Working through the IoC, I see these lines
copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe
Why append a random number to a copy of certutil.exe other than to change the file signature?
1 karma · joined May 24, 2021
copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe
Why append a random number to a copy of certutil.exe other than to change the file signature?