mimikatz | 32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471 | Triage

Resubmissions

26-08-2024 09:41

240826-ln48csyerj 10

29-01-2022 07:52

220129-jqhe9sgcg5 10

Sharing

General

Target

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
Size

1.8MB
Sample

240826-ln48csyerj
MD5

59c3f3f99f44029de81293b1e7c37ed2
SHA1

fb07496900468529719f07ed4b7432ece97a8d3d
SHA256

32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
SHA512

9b3bd8a76d754bf9c899111be986c4fd6d14f6993a9a0e3dcd9b4a76c0f7764ac8798f5cbc7a0467c1562638d85bf52f627bd32c125f587b1e838beaf03c8a0e
SSDEEP

49152:aIuQjMgjzus3wLNlDXjUoXFhKoT2iG6xQQqOeaGcWRrLy3pN+:a1bgjyQwhlDFEi5Qt7aGdRrLy5N

Score

10^/10

mimikatz credential_access defense_evasion discovery evasion execution impact ransomware spyware stealer

Malware Config

Targets

- Target
  
  32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
- Size
  
  1.8MB
- MD5
  
  59c3f3f99f44029de81293b1e7c37ed2
- SHA1
  
  fb07496900468529719f07ed4b7432ece97a8d3d
- SHA256
  
  32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
- SHA512
  
  9b3bd8a76d754bf9c899111be986c4fd6d14f6993a9a0e3dcd9b4a76c0f7764ac8798f5cbc7a0467c1562638d85bf52f627bd32c125f587b1e838beaf03c8a0e
- SSDEEP
  
  49152:aIuQjMgjzus3wLNlDXjUoXFhKoT2iG6xQQqOeaGcWRrLy3pN+:a1bgjyQwhlDFEi5Qt7aGdRrLy5N
Score

10^/10

mimikatz credential_access defense_evasion discovery evasion execution impact ransomware spyware stealer
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Clears Windows event logs
  evasion ransomware
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- mimikatz is an open source tool to dump credentials on Windows
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

Clear Windows Event Logs

File Deletion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

mimikatzcredential_accessdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

behavioral2

mimikatzcredential_accessdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

behavioral3

mimikatzcredential_accessdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

behavioral4

mimikatzcredential_accessdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer