mimikatz | 5a0a28641cd0c4483a8190d8327cdea9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
5a0a28641cd0c4483a8190d8327cdea9_JaffaCakes118
Size 1.1MB
Sample240729-xpn4bavdlm
SHA256 f20d41dcaed4031a076389770f9e917686016ba70f81131dc330586e8e1e1a48
MD5 5a0a28641cd0c4483a8190d8327cdea9
SHA1 738c682353513fd69ecd337f05bc991e4cafe1a1
SHA512 e6fba47344281e43955b411f770cea842573da1465313db403a283ae24d3b9ebf0996a9a47d961f7126e29e675da95dd0020d336c13afb4d83d65751e830eb16
SSDEEP 12288:rCg1g4Gk+wq91vw4viqm5nUXhvYZ4CqkEl+I0rgZ33hfzszUndVCKqcvqTwV:rTgUik4viqOUXhgLqp+I0sZBbckfCI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a0a28641cd0c4483a8190d8327cdea9_JaffaCakes118

File Explorer

5a0a28641cd0c4483a8190d8327cdea9_JaffaCakes118

.dll 1.1MB

5a0a28641cd0c4483a8190d8327cdea9_JaffaCakes118

IMPHASH 6b56153664d829f70fd040a23ed75713
SHA256 f20d41dcaed4031a076389770f9e917686016ba70f81131dc330586e8e1e1a48
MD5 5a0a28641cd0c4483a8190d8327cdea9
SHA1 738c682353513fd69ecd337f05bc991e4cafe1a1
SHA512 e6fba47344281e43955b411f770cea842573da1465313db403a283ae24d3b9ebf0996a9a47d961f7126e29e675da95dd0020d336c13afb4d83d65751e830eb16
SSDEEP 12288:rCg1g4Gk+wq91vw4viqm5nUXhvYZ4CqkEl+I0rgZ33hfzszUndVCKqcvqTwV:rTgUik4viqOUXhgLqp+I0sZBbckfCI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

614456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ncrypt

BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptGetProperty NCryptExportKey NCryptImportKey NCryptSetProperty NCryptGetProperty NCryptOpenKey NCryptFreeBuffer NCryptEnumKeys BCryptEnumRegisteredProviders NCryptOpenStorageProvider BCryptFreeBuffer BCryptDestroyKey BCryptImportKeyPair BCryptExportKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider NCryptFreeObject

fltlib

FilterFindNext FilterFindFirst

cabinet

ord14 ord13 ord11 ord10

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winscard

SCardListCardsW SCardControl SCardGetAttrib SCardConnectW SCardFreeMemory SCardGetCardTypeProviderNameW SCardEstablishContext SCardReleaseContext SCardListReadersW SCardTransmit SCardDisconnect

advapi32

CryptGetKeyParam QueryServiceObjectSecurity OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle FreeSid AllocateAndInitializeSid RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW CreateProcessWithLogonW CreateWellKnownSid CopySid CryptDuplicateKey CryptEncrypt CryptSetHashParam CryptAcquireContextA CredIsMarshaledCredentialW CredUnmarshalCredentialW SystemFunction025 SystemFunction024 ConvertStringSecurityDescriptorToSecurityDescriptorW CredFree CredEnumerateW RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeNameW OpenThreadToken StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW CreateProcessAsUserW OpenProcessToken LookupPrivilegeValueW LsaQuerySecret LsaOpenSecret CheckTokenMembership LookupAccountNameW LookupAccountSidW IsTextUnicode BuildSecurityDescriptorW StartServiceW SetServiceObjectSecurity CryptAcquireContextW CryptReleaseContext CryptGenKey CryptDestroyKey CryptSetKeyParam CryptSetProvParam CryptGetProvParam CryptEnumProvidersW ConvertSidToStringSidW ConvertStringSidToSidW LsaFreeMemory IsValidSid GetSidSubAuthority GetSidSubAuthorityCount CryptDecrypt SetThreadToken GetTokenInformation DuplicateTokenEx QueryServiceStatusEx CryptGetUserKey CryptExportKey CryptImportKey CryptEnumProviderTypesW SystemFunction006 SystemFunction007 ClearEventLogW GetNumberOfEventLogRecords OpenEventLogW GetLengthSid CryptDeriveKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashW LsaClose LsaOpenPolicy LsaQueryInformationPolicy LsaQueryTrustedDomainInfoByName LsaEnumerateTrustedDomainsEx LsaRetrievePrivateData SystemFunction001 SystemFunction005 SystemFunction013 SystemFunction032 A_SHAUpdate A_SHAFinal A_SHAInit

crypt32

CryptEncodeObject CertOpenStore CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CryptSignAndEncodeCertificate CryptStringToBinaryW CryptUnprotectData PFXExportCertStoreEx CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertGetNameStringW CertEnumSystemStore CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertAddCertificateContextToStore CryptBinaryToStringW CertEnumCertificatesInStore CryptProtectData

cryptdll

CDGenerateRandomBits MD5Final MD5Update MD5Init CDLocateCheckSum CDLocateCSystem

dnsapi

DnsQuery_A DnsFree

netapi32

NetRemoteTOD DsEnumerateDomainTrustsW NetApiBufferFree NetSessionEnum NetWkstaUserEnum NetShareEnum NetStatisticsGet DsGetDcNameW NetServerGetInfo I_NetServerTrustPasswordsGet I_NetServerAuthenticate2 I_NetServerReqChallenge

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantInit

rpcrt4

MesEncodeIncrementalHandleCreate RpcBindingFree RpcBindingToStringBindingW RpcBindingVectorFree RpcStringFreeW RpcServerInqBindings RpcServerListen RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcServerUseProtseqEpW RpcMgmtStopServerListening RpcEpResolveBinding RpcServerRegisterAuthInfoW RpcEpRegisterW RpcEpUnregister RpcMgmtEpEltInqBegin RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW UuidCreate I_RpcGetCurrentCallHandle I_RpcBindingInqSecurityContext RpcBindingSetOption RpcBindingFromStringBindingW RpcStringBindingComposeW RpcImpersonateClient RpcRevertToSelf RpcBindingInqAuthClientW NdrMesTypeFree2 RpcMgmtWaitServerListen UuidToStringW NdrServerCall2 NdrClientCall2 NdrMesTypeEncode2 NdrMesTypeAlignSize2 MesHandleFree MesIncrementalHandleReset MesDecodeIncrementalHandleCreate RpcBindingSetAuthInfoExW NdrMesTypeDecode2

shlwapi

PathCombineW PathIsDirectoryW PathFindFileNameW PathCanonicalizeW PathIsRelativeW

samlib

SamLookupNamesInDomain SamEnumerateUsersInDomain SamiChangePasswordUser SamSetInformationUser SamQueryInformationUser SamOpenUser SamOpenDomain SamLookupDomainInSamServer SamEnumerateDomainsInSamServer SamConnect SamCloseHandle SamFreeMemory SamOpenGroup SamOpenAlias SamGetGroupsForUser SamGetAliasMembership SamGetMembersInGroup SamGetMembersInAlias SamEnumerateGroupsInDomain SamEnumerateAliasesInDomain SamRidToSid SamLookupIdsInDomain

secur32

InitializeSecurityContextW DeleteSecurityContext FreeContextBuffer EnumerateSecurityPackagesW QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleW LsaFreeReturnBuffer LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaLookupAuthenticationPackage

shell32

CommandLineToArgvW

user32

PostMessageW DefWindowProcW UnregisterClassW SendMessageW CreateWindowExW DestroyWindow OpenClipboard CloseClipboard GetClipboardSequenceNumber SetClipboardViewer ChangeClipboardChain GetClipboardData EnumClipboardFormats GetUserObjectInformationW IsCharAlphaNumericW DispatchMessageW GetMessageW GetKeyboardLayout RegisterClassExW TranslateMessage

hid

HidD_GetHidGuid HidP_GetCaps HidD_GetAttributes HidD_GetPreparsedData HidD_FreePreparsedData HidD_SetFeature HidD_GetFeature

