Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 25, 2023, 5:47 p.m.	April 25, 2023, 5:56 p.m.

Size	1.3MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`29efd64dd3c7fe1e2b022b7ad73a1ba5`
SHA256	`61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1`
CRC32	`6FF0C738`
ssdeep	`24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsPE64 - (no description) Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware

mimikatz.exe "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
2076

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (50 out of 184 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: k console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: t console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: z console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: x console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: S console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: p console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: V console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: o console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: u console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: r console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: o console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: o console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: B console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: j console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: D console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: E console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: P console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: Y console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: g console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: t console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: l console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: k console_handle: 0x000000000000000f	1	1
WriteConsoleW April 25, 2023, 5:47 p.m.	buffer: i console_handle: 0x000000000000000f	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 25, 2023, 5:47 p.m.		1	1	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	Windows.Hacktool.Mimikatz
Cynet	Malicious (score: 100)
CAT-QuickHeal	HackTool.Mimikatz.S13719268
McAfee	HTool-MimiKatz!29EFD64DD3C7
Cylance	unsafe
Zillya	Tool.Mimikatz.Win64.2782
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Hacktool ( 0043c1591 )
Alibaba	HackTool:Win32/Mimikatz.e9982ec9
K7GW	Hacktool ( 0043c1591 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D3F1A378
Cyren	W64/S-b61adc75!Eldorado
Symantec	Hacktool.Mimikatz
ESET-NOD32	a variant of Win64/Riskware.Mimikatz.G
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Mimikatz-9778171-1
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.66167672
NANO-Antivirus	Trojan.Win64.Mimikatz.jsrqig
SUPERAntiSpyware	Hack.Tool/Gen-Mimikatz
MicroWorld-eScan	Trojan.GenericKD.66167672
Avast	Win64:HacktoolX-gen [Trj]
Tencent	Trojan.Win64.Mimikatz.a
Sophos	ATK/Apteryx-Gen
F-Secure	Heuristic.HEUR/AGEN.1321016
DrWeb	Tool.Mimikatz.1232
VIPRE	Trojan.GenericKD.66167672
TrendMicro	HKTL_MIMIKATZ64
McAfee-GW-Edition	BehavesLike.Win64.HToolMimiKatz.th
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.29efd64dd3c7fe1e
Emsisoft	Trojan.GenericKD.66167672 (B)
Ikarus	HackTool.Mimikatz
Jiangmin	Trojan.PSW.Mimikatz.pv
Webroot	W32.Hacktool.Gen
Avira	HEUR/AGEN.1321016
MAX	malware (ai score=86)
Antiy-AVL	RiskWare/Win64.Mimikatz
Gridinsoft	Risk.Win64.Gen.dd!i
Xcitium	Malware@#2e2m06ht3u8w
Microsoft	HackTool:Win32/Mimikatz.D
ViRobot	HackTool.S.Mimikatz.1355264
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win64.Trojan-Stealer.Mimikatz.J
Google	Detected
AhnLab-V3	Trojan/Win32.RL_Mimikatz.R366782
Acronis	suspicious

mimikatz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All