Overview

overview

10

Static

static

10

Win32/mimidrv.sys

windows7-x64

10

Win32/mimidrv.sys

windows10-2004-x64

10

Win32/mimikatz.exe

windows7-x64

3

Win32/mimikatz.exe

windows10-2004-x64

3

Win32/mimilib.dll

windows7-x64

3

Win32/mimilib.dll

windows10-2004-x64

3

Win32/mimilove.exe

windows7-x64

3

Win32/mimilove.exe

windows10-2004-x64

3

x64/mimidrv.sys

windows7-x64

10

x64/mimidrv.sys

windows10-2004-x64

1

x64/mimikatz.exe

windows7-x64

1

x64/mimikatz.exe

windows10-2004-x64

1

x64/mimilib.dll

windows7-x64

1

x64/mimilib.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53b78fa733ae10dd1f2f066f12523cb3_JaffaCakes118

  • Size

    904KB

  • Sample

    241017-zvpyxazakj

  • MD5

    53b78fa733ae10dd1f2f066f12523cb3

  • SHA1

    ebabab9c5b723df0fde7fe02dc22145e39ba0502

  • SHA256

    d19bf611356d319e792ac04e4bc986aa01c8282d942e9de0ae568b0a7d15dc24

  • SHA512

    e95b83e99414159a7ad4bf8bfb3702e0504744b744f157ff4355108e2490b1ccdf9ab0b136197d86f4560a69699d6ec61e8073aa6267b9a750f23096edd54ee4

  • SSDEEP

    24576:Ig2RaZQf/7pQLzMAssYp4iubjlM6rlzd5oQ/mxhG:cRaWYui26rhdyQ/mq

Score
10/10
mimikatzdiscovery

Malware Config

Targets

    • Target

      Win32/mimidrv.sys

    • Size

      28KB

    • MD5

      ba54a0dbe2685e66e21d41b4529b3528

    • SHA1

      87e20486e804bfff393cc9ad9659858e130402a2

    • SHA256

      9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392

    • SHA512

      1fbdb7c38fa7a4268fe4844a6a4ba9881566766c931c2bca8f200b0f8b8d09e1d3c61c56e9335b83f9a27319e23f2a008940ca0e2bba78183009069cdccc4902

    • SSDEEP

      768:EiHyA4sZMyyJ5+zfZ+B8OluPWVHkisAxA:EeyArM3Jk7MB8OlFJkis3

    Score
    10/10
    mimikatz

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    behavioral1behavioral2

    • Target

      Win32/mimikatz.exe

    • Size

      795KB

    • MD5

      f57703b4f9ce1737d2e75d20c6dd0e87

    • SHA1

      33e56cdffca84fc0672ad6f693cb0fbb5984cfd2

    • SHA256

      e22d2de1817f68ee65c30f187ac916bd7ce658fc2617f77e92f618d66db85156

    • SHA512

      5e0f13982897bf91cb7e93481af7f5bfce3f53d505208ff1c88cd3cf0e6660e295eb196f5f35520baccd075fedf696fa86e10fb854936a781d684c5299f80f98

    • SSDEEP

      24576:sQ8SUEJb0QL/KyeAlhUt0H9wSa2iIOtFHD:62bN/KyeaUgwz2ijV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Win32/mimilib.dll

    • Size

      40KB

    • MD5

      97d95fa767c62e3dd17fb883b6a1d5dc

    • SHA1

      c271396203b94c99f6578fc42179716fbcf54bbd

    • SHA256

      0f60f322e16e2deb759f729232b0578a640af23b9327a4327d45b8ceb85022e8

    • SHA512

      1007160b0c917e3a2af27c2da428605a4edb572674e602c7d11aeddabfaf91e33d05903750c4b6313b94acd749b2776b759d3f83b5288391e939ad6647784a73

    • SSDEEP

      768:IhUZHYTw3R3Zeu1b5Oib7Zs3sd9hmVejnl0SNhFnGEhMFnesEhi:/nikb55b7S8dfIejnlD3GE8xEY

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Win32/mimilove.exe

    • Size

      35KB

    • MD5

      12dcdf595733dbafc14e7382a527c0bb

    • SHA1

      4fc8e47741f624cc4fe2a2fb684246c139ea1ae4

    • SHA256

      232952c41c452bc8b648cd0abee5a79c6d2a7c3d3a76d55c7af31eb18aee881f

    • SHA512

      cbce100331e04e0bcb5607cf4a96b28756dccb39dcaf4bc635b860343af2568b3563a6934e928a37a5c6bae84c9d017d24999de2b53cbee8072bd0fad271d3fc

    • SSDEEP

      768:quH7PLxh8+AJtxF0jBuD24aYN2lW9gFqF6VGCxLl/qzFn/EhpFn0MEhV:quHxsreYV9dnCxLlQ/EhnEv

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      x64/mimidrv.sys

    • Size

      35KB

    • MD5

      29e03f4811b64969e48a99300978f58c

    • SHA1

      a8ddb7565b61bc021cd2543a137e00627f999dcc

    • SHA256

      200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a

    • SHA512

      e4dde30edbca37fe8843b6f3d15d696dc2964bf2a980bda34591a7215e22aeaba8f29d6623efa357a01928ffeec53d9b9e48054fa86db6f6e63dd64540fbcacd

    • SSDEEP

      768:4i4mpA/ZBEAKaCTC/dBM8ipSeJvl1qlCGB8OluQ1WVHkisR:ImaEAKEqjJlQlHB8OlhkJkisR

    Score
    10/10
    mimikatz

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    behavioral10behavioral9

    • Target

      x64/mimikatz.exe

    • Size

      990KB

    • MD5

      80f421c5fd5b28fc05b485de4f7896a1

    • SHA1

      5e8001b0afcefa801da2398bea6cd539dc22dd57

    • SHA256

      df6a740b0589dbd058227d3fcab1f1a847b4aa73feab9a2c157af31d95e0356f

    • SHA512

      af968a350b8f9343876c00c76e2db217b0e79b72d994c0324deb9f2ed2a65e24529b5a13d8ff1ba3f0e989343b72ce96ad9d0c9d1637da43132ee1dd6822853a

    • SSDEEP

      12288:3nq33ZIUFFPRCrNcfk1u1pN9NJOSl5IYTbZkusjksUc8wdj/R58ZQl1:3nqnZIMFpCr2PrZ5IYTbZkpkMz/R5Wo

    Score
    1/10
    behavioral11behavioral12

    • Target

      x64/mimilib.dll

    • Size

      45KB

    • MD5

      ab9bb7c4b0f50907f5b30e4b1a9d9be1

    • SHA1

      a313253944882ba9c1f8229699f38c750817eb45

    • SHA256

      f6f57fc82399ef3759dcbc16b7a25343dea0b539332dacdf0ed289cc82e900db

    • SHA512

      07e42b589d9e53fcd6353dc1c6fff0727cfc457ebee20596ee18b37d55404738a5000756e97e668bbee5f75a9d337a2e9dfc0fd1e9e1fb90e78a64d5d0883505

    • SSDEEP

      768:leZJr1okqSWZc8A5txt24QHEmclhb7snsFY3+Crf0zlejnl0DQFnzEhzFn2+Eh+:I/K9Are4Qk/lhbosF11lejnlCKzEzbEM

    Score
    1/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks