ad20359d8be40d3accac168a15a327fb
SHA256: 56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c
Imphash: fca0f3c7b6d79f494034b9d2a1f5921a
Authentihash MD5: e66ea646261c73baee310361524fbb7c
Authentihash SHA1: 12d1ff0396dc1ffe15ad4fcb42319f6d4ee99393
Authentihash SHA256: 0527451d72ba02db8479ea69689350cc563b939bb2cc685386719ab32b7e2772
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

sc.exe create MSqPq.sys binPath=C:\windows\temp\MSqPq.sys type=kernel && sc.exe start MSqPq.sys

Elevate privileges · Privileges: kernel · OS: Windows 10