Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
framework_sensors_0.0.0.6_EVCert_Debug/FrameworkSensors.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
- Size 878B
- Sample261102-nywp3seh58
- SHA256 a91a752c9917b941158a951ef097007940f59b84a51bbec814a517c6c55aed4a
- MD5 ec056f242515712450dbb05f1ed957b0
- SHA1 35a2551524e48dd55f89322b5439b85f4e886bdc
- SHA512 297b1af926e5799081c0e010ee599a3917b8a71c75ec02979e419e1dc6e303acd48fd72aa52234264c1778911a08d261f9391e6e21d5fd021eb523854fcbafc2
- TLSH T119115C090C8686322272D2B0D7272540F66EF1073C2848B4F56361A49DFA2849BFD6D9
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\243739A0C90E373D5D89308ACADB8692C8419BEC\Blob = 030000000100000014000000243739a0c90e373d5d89308acadb8692c8419bec19000000010000001000000058e740378bd5e79842e73b21e6b5cd8c6b00000001000000200000007ef558533441c1f09b7816235f2e569ef98b18fcb472133a6b67d8da3426aa8e0f00000001000000200000006733b04c146a97e6f89c29e440fafb5cc7219fd54ae68cf965c58f1c5ebd89d42000000001000000e4050000308205e0308203c8a00302010202101a38ae2319b9a2dab8dea5814b36dd62300d06092a864886f70d01010b0500307b310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e3111300f060355040a0c0853534c20436f72703137303506035504030c2e53534c2e636f6d20455620436f6465205369676e696e6720496e7465726d65646961746520434120525341205233301e170d3234303431313033303433345a170d3237303430313035323632325a3081dd310b30090603550406130255533113301106035504080c0a43616c69666f726e69613116301406035504070c0d53616e204672616e636973636f311f301d060355040a0c164672616d65776f726b20436f6d707574657220496e633110300e0603550405130737373631323431311f301d06035504030c164672616d65776f726b20436f6d707574657220496e63311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31193017060b2b0601040182373c0201020c0844656c617761726531133011060b2b0601040182373c020103130255533076301006072a8648ce3d020106052b8104002203620004f48332d1802818e69cd48a2000958294735d67729411b16da80ebf3cdccccc42e00a386e9781e13cd641a9e41e31c29e1cfb9ce2dd8f0b4506515c3f217fe8f5d3b7d0dc4a32210b596573b57097caa78249e8b93bc3434469d71d7242794ad4a38201a9308201a5300c0603551d130101ff04023000301f0603551d2304183016801436bd49ff312cebaf6a40fe99c016edbafc48dd5f307d06082b060105050701010471306f304b06082b06010505073002863f687474703a2f2f636572742e73736c2e636f6d2f53534c636f6d2d53756243412d45562d436f64655369676e696e672d5253412d343039362d52332e636572302006082b060105050730018614687474703a2f2f6f637370732e73736c2e636f6d305f0603551d20045830563007060567810c0103300d060b2a84680186f67702050107303c060c2b0601040182a93001030302302c302a06082b06010505070201161e68747470733a2f2f7777772e73736c2e636f6d2f7265706f7369746f727930130603551d25040c300a06082b0601050507030330500603551d1f044930473045a043a041863f687474703a2f2f63726c732e73736c2e636f6d2f53534c636f6d2d53756243412d45562d436f64655369676e696e672d5253412d343039362d52332e63726c301d0603551d0e041604140592833f7ea17e2ebc67534751d248b3d5881b45300e0603551d0f0101ff040403020780300d06092a864886f70d01010b05000382020100e34e965bae83e986a61aa234b9ac8e59184ef2615c86f4730b1e0e1f42054f5538dcc5925cf21571a6dddc21dd035635f802e3182000f8b43e9a6284f6a7626fc00a86a8775bdffac2cdc903e696d74da93b27c0aa162490066fab92a5b3ffcebc1a39e317fa9e0a4316d687dcb142a8a7942d629c6b7a4f65720a0581671e0265152b844f7daec12fe49aa8e8003d6865a883939ba4adc28bcbbf8f52757fe35a0d83f5ba2d4401cd379262ef49e86e3f82dbecf1b7bdca017a12f1e15f94d64d09ab4dc68a3f6cab2e342a0bc9e855a7d1d63aedf69ee55e0e0a8bd7016de4b5b1cac34ae3617c96744885d97129b4cf61debb4aa186d66c4f852f2c93342e2a8986a68501bf9d7fcd4cd963d8771b8b162c4abd709c88d0bbc546104e76fc736a4f3e1db2777d400e176f4abd9638124db5b22df42322fb7c96f89ff4806ce85ef6f6cd68c402f215e34f42ba5649c1ad42e4e41b1983cd86d1d368766e8c57473a15f9a1173d233c2b8aecbb43e3dacb54aca28e6ab9da2fe7256ba09638f96792d23736ef223856770bc1cc216f677967827459a5a6c9b134c6d6d568ac6f2020df4b87c8820b54db995ed52bbf3f31ac429f513c992de777cf89e41e4254e1ee54f3218677b44224784c7254b6bba6b91cbe36b3b19a7d05904b7ecaadfae6d9e708ab0b5164a3db17a4694061450352efb216a541f4afcf059af8fde2 DrvInst.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET7FE4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET7FE4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET7FF5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\FrameworkSensors.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\FrameworkSensors.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\FrameworkSensors.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET7FF5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET8025.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\SET8025.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d} DrvInst.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4324 cmd.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID pnputil.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4324 wrote to memory of 704 4324 cmd.exe 90 PID 4324 wrote to memory of 2664 4324 cmd.exe 91 PID 5936 wrote to memory of 5940 5936 DrvInst.exe 93 PID 4324 wrote to memory of 3760 4324 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug\install_frameworksensors.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:704
-
-
C:\Windows\system32\pnputil.exepnputil -a "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug\\frameworksensors.inf" /install2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2664
-
-
C:\Windows\system32\cmd.execmd /k2⤵PID:3760
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9cc4111e-ab78-0347-a6eb-fdd9ac158f23}\FrameworkSensors.inf" "9" "4e6745d3f" "00000000000001A0" "WinSta0\Default" "00000000000001A4" "208" "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug"1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{F5F99E60-B45B-4B3C-88BA-71829DFC2DC2} Global\{668784ED-EAC0-43FE-80FA-E59017D3CC0D} C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\FrameworkSensors.inf C:\Windows\System32\DriverStore\Temp\{db5ff289-81ae-ad4b-8ae0-f0e3d350b09d}\FrameworkSensors.cat2⤵PID:5940
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b.ini
- Size 451B
- SHA256 a83309c86836a9a3c81b1ed4001fc18688af82763dd4c3b339c6e612052db4f3
- MD5 59accef75035bfde8889ce02ac401683
- SHA1 0dfb4d349536706442d17add725910384213f7ac
- SHA512 057b9f3f1984ad0d0053142265718808dba7b42695201dba8705150de28cd4879c5d52ce1a0bf411830d5ca9bc35616bc57ef67a90dd90dc7d8a7e425145214c
- TLSH T115F03051528941EF3B545E217E3C8CF7886DA6E9B42214ED7330DC8C4779C287B11367
- MD5 SHA1 SHA512 TLSH