Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
63bdd507534329eb84869285a2da2510_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63bdd507534329eb84869285a2da2510_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Target
63bdd507534329eb84869285a2da2510_JaffaCakes118
Size
179KB
MD5
63bdd507534329eb84869285a2da2510
SHA1
99a7fc73f8c978b36873f388a204b16181812c6f
SHA256
fc0e7a7dc086bca2cdab7f8b2a033806b291a94cc118e981b457c8c91aaa6fe7
SHA512
b8fd819b11516423381ff5bb5aa11abee64d6c7f57426c3a46abf437999e32f5ad877f18c94a308b2cb4fbc3f7488ea52df1801cddb9f6930875d7d2a4ddf775
SSDEEP
3072:TjDhbzXu0G3ZEr5mMENvIKb4ya77X+fHB+HVgHta:lzXuN1vhs+5Na
Processes:
resource | yara_rule |
---|---|
sample | mimikatz |
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\Builds\33\CADev\DNACredDetection-Main\Sources\bin\DNACredDetection\DNACredDetection_x86.pdb
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
IsTextUnicode
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SystemFunction032
LsaFreeMemory
CryptEnumProvidersW
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
SystemFunction025
OpenThreadToken
SetThreadToken
DuplicateTokenEx
CheckTokenMembership
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptBinaryToStringW
CryptExportPublicKeyInfo
CryptAcquireCertificatePrivateKey
CertGetNameStringW
CertAddCertificateContextToStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptSignAndEncodeCertificate
CertEnumSystemStore
CryptEncodeObject
MD5Final
MD5Update
MD5Init
CDGenerateRandomBits
UuidCreate
MesEncodeIncrementalHandleCreate
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
PathFindFileNameW
PathIsDirectoryW
wsprintfW
IsCharAlphaNumericW
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardConnectW
SCardListReadersW
SCardDisconnect
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
NtQueryObject
RtlEqualUnicodeString
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlStringFromGUID
RtlGetNtVersionNumbers
RtlUpcaseUnicodeString
RtlAdjustPrivilege
RtlEqualString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlDowncaseUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ReadConsoleW
HeapSize
OutputDebugStringW
WriteConsoleW
LoadLibraryExW
HeapReAlloc
HeapAlloc
LCMapStringW
SetFilePointerEx
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameW
GetStringTypeW
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetFileType
SetStdHandle
RtlUnwind
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitProcess
DeleteCriticalSection
MultiByteToWideChar
GetCurrentThreadId
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
DecodePointer
EncodePointer
IsDebuggerPresent
GetCommandLineW
HeapFree
LeaveCriticalSection
EnterCriticalSection
IsWow64Process
GetCurrentProcessId
GetCurrentThread
GetProcAddress
LoadLibraryW
FreeLibrary
FileTimeToLocalFileTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
SetLastError
FileTimeToSystemTime
LocalAlloc
LocalFree
GetLastError
FindFirstFileW
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetFileSizeEx
FindClose
FindNextFileW
CloseHandle
GetCurrentProcess
OpenProcess
DuplicateHandle
DeviceIoControl
SetFilePointer
VirtualQuery
VirtualQueryEx
ReadProcessMemory
VirtualProtectEx
VirtualProtect
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