mimikatz | 4e6a08a2b3a23998fc83712a5740decd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4e6a08a2b3a23998fc83712a5740decd_JaffaCakes118
Size 368KB
Sample240517-e2t6zshc4w
SHA256 2cbc73ff56efc9e7e099629910cbb01da6716616e0d34428d6a42661a68c1998
MD5 4e6a08a2b3a23998fc83712a5740decd
SHA1 32c25c6199a751502713a459c372e52719f87f42
SHA512 be0924269838d3148d034504d245e44fbc8679ddd2499a2423a8e0684c4249a0c9b7ba352e280fc8466c4f4556abd69a2bbffad71c0a74738939ee33e8cf1f67
SSDEEP 6144:330dM4XbZn8Sp6tnizFXxplUrX8ISCKl42TMAiuW3Cp3Bkt5c5H9R7iEWLX5Nc:H0dM4LZCizFXxkTK7THiuWOk3IzeEWtu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
static1/unpack001/mimikatz.exe	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mimikatz.exe

File Explorer

4e6a08a2b3a23998fc83712a5740decd_JaffaCakes118

.zip 368KB
mimikatz.exe

.exe 791KB

4e6a08a2b3a23998fc83712a5740decd_JaffaCakes118

SHA256 2cbc73ff56efc9e7e099629910cbb01da6716616e0d34428d6a42661a68c1998
MD5 4e6a08a2b3a23998fc83712a5740decd
SHA1 32c25c6199a751502713a459c372e52719f87f42
SHA512 be0924269838d3148d034504d245e44fbc8679ddd2499a2423a8e0684c4249a0c9b7ba352e280fc8466c4f4556abd69a2bbffad71c0a74738939ee33e8cf1f67
SSDEEP 6144:330dM4XbZn8Sp6tnizFXxplUrX8ISCKl42TMAiuW3Cp3Bkt5c5H9R7iEWLX5Nc:H0dM4LZCizFXxkTK7THiuWOk3IzeEWtu
MD5 SHA1 SHA512 SSDEEP

mimikatz.exe

IMPHASH c009c9b5ca126651adae86bcc3398b7d
SHA256 eac8cf9a8ba23c110100239ec00cad9e7466913568ca0dbcf363cf4715f87669
MD5 785f9560ef5cab7ab2a86c91bd06ee99
SHA1 500dc91c4e33cb2e3af241eb6f4c9bc3f2641d5e
SHA512 b00cbe5d9eab6274c5a9629e7c3c7aa97b5b3929a19244e42ba3f973f16d8f0a0ac84ee99d1f7a2e2025858217c2f76ab2774b2e009d7732eae10371012d71ec
SSDEEP 12288:FPIWyohZ0jlex0y4JDXio13EwmqQRB3rMBjLO0f:9NyohOjcIDXYw+fbUi0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

475336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership ConvertStringSidToSidW LsaFreeMemory CryptSetProvParam CryptEnumProvidersW CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 SystemFunction005 LsaQueryTrustedDomainInfoByName SystemFunction025 LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW IsValidSid LookupPrivilegeNameW OpenThreadToken SetThreadToken CredFree CredEnumerateW GetSidSubAuthority GetSidSubAuthorityCount A_SHAUpdate A_SHAInit A_SHAFinal

crypt32

CertGetNameStringW CryptEncodeObject CertEnumSystemStore CryptSignAndEncodeCertificate CertEnumCertificatesInStore CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryW CryptProtectData CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertGetCertificateContextProperty CertAddCertificateContextToStore CertFindCertificateInStore

cryptdll

MD5Init MD5Update MD5Final CDGenerateRandomBits CDLocateCSystem CDLocateCheckSum

fltlib

FilterFindFirst FilterFindNext

netapi32

NetStatisticsGet DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetServerGetInfo NetShareEnum NetWkstaUserEnum I_NetServerTrustPasswordsGet I_NetServerAuthenticate2 I_NetServerReqChallenge

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysAllocString VariantInit SysFreeString

rpcrt4

RpcServerUseProtseqEpW RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 I_RpcBindingInqSecurityContext NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcServerUnregisterIfEx RpcMgmtEpEltInqDone RpcServerInqBindings RpcServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree RpcMgmtEpEltInqNextW RpcEpUnregister RpcMgmtEpEltInqBegin

shlwapi

PathFindFileNameW PathCanonicalizeW PathCombineW PathIsDirectoryW PathIsRelativeW

samlib

SamEnumerateAliasesInDomain SamOpenDomain SamConnect SamSetInformationUser SamiChangePasswordUser SamEnumerateGroupsInDomain SamGetGroupsForUser SamGetMembersInGroup SamRidToSid SamGetMembersInAlias SamGetAliasMembership SamOpenGroup SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamOpenAlias SamLookupIdsInDomain

secur32

FreeContextBuffer LsaLookupAuthenticationPackage LsaFreeReturnBuffer LsaDeregisterLogonProcess LsaCallAuthenticationPackage QueryContextAttributesW LsaConnectUntrusted

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW GetKeyboardLayout

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_FreePreparsedData HidP_GetCaps HidD_GetAttributes HidD_GetHidGuid HidD_GetPreparsedData

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList

winscard

SCardGetCardTypeProviderNameW SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardConnectW SCardListReadersW SCardDisconnect SCardReleaseContext SCardListCardsW

winsta

WinStationQueryInformationW WinStationConnectW WinStationFreeMemory WinStationOpenServerW WinStationEnumerateW WinStationCloseServer

wldap32

ord145 ord208 ord167 ord36 ord79 ord157 ord41 ord127 ord73 ord26 ord310 ord54 ord309 ord304 ord147 ord13 ord27 ord77 ord301 ord142 ord133

msasn1

ASN1_CloseEncoder ASN1_CreateModule ASN1BERDotVal2Eoid ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseDecoder ASN1_CreateEncoder ASN1_CloseModule

ntdll

towupper wcstol wcstoul memmove wcsstr _wcsnicmp strtoul wcschr wcsrchr _stricmp _vscwprintf _wcsicmp strrchr RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlEqualString RtlFreeUnicodeString RtlDowncaseUnicodeString RtlFreeAnsiString RtlUnicodeStringToAnsiString memcmp __chkstk

kernel32

HeapValidate HeapCreate GetFileAttributesA LeaveCriticalSection HeapDestroy GetVersionExW FormatMessageW InitializeCriticalSection FormatMessageA GetProcessHeap GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess UnlockFileEx GetTickCount OutputDebugStringW WaitForSingleObjectEx LockFile FlushViewOfFile UnlockFile HeapFree QueryPerformanceCounter HeapAlloc SetEndOfFile TryEnterCriticalSection HeapCompact CreateMutexW GetFileSize HeapReAlloc GetFullPathNameA GetFullPathNameW GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW lstrlenW CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW DeleteFileA GetTempPathA FileTimeToLocalFileTime SetFilePointer CreateFileA CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile TerminateThread WriteFile CreateFileMappingA FileTimeToSystemTime Sleep VirtualProtect GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess RaiseException MultiByteToWideChar GetTempPathW HeapSize EnterCriticalSection GetDiskFreeSpaceW LockFileEx SetConsoleCtrlHandler SetConsoleTitleW lstrlenA FreeLibrary LoadLibraryW GetProcAddress GetModuleHandleW SetHandleInformation CreatePipe SetEvent CreateEventW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetCurrentDirectoryW GetCurrentThread ProcessIdToSessionId GetProcessId LoadLibraryA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

msvcrt

gmtime memcpy ungetc _isatty _write _lseeki64 _read __pioinfo __badioinfo ?terminate@@YAXXZ wcstombs iswctype ferror wctomb _itoa _snprintf localeconv isxdigit isleadbyte __mb_cur_max mbtowc isspace isdigit calloc __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __wgetmainargs __C_specific_handler _errno free _wcsdup vfwprintf fflush _wfopen wprintf _fileno _iob vwprintf _setmode fclose _wpgmptr malloc _msize strftime realloc fgetws memset

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=45, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=561, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=83, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,