1bae55baa2dfe26ecc9b148bc2c9820ce05e0fbbfe907a3a116aa08546fabe6d | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 01:04

Sharing

Report Analysis Logs

General

Target

mimikatz_trunk/x64/mz64.exe
Size

979KB
MD5

297b896dbf8d619c61fd947086fce6e8
SHA1

7cb9486abe2317e735bf2e2ddb58992835ac7556
SHA256

b294f94c469f43a78a324b5cfecbde0afb3aa0256bbde06ca2718b8c038a9324
SHA512

0726206509fae1d29612e04e20a4d2f7c32ef1128eeb861f7e24a4feec62e80ffe27864c5caeb60cf7d7e1dd962eaf535ce76751c3619d8f281c7a2c8e5fac44
SSDEEP

24576:rjEObtgfYpGGQakZ6tXEu3hA+w3552NGQ4wE:3EngmstRhA+wJ5e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2208	mz64.exe
2208	mz64.exe
2208	mz64.exe
2208	mz64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	mz64.exe

C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\x64\mz64.exe
"C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\x64\mz64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads