mimikatz | c29ebe42dfe7703c905f775263c5c1f2668e5c36d1ceabf4544851b1c877636c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 22:40

Target

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
Size

922KB
MD5

ff6b0583b45f418445c054c054953e22
SHA1

dd63264875a0f5f9255bb5c0d1d1e20d6aaff282
SHA256

c29ebe42dfe7703c905f775263c5c1f2668e5c36d1ceabf4544851b1c877636c
SHA512

8a512b4000dfe6b7657e1f5bb521ecf8fd40e1c7b7cfdadb84ba927044d82fa1d97db0b97461be00b96cc8077d1814f95e25b38b503ace8bda8ee15008362609
SSDEEP

24576:6D2RhZw5fO1EuBKMpoEh7mdZfvghR6sAStxvwsK61FSQ7OCDhzkhc9t:ELW25M1h7oBvmRzj4rMOCOhA

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2108-14-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-29-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-28-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-26-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-22-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-20-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-16-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral1/memory/2108-18-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2524 set thread context of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2108	2524	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe"
  2⤵
  PID:2108

memory/2108-14-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-31-0x0000000140001000-0x0000000140050000-memory.dmp

Filesize
316KB

Download
memory/2108-29-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-28-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-26-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-24-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp

Filesize
4KB

Download
memory/2108-22-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-20-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-16-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-12-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-10-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-8-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-6-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-4-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2108-18-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/2524-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download