53cdc49c7fb83b419c07edb45c544b106aaa37db00e8a37211678af6350a82f1

Analysis

max time kernel
1736s
max time network
1752s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30/06/2024, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Borat/ServerCertificate.p12
Size 1KB
Sample240630-xy39lashle
SHA256 4b0612b2cd5e7ecc456d5c29c89917b8ec881c5f4fd94afe157098ca96308781
MD5 478ee44a47895e687296b9ab34df04c4
SHA1 4b81e94f3d3a99cc01d5c57bd5bec8317f0aca4f
SHA512 28c0635f1e5062fcdef783aceaa8aa53531f18ce66d4aed62a99ec5b31a364e0d0d36fa237d978d75f51a859a7140d31e62aed340eae4aa769e02d1640e30c7b
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\certmgr.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1292	mmc.exe
Token: SeIncBasePriorityPrivilege	1292	mmc.exe
Token: 33	1292	mmc.exe
Token: SeIncBasePriorityPrivilege	1292	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1292	mmc.exe
1292	mmc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1292	1412	rundll32.exe	78
PID 1412 wrote to memory of 1292	1412	rundll32.exe	78

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX C:\Users\Admin\AppData\Local\Temp\Borat\ServerCertificate.p12
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\mmc.exe
  "C:\Windows\System32\mmc.exe" C:\Windows\system32\certmgr.msc /certmgr:FileName="C:\Users\Admin\AppData\Local\Temp\Borat\ServerCertificate.p12"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads