mimikatz | c29ebe42dfe7703c905f775263c5c1f2668e5c36d1ceabf4544851b1c877636c

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 22:40

Target

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
Size

922KB
MD5

ff6b0583b45f418445c054c054953e22
SHA1

dd63264875a0f5f9255bb5c0d1d1e20d6aaff282
SHA256

c29ebe42dfe7703c905f775263c5c1f2668e5c36d1ceabf4544851b1c877636c
SHA512

8a512b4000dfe6b7657e1f5bb521ecf8fd40e1c7b7cfdadb84ba927044d82fa1d97db0b97461be00b96cc8077d1814f95e25b38b503ace8bda8ee15008362609
SSDEEP

24576:6D2RhZw5fO1EuBKMpoEh7mdZfvghR6sAStxvwsK61FSQ7OCDhzkhc9t:ELW25M1h7oBvmRzj4rMOCOhA

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/856-5-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/856-6-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/856-9-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz
behavioral2/memory/856-4-0x0000000140000000-0x00000001400D1000-memory.dmp	mimikatz

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe

description	pid	Process	procid_target
PID 724 set thread context of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe

description	pid	Process	procid_target
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82
PID 724 wrote to memory of 856	724	ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ff6b0583b45f418445c054c054953e22_JaffaCakes118.exe"
  2⤵
  PID:856

memory/724-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/856-5-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/856-6-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/856-9-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download
memory/856-4-0x0000000140000000-0x00000001400D1000-memory.dmp

Filesize
836KB

Download