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList

wldap32

ord79 ord54 ord301 ord304 ord309 ord310 ord13 ord208 ord41 ord26 ord27 ord36 ord127 ord167 ord142 ord14 ord133 ord147 ord157 ord145 ord88 ord12 ord73 ord203 ord69 ord113 ord140 ord139 ord97 ord96 ord77 ord224 ord223 ord122

ntdll

NtCompareTokens RtlCreateUserThread RtlGetCurrentPeb NtQueryInformationProcess RtlDecompressBuffer RtlCompressBuffer RtlGetCompressionWorkSpaceSize RtlDowncaseUnicodeString RtlFreeAnsiString RtlUnicodeStringToAnsiString NtQuerySystemInformation NtQueryObject RtlIpv6AddressToStringW RtlIpv4AddressToStringW NtEnumerateSystemEnvironmentValuesEx NtSetSystemEnvironmentValueEx NtQuerySystemEnvironmentValueEx NtTerminateProcess NtSuspendProcess RtlAdjustPrivilege NtResumeProcess RtlStringFromGUID RtlFreeUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString RtlEqualUnicodeString RtlGetNtVersionNumbers RtlEqualString RtlGUIDFromString RtlInitUnicodeString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString

msasn1

ASN1_CreateModule ASN1BERDotVal2Eoid ASN1_CloseModule ASN1_CreateEncoder ASN1BEREoid2DotVal ASN1_CreateDecoder ASN1_CloseDecoder ASN1_FreeEncoded ASN1_CloseEncoder ASN1Free

winsta

WinStationConnectW WinStationFreeMemory WinStationEnumerateW WinStationQueryInformationW WinStationOpenServerW WinStationCloseServer

kernel32

GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo GetModuleFileNameW GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW LoadLibraryExW GetConsoleCP GetConsoleMode GetFileType GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA GetModuleHandleExW ExitProcess DecodePointer EncodePointer RtlUnwindEx CreateEventW SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateProcessW CreatePipe SetHandleInformation ReadFile TryEnterCriticalSection GetFullPathNameW GetFullPathNameA HeapReAlloc WaitForSingleObject SystemTimeToFileTime SetConsoleCtrlHandler GetModuleHandleW GlobalSize SetLastError Sleep CreateThread CreateFileW LoadLibraryW lstrlenA GetProcAddress FreeLibrary GetSystemTimeAsFileTime GetLastError CloseHandle GetCurrentProcessId OpenProcess AllocConsole lstrlenW RaiseException LocalFree LocalAlloc GetTimeZoneInformation GetSystemDirectoryW SetCurrentDirectoryW FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetConsoleCursorPosition GetCurrentProcess GetCurrentThread GetStdHandle ProcessIdToSessionId GetComputerNameW GetProcessId FileTimeToSystemTime TerminateThread WriteFile GetFileInformationByHandle SetFilePointer FileTimeToLocalFileTime FileTimeToDosDateTime GetTempPathA GetTempFileNameA GetCurrentDirectoryA CreateFileA DeleteFileA GetFileSizeEx FlushFileBuffers FindClose ExpandEnvironmentStringsW GetCurrentDirectoryW GetFileAttributesW FindFirstFileW FindNextFileW DuplicateHandle DeviceIoControl VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualAllocEx VirtualFreeEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory MapViewOfFile UnmapViewOfFile CreateFileMappingW GetComputerNameExW ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState GetNamedPipeInfo CreateNamedPipeW WaitNamedPipeW CreateRemoteThread ClearCommError PurgeComm WideCharToMultiByte GetTimeFormatW GetDateFormatW AreFileApisANSI GetSystemTime DeleteFileW GetVersionExA OutputDebugStringA GetFileAttributesExW GetSystemInfo GetDiskFreeSpaceA CreateFileMappingA GetDiskFreeSpaceW LockFileEx HeapSize GetTempPathW MultiByteToWideChar HeapValidate HeapCreate GetFileAttributesA HeapDestroy GetVersionExW FormatMessageW FormatMessageA GetProcessHeap UnlockFileEx GetTickCount OutputDebugStringW WaitForSingleObjectEx CompareStringW LCMapStringW SetFilePointerEx SetStdHandle WriteConsoleW ReadConsoleW SetEnvironmentVariableA LockFile FlushViewOfFile UnlockFile HeapFree QueryPerformanceCounter GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc