f8fac5b3d38d4d2589c6a4ef9d9c10a89250e84bea37adde055b0426e7b11167 | Triage

Analysis

max time kernel
162s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 19:53

Sharing

Report Analysis Logs

General

Target

certificate.bat
Size

299B
MD5

3db90d509c83f972d6f93470198ddd41
SHA1

418a32669c68c0532fd442d37fab0c91dfa112f7
SHA256

258f08211780841856b66ead13d5e6d1bd6733bb64b7b293b2a48cc55871e006
SHA512

c8387ba6e553d214b7d41f67dcbf8192d7e4d5f8b5e35876c7b5b202274f639cdeb18ac9a6faf18f709fadb7f60afe8846f5b40e5f0cff3ccfe0fbc11ea103cd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3044	3368	cmd.exe	88
PID 3368 wrote to memory of 3044	3368	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\certificate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\certutil.exe
  certutil -addstore -f "ROOT" "C:\Users\Admin\.mitmproxy\mitmproxy-ca-cert.cer"
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads