3 ms·

Working through the IoC, I see these lines copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe Why append a ra

Working through the IoC, I see these lines copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe Why append a random number to a copy of certutil.exe other than to change the file signature?

jcims 5y ago
Because these aren't big brain operations.
tempfs 5y ago
Because a lot of EDR detections are purely string based and will be closely watching for certutil doing things that attackers like to use it for. Making a copy with a new random name defeats this detection logic.