Analysis
-
max time kernel
341s -
max time network
403s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
29/06/2023, 19:32
General
-
Target
mimikatz_trunk.zip
-
Size
1.2MB
-
MD5
d2d3e1f8023b12fb89e400c7e8ecd7db
-
SHA1
4112ef95386ea4d1131be7c600d49a310e9d8f5b
-
SHA256
7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5
-
SHA512
6b20caba114996bf268d2dc5e857624f7ebad0c580c8054cfc53c5d9af6c7bf56a91f2a68e9a03101e8599c4e1ddd94ad2d37e38d92243d4c2b89370cfee80ad
-
SSDEEP
24576:YH9iKnN1lvn928lSnigsGXLwVOoEP2qMkKDYLUPMzahK:+X5vn9HlSigsGbwVOoAlRaYLUUr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\mimikatz_trunk\" -spe -an -ai#7zMap29175:86:7zEvent310151⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\mimikatz_trunk\x64\mimikatz.exe"C:\Users\Admin\Desktop\mimikatz_trunk\x64\mimikatz.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD529efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA25661c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
SHA512f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
-
Filesize
1.3MB
MD529efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA25661c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
SHA512f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3