a122d4080a26c1da986bd0e7202b1630eb661a624915ef244f496fdd306e85fb | Triage

Analysis

max time kernel
837s
max time network
837s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 04:58

Sharing

Report Analysis Logs

General

Target

Cisco_Umbrella_Root_CA.cer
Size

1KB
MD5

963b7b50c6f11c264e30fda42c431ad6
SHA1

8ae3de215566db897f9fd1e72d54a0672bcfe430
SHA256

a122d4080a26c1da986bd0e7202b1630eb661a624915ef244f496fdd306e85fb
SHA512

9682908dc0eacac512cb9d2249350eebab89efd5f50b35fd134a21a66ef0219380edf28a3f309908f405cdbd672292e707b94475133109a2c5678f8f24306bf5

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2096	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\Cisco_Umbrella_Root_CA.cer
1⤵
- Blocklisted process makes network request
- Suspicious behavior: GetForegroundWindowSpam
PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab9F9B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit