← Back to driver explorer
Driver intelligenceMaliciousVerified
dkrTK.sys
The User Agent tjr.exe, which is protected via a virtual machine, drops the kernel driver to the user temporary directory C:\%User%\AppData\Local\Temp\Ktgn.sys. It then installs the dropped driver with the name ktgn and the start value = System (to start when the system restarts). From our analysis of what occurs when a user interfaces with this driver, we observed that it only uses one of the exposed Device Input and Output Control (IOCTL) code — Kill Process, which is used to kill security agent processes installed on the system.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
dkrTK.sysSample 1 · HVCI TRUE
- MD5
a837302307dace2a00d07202b661bce2- SHA1
91568d7a82cc7677f6b13f11bea5c40cf12d281b- SHA256
52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677- Imphash
26ceec6572c630bdad60c984e51b7da4- Authentihash MD5
233c2815720d7aa90838780dc482ddb9- Authentihash SHA1
6271a84b349debb9a1bf7a5a164e91ef6cb9f869- Authentihash SHA256
24395b622d4fd48864a50978ffd2b82fdded5189741a6deea9293cc075cd0c6b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create dkrTK.sys binPath=C:\windows\temp\dkrTK.sys type=kernel && sc.exe start dkrTK.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: BushidoToken BushidoToken