A17D.tmp.zip
- SHA256 9e8daa2c3b7978a93f6d8775af42cb56388fb903131f3c535771eae998a5b57c
Password
infected
Behavioral task
behavioral1
Sample
A17D.exe
Resource
win10v2004-20260911-es
windows10-2004-x64
2 signatures
60 seconds
Behavioral task
behavioral2
Sample
A17D.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
2 signatures
60 seconds
General
- Target A17D.tmp.zip
- Size 31KB
- Sample261104-eza1bsysa1
- SHA256 9e8daa2c3b7978a93f6d8775af42cb56388fb903131f3c535771eae998a5b57c
- MD5 61140c93c9cb790c2c7409cfbe2c4d26
- SHA1 5afddd82f2e065573a0414d7db4ac4cfdc56158a
- SHA512 1d00abce323066274f5c4cce421c49eb8762b6284e7062765582b280a06631b96c9e64657a07c887407ceacb9603d5e1b56225305a6af1f1d4359a2aa4c9d352
- SSDEEP 384:zzYtdvmPN+XAHewzu7rjtny+5rKY2hL/Nhnb76WrXyp+z/zhsUsyhr0xDi79O2B:zMCkQFu7tnp5rKvbjrXt/tsUs6nf
- TLSH T164E2E13CE449C7C02F9C9816F919C93EB5B8CE7BFCFB82536C0D0185429E1E5915ABA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule static1/unpack001/A17D.tmp mimikatz - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/A17D.tmp
File Explorer
-
A17D.tmp.zip.zip 31KB
-
A17D.tmp.exe 60KB
A17D.tmp
- IMPHASH f0fbb269ea6eab21b935b8a4de86dd5b
- SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
- MD5 347ac3b6b791054de3e5720a7144a977
- SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
- SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
- SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
- TLSH T1E6536C5A23A441F8E5679231C8B1ED16E7B2B8461370834F02A8C6AB5FB37D19D3C772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
-
Codesign digest Mismatch
File was altered after it was signed.
Password
infected
PE Signature issue
Digest
a4:c3:d5:92:c4:81:5b:2a:58:1e:d0:ff:dd:14:29:70:70:62:a1:05
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 27, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
2
Major OS version
5
Entry point
17724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsTextUnicode
shlwapi
StrChrW
user32
IsCharAlphaNumericW
wsprintfW
ntdll
NtQuerySystemInformation
RtlEqualUnicodeString
RtlGetNtVersionNumbers
RtlGetCurrentPeb
NtQueryInformationProcess
RtlAdjustPrivilege
RtlInitUnicodeString
kernel32
HeapSize
HeapReAlloc
LoadLibraryW
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
MultiByteToWideChar
SetFilePointer
GetModuleHandleW
ReadProcessMemory
GetProcAddress
LocalFree
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CloseHandle
GetCurrentProcess
HeapAlloc
GetProcessHeap
WaitNamedPipeW
Sleep
CreateFileW
FreeLibrary
OpenProcess
GetCommandLineW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DecodePointer
TerminateProcess
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
LCMapStringW
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
774B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=65, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=97, id=1, productName=Unmarked objects,
count=15, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,