diff --git a/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py b/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py index 33fec20..541ae57 100644 --- a/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py +++ b/libs/file_enrichment_modules/file_enrichment_modules/lsass_dump/analyzer.py @@ -12,7 +12,7 @@ from common.state_helpers import get_file_enriched from common.storage import StorageMinio from dapr.clients import DaprClient from file_enrichment_modules.module_loader import EnrichmentModule -from nemesis_dpapi import DpapiManager, MasterKey +from nemesis_dpapi import DpapiManager, MasterKey, UserAccountType from pypykatz.pypykatz import pypykatz if TYPE_CHECKING: @@ -241,6 +241,7 @@ class LsassDumpParser(EnrichmentModule): mk = MasterKey( guid=UUID(str(cred.key_guid)), + user_account_type=UserAccountType.UNKNOWN, plaintext_key=masterkey_bytes, plaintext_key_sha1=sha1_masterkey_bytes, ) diff --git a/projects/file_enrichment/file_enrichment/routes/dpapi.py b/projects/file_enrichment/file_enrichment/routes/dpapi.py index 3e76b96..18fd1a9 100644 --- a/projects/file_enrichment/file_enrichment/routes/dpapi.py +++ b/projects/file_enrichment/file_enrichment/routes/dpapi.py @@ -31,6 +31,7 @@ from nemesis_dpapi import ( Password, Pbkdf2Hash, Sha1Hash, + UserAccountType, ) from nemesis_dpapi.eventing import ( DpapiEvent, @@ -245,6 +246,7 @@ async def _handle_master_key_guid_pairs(dpapi_manager: DpapiManager, request: Ma masterkey = MasterKey( guid=masterkey_guid, + user_account_type=UserAccountType.UNKNOWN, plaintext_key=masterkey_data, plaintext_key_sha1=SHA1.new(masterkey_data).digest(), )