f8fac5b3d38d4d2589c6a4ef9d9c10a89250e84bea37adde055b0426e7b11167 | Triage

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 19:53

Sharing

Report Analysis Logs

General

Target

certificate.bat
Size

299B
MD5

3db90d509c83f972d6f93470198ddd41
SHA1

418a32669c68c0532fd442d37fab0c91dfa112f7
SHA256

258f08211780841856b66ead13d5e6d1bd6733bb64b7b293b2a48cc55871e006
SHA512

c8387ba6e553d214b7d41f67dcbf8192d7e4d5f8b5e35876c7b5b202274f639cdeb18ac9a6faf18f709fadb7f60afe8846f5b40e5f0cff3ccfe0fbc11ea103cd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2068	1816	cmd.exe	29
PID 1816 wrote to memory of 2068	1816	cmd.exe	29
PID 1816 wrote to memory of 2068	1816	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\certificate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\system32\certutil.exe
  certutil -addstore -f "ROOT" "C:\Users\Admin\.mitmproxy\mitmproxy-ca-cert.cer"
  2⤵
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads