Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 4, 2024, 1:29 p.m.	Aug. 4, 2024, 2:12 p.m.

Size	748.5KB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`482780a54542c89b59b83fc39febe95c`
SHA256	`884fce7b68e6028ec1dedc0936b64588451c5b8568ceb5338f4dc468f1c73e09`
CRC32	`4FC3FF46`
ssdeep	`12288:/o04pWvpwAIj8Jl/kzzLOrUyVG7K3XDu7FEMIohz6N2:/ipWvpLIwuzLGG+3ik`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware

mimikatz.exe "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (50 out of 129 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: k console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: t console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: z console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: x console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: b console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: u console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: l console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: t console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: o console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: p console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: r console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: V console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: A console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: o console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: u console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: r console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: B console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: j console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: a console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: m console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: D console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: E console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: L console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: P console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: Y console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: g console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: e console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: n console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: t console_handle: 0x000000000000000f	1	1
WriteConsoleW Aug. 4, 2024, 1:22 p.m.	buffer: i console_handle: 0x000000000000000f	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 4, 2024, 1:22 p.m.		1	1	0

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Mimikatz.4!c
Elastic	Windows.Hacktool.Mimikatz
Cynet	Malicious (score: 100)
CAT-QuickHeal	HackTool.Mimikatz.S13719268
Skyhigh	HTool-MimiKatz!482780A54542
ALYac	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908
Cylance	Unsafe
VIPRE	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908
Sangfor	Riskware.Win32.Mimikatz.Vrvo
K7AntiVirus	Hacktool ( 0043c1591 )
BitDefender	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908
K7GW	Hacktool ( 0043c1591 )
Cybereason	malicious.54542c
Arcabit	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Riskware.Mimikatz.AA
McAfee	HTool-MimiKatz!482780A54542
Avast	Win64:Malware-gen
ClamAV	Win.Trojan.Agent-6260290-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanPSW:Win64/Mimikatz.88f3129b
NANO-Antivirus	Trojan.Win64.Mimikatz.ensmum
SUPERAntiSpyware	Hack.Tool/Gen-Mimikatz
MicroWorld-eScan	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908
Rising	HackTool.Mimikatz!1.B63A (CLASSIC)
Emsisoft	Generic.Trojan.Mimikatz.Marte.!s!.A.28B97908 (B)
DrWeb	Tool.Mimikatz.68
Zillya	Trojan.Mimikatz.Win32.209
TrendMicro	HKTL_MIMIKATZ64.SMGK
McAfeeD	ti!884FCE7B68E6
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.482780a54542c89b
Sophos	ATK/Apteryx-Gen
Ikarus	HackTool.Mimikatz
Jiangmin	HackTool.Mimikatz.fr
Webroot	W32.Hacktool.Gen
Google	Detected
MAX	malware (ai score=100)
Antiy-AVL	Trojan[PSW]/Win32.Mimikatz
Kingsoft	malware.kb.a.995
Gridinsoft	Risk.Win64.Mimikatz.tr
Xcitium	Malware@#12ayoseu6bn1d
Microsoft	HackTool:Win32/Mimikatz.D
ViRobot	HackTool.Mimikatz.766464
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win64.Trojan-Stealer.Mimikatz.J
Varist	W64/S-b61adc75!Eldorado
AhnLab-V3	Trojan/Win.Mimikatz.R559345
DeepInstinct	MALICIOUS

mimikatz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All