mimikatz | b5a89b46a5f0acdce50d07bd85a307091c1b3c5bdeb9c39f6f388a259234d920

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:50

Target
92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe
Size 902KB
Sample240603-2sc8faca2s
SHA256 b5a89b46a5f0acdce50d07bd85a307091c1b3c5bdeb9c39f6f388a259234d920
MD5 92e0c3b3febfef64a1a41824dda328ca
SHA1 ff8818aa1e1196aa3e10f763bbcc4a9c8ed7e96c
SHA512 e26ee1694b84533f415ac6aec59c66b245062b4910e1bd3da0ab21c388c29ec1f57cadeeadbb9d45c15093d919e818a1c1e9ca15de619198819141ba889b6377
SSDEEP 24576:rPSvI8SNSAAhCUEDA2xvMZj5Z/0ePFUZ5f3pMXYTaAg9xPLl:DSCjNUEoB//zPFUZ5f3pMXYTaNVh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/5004-4-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/5004-5-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/5004-7-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/5004-6-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90
PID 652 wrote to memory of 5004	652	92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\92e0c3b3febfef64a1a41824dda328ca_JaffaCakes118.exe"
  2⤵
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:640

memory/652-3-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/5004-4-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5004-5-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5004-7-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5004-6-0x0000000140000000-0x00000001400D1000-memory.dmp

Download