d6a4e0dda642a84e4a964f7f33982306205b7ec2465312bb6ad8783bb981050e | Triage

Analysis

max time kernel
504s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 11:41

Sharing

Report Analysis Logs

General

Target

Egypt_RootCA_G1.cer
Size

2KB
MD5

582e82d3325d1cfeb940956435d0fe54
SHA1

955827a8d63d70012e09b0bb36a3bf1d9284473d
SHA256

d6a4e0dda642a84e4a964f7f33982306205b7ec2465312bb6ad8783bb981050e
SHA512

1faf797ca584638748b7d022cc73bcfea3adbd84dcbf502989221d4ba6f943c89a58db05c2d07a5b0df546ef0390f34a714e5ad64ddd4467b79e07cfe431a591

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1844	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\Egypt_RootCA_G1.cer
1⤵
- Blocklisted process makes network request
- Suspicious use of FindShellTrayWindow
PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads