Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
706c22a98c902a6d006d04cfda47e163.exe
Resource
win7-20231215-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
706c22a98c902a6d006d04cfda47e163.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
706c22a98c902a6d006d04cfda47e163.exe
-
Size
283KB
-
MD5
706c22a98c902a6d006d04cfda47e163
-
SHA1
0dc80ee20cefca3045abcc1342d960b8a3c49e9c
-
SHA256
54151d24cac03c5d6be72f161faa00f794edaca0c090747dfadc91a867dbd7bf
-
SHA512
5f237c32596c16c2cf41c70977c02a86133dc2bb77bf11abd2b9cbb45e3a173a6e4971aefe3b33845c2fc07b29d1b4a52afea96f19fd2308903f8e32bd63234d
-
SSDEEP
3072:Bx6AHjYzaFXg+w17jsgS/jHagQg1dxiEVlV5998K3WQ8fjEXKgZfnhfxu4V5998l:BxzYzaFXi17jWlVG84jqfhdVG84jqfhQ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 706c22a98c902a6d006d04cfda47e163.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 706c22a98c902a6d006d04cfda47e163.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 706c22a98c902a6d006d04cfda47e163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 706c22a98c902a6d006d04cfda47e163.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\SysWOW64\drivers\system32.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe -
Executes dropped EXE 30 IoCs
pid Process 2696 smss.exe 3016 smss.exe 2544 Gaara.exe 2816 smss.exe 2908 Gaara.exe 2152 csrss.exe 1912 smss.exe 1768 Gaara.exe 1956 csrss.exe 2196 Kazekage.exe 2148 smss.exe 2300 Gaara.exe 2452 csrss.exe 2952 Kazekage.exe 2460 system32.exe 1908 smss.exe 840 Gaara.exe 1520 csrss.exe 1800 Kazekage.exe 1504 system32.exe 1584 system32.exe 3048 Kazekage.exe 932 system32.exe 3060 csrss.exe 2500 Kazekage.exe 1748 system32.exe 2972 Gaara.exe 292 csrss.exe 888 Kazekage.exe 2008 system32.exe -
Loads dropped DLL 61 IoCs
pid Process 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2696 smss.exe 2696 smss.exe 3016 smss.exe 2696 smss.exe 2696 smss.exe 2544 Gaara.exe 2544 Gaara.exe 2816 smss.exe 2908 Gaara.exe 2544 Gaara.exe 2544 Gaara.exe 2152 csrss.exe 2152 csrss.exe 1912 smss.exe 2152 csrss.exe 1768 Gaara.exe 1956 csrss.exe 2152 csrss.exe 2152 csrss.exe 2196 Kazekage.exe 2148 smss.exe 2196 Kazekage.exe 2300 Gaara.exe 2196 Kazekage.exe 2452 csrss.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2460 system32.exe 1908 smss.exe 2460 system32.exe 840 Gaara.exe 2460 system32.exe 1520 csrss.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2152 csrss.exe 2152 csrss.exe 2544 Gaara.exe 2544 Gaara.exe 2544 Gaara.exe 2544 Gaara.exe 2696 smss.exe 3060 csrss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2972 Gaara.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 292 csrss.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-1-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 1 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 1 - 2024\\Gaara.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 706c22a98c902a6d006d04cfda47e163.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\V:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\L:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\A:\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\Z:\Desktop.ini Kazekage.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\J: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\N: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\G: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\R: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\T: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\U: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\V: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\J: system32.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\H: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\B: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\Z: 706c22a98c902a6d006d04cfda47e163.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\B: Kazekage.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\R: smss.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\N:\Autorun.inf smss.exe File created \??\P:\Autorun.inf Kazekage.exe File opened for modification \??\T:\Autorun.inf system32.exe File created \??\U:\Autorun.inf system32.exe File created \??\H:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\V:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf smss.exe File opened for modification \??\B:\Autorun.inf system32.exe File opened for modification C:\Autorun.inf system32.exe File opened for modification \??\Y:\Autorun.inf system32.exe File created \??\L:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File created \??\O:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File created \??\T:\Autorun.inf system32.exe File created \??\J:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File opened for modification D:\Autorun.inf Kazekage.exe File created \??\M:\Autorun.inf smss.exe File created \??\K:\Autorun.inf Kazekage.exe File created \??\L:\Autorun.inf Kazekage.exe File created D:\Autorun.inf system32.exe File opened for modification \??\P:\Autorun.inf csrss.exe File opened for modification \??\J:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf Gaara.exe File opened for modification \??\X:\Autorun.inf system32.exe File created \??\B:\Autorun.inf csrss.exe File opened for modification \??\H:\Autorun.inf csrss.exe File opened for modification \??\L:\Autorun.inf csrss.exe File opened for modification \??\T:\Autorun.inf smss.exe File created \??\I:\Autorun.inf system32.exe File opened for modification \??\L:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File created \??\W:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File created \??\M:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File created \??\N:\Autorun.inf csrss.exe File created \??\V:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf Kazekage.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\G:\Autorun.inf csrss.exe File created \??\Q:\Autorun.inf csrss.exe File opened for modification \??\P:\Autorun.inf smss.exe File created \??\V:\Autorun.inf smss.exe File created \??\V:\Autorun.inf Gaara.exe File created \??\H:\Autorun.inf Kazekage.exe File created \??\J:\Autorun.inf Kazekage.exe File opened for modification D:\Autorun.inf system32.exe File created \??\K:\Autorun.inf system32.exe File created \??\X:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\O:\Autorun.inf smss.exe File created \??\I:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf system32.exe File created \??\T:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File created \??\T:\Autorun.inf csrss.exe File created \??\Y:\Autorun.inf csrss.exe File created \??\U:\Autorun.inf smss.exe File created \??\O:\Autorun.inf Kazekage.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\Z:\Autorun.inf 706c22a98c902a6d006d04cfda47e163.exe File opened for modification \??\T:\Autorun.inf csrss.exe File created \??\I:\Autorun.inf smss.exe File opened for modification \??\X:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf Gaara.exe File created \??\Z:\Autorun.inf Gaara.exe File opened for modification \??\A:\Autorun.inf Kazekage.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\ 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\SysWOW64\23-1-2024.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\SysWOW64\23-1-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\ Gaara.exe File created C:\Windows\Fonts\The Kazekage.jpg 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\system\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\system\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\WBEM\msvbvm60.dll 706c22a98c902a6d006d04cfda47e163.exe File created C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Size = "72" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "2" 706c22a98c902a6d006d04cfda47e163.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main csrss.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 706c22a98c902a6d006d04cfda47e163.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 706c22a98c902a6d006d04cfda47e163.exe -
Runs ping.exe 1 TTPs 30 IoCs
pid Process 2604 ping.exe 1544 ping.exe 2500 ping.exe 1220 ping.exe 2948 ping.exe 2960 ping.exe 1436 ping.exe 1764 ping.exe 548 ping.exe 2000 ping.exe 644 ping.exe 1968 ping.exe 2624 ping.exe 2824 ping.exe 1600 ping.exe 2156 ping.exe 1512 ping.exe 572 ping.exe 2564 ping.exe 2596 ping.exe 2560 ping.exe 704 ping.exe 2304 ping.exe 788 ping.exe 1448 ping.exe 1720 ping.exe 1608 ping.exe 2832 ping.exe 2128 ping.exe 1300 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2152 csrss.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2196 Kazekage.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2312 706c22a98c902a6d006d04cfda47e163.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2696 smss.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2460 system32.exe 2544 Gaara.exe 2544 Gaara.exe 2544 Gaara.exe 2544 Gaara.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2312 706c22a98c902a6d006d04cfda47e163.exe 2696 smss.exe 3016 smss.exe 2544 Gaara.exe 2816 smss.exe 2908 Gaara.exe 2152 csrss.exe 1912 smss.exe 1768 Gaara.exe 1956 csrss.exe 2196 Kazekage.exe 2148 smss.exe 2300 Gaara.exe 2452 csrss.exe 2952 Kazekage.exe 2460 system32.exe 1908 smss.exe 840 Gaara.exe 1520 csrss.exe 1800 Kazekage.exe 1504 system32.exe 1584 system32.exe 3048 Kazekage.exe 932 system32.exe 3060 csrss.exe 2500 Kazekage.exe 1748 system32.exe 2972 Gaara.exe 292 csrss.exe 888 Kazekage.exe 2008 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2696 2312 706c22a98c902a6d006d04cfda47e163.exe 28 PID 2312 wrote to memory of 2696 2312 706c22a98c902a6d006d04cfda47e163.exe 28 PID 2312 wrote to memory of 2696 2312 706c22a98c902a6d006d04cfda47e163.exe 28 PID 2312 wrote to memory of 2696 2312 706c22a98c902a6d006d04cfda47e163.exe 28 PID 2696 wrote to memory of 3016 2696 smss.exe 29 PID 2696 wrote to memory of 3016 2696 smss.exe 29 PID 2696 wrote to memory of 3016 2696 smss.exe 29 PID 2696 wrote to memory of 3016 2696 smss.exe 29 PID 2696 wrote to memory of 2544 2696 smss.exe 30 PID 2696 wrote to memory of 2544 2696 smss.exe 30 PID 2696 wrote to memory of 2544 2696 smss.exe 30 PID 2696 wrote to memory of 2544 2696 smss.exe 30 PID 2544 wrote to memory of 2816 2544 Gaara.exe 31 PID 2544 wrote to memory of 2816 2544 Gaara.exe 31 PID 2544 wrote to memory of 2816 2544 Gaara.exe 31 PID 2544 wrote to memory of 2816 2544 Gaara.exe 31 PID 2544 wrote to memory of 2908 2544 Gaara.exe 32 PID 2544 wrote to memory of 2908 2544 Gaara.exe 32 PID 2544 wrote to memory of 2908 2544 Gaara.exe 32 PID 2544 wrote to memory of 2908 2544 Gaara.exe 32 PID 2544 wrote to memory of 2152 2544 Gaara.exe 33 PID 2544 wrote to memory of 2152 2544 Gaara.exe 33 PID 2544 wrote to memory of 2152 2544 Gaara.exe 33 PID 2544 wrote to memory of 2152 2544 Gaara.exe 33 PID 2152 wrote to memory of 1912 2152 csrss.exe 34 PID 2152 wrote to memory of 1912 2152 csrss.exe 34 PID 2152 wrote to memory of 1912 2152 csrss.exe 34 PID 2152 wrote to memory of 1912 2152 csrss.exe 34 PID 2152 wrote to memory of 1768 2152 csrss.exe 35 PID 2152 wrote to memory of 1768 2152 csrss.exe 35 PID 2152 wrote to memory of 1768 2152 csrss.exe 35 PID 2152 wrote to memory of 1768 2152 csrss.exe 35 PID 2152 wrote to memory of 1956 2152 csrss.exe 36 PID 2152 wrote to memory of 1956 2152 csrss.exe 36 PID 2152 wrote to memory of 1956 2152 csrss.exe 36 PID 2152 wrote to memory of 1956 2152 csrss.exe 36 PID 2152 wrote to memory of 2196 2152 csrss.exe 37 PID 2152 wrote to memory of 2196 2152 csrss.exe 37 PID 2152 wrote to memory of 2196 2152 csrss.exe 37 PID 2152 wrote to memory of 2196 2152 csrss.exe 37 PID 2196 wrote to memory of 2148 2196 Kazekage.exe 38 PID 2196 wrote to memory of 2148 2196 Kazekage.exe 38 PID 2196 wrote to memory of 2148 2196 Kazekage.exe 38 PID 2196 wrote to memory of 2148 2196 Kazekage.exe 38 PID 2196 wrote to memory of 2300 2196 Kazekage.exe 39 PID 2196 wrote to memory of 2300 2196 Kazekage.exe 39 PID 2196 wrote to memory of 2300 2196 Kazekage.exe 39 PID 2196 wrote to memory of 2300 2196 Kazekage.exe 39 PID 2196 wrote to memory of 2452 2196 Kazekage.exe 40 PID 2196 wrote to memory of 2452 2196 Kazekage.exe 40 PID 2196 wrote to memory of 2452 2196 Kazekage.exe 40 PID 2196 wrote to memory of 2452 2196 Kazekage.exe 40 PID 2196 wrote to memory of 2952 2196 Kazekage.exe 41 PID 2196 wrote to memory of 2952 2196 Kazekage.exe 41 PID 2196 wrote to memory of 2952 2196 Kazekage.exe 41 PID 2196 wrote to memory of 2952 2196 Kazekage.exe 41 PID 2196 wrote to memory of 2460 2196 Kazekage.exe 42 PID 2196 wrote to memory of 2460 2196 Kazekage.exe 42 PID 2196 wrote to memory of 2460 2196 Kazekage.exe 42 PID 2196 wrote to memory of 2460 2196 Kazekage.exe 42 PID 2460 wrote to memory of 1908 2460 system32.exe 43 PID 2460 wrote to memory of 1908 2460 system32.exe 43 PID 2460 wrote to memory of 1908 2460 system32.exe 43 PID 2460 wrote to memory of 1908 2460 system32.exe 43 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 706c22a98c902a6d006d04cfda47e163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 706c22a98c902a6d006d04cfda47e163.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\706c22a98c902a6d006d04cfda47e163.exe"C:\Users\Admin\AppData\Local\Temp\706c22a98c902a6d006d04cfda47e163.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2696 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2544 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2152 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2196 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2452
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2460 -
C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:840
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2948
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2960
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:572
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1764
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2624
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2128
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1968
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1600
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2500
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1300
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1720
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1512
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:788
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:644
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2604
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1220
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2156
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1436
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2304
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1608
-
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2824
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2560
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2832
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1544
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2564
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2596
-
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 1 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:292
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1448
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:704
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:548
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
Filesize
283KB
MD541d227aa29bc48bdfff6c281e94c5482
SHA197e9f04641cccc40213fe2bc0979970d0274f4ab
SHA25634abe878633f992c6b94e3537d15fc1e00b18f80fe326c5648035e91cb612847
SHA51273d4a4bafa18969fe7be7a6786a6594517dc2f7217916d15ef272a345ea2ec29b82f3c4d36be72d7e543bfac48a0a5d97ece65d94a6bfb223095b901ab2ace59
-
Filesize
283KB
MD5706c22a98c902a6d006d04cfda47e163
SHA10dc80ee20cefca3045abcc1342d960b8a3c49e9c
SHA25654151d24cac03c5d6be72f161faa00f794edaca0c090747dfadc91a867dbd7bf
SHA5125f237c32596c16c2cf41c70977c02a86133dc2bb77bf11abd2b9cbb45e3a173a6e4971aefe3b33845c2fc07b29d1b4a52afea96f19fd2308903f8e32bd63234d
-
Filesize
283KB
MD574d1a5b3ff5ba84a11751ad95e922f25
SHA1092678779585bf96098f1da044cfd3478a2284ac
SHA25660791be9c75d21e853bc489a852ad1170544016126dce32966e858a19262cc48
SHA512c60e93ccc9548d0534a11e89917015b119aadfec38deb269c4d8c16ef195bface382600f0f0bcf09c3feb7b7cc51597ab8296c66b4240f26652eff531dd3388f
-
Filesize
256KB
MD53d11382bb9fd1ef88c3124e45938cf49
SHA19d706c474116dc010f850db5cd4873c1187cfbe1
SHA2565c1344a7ccb2f3b9dc601ce283134b74b704b059377266f987c4f6dd652360cc
SHA512c35816d8e6cfef3a6e2210e639f57f7d5a3bb22bb5bd292b9fa5f6003da41943d187d8fe33b73b367f66a5eb9bc266a1d7cac5c24805ca80858a4e45ae7fb55d
-
Filesize
128KB
MD502770ec1a321e19ddd06cdb29d69ffe3
SHA1d51b0b4d5de7a3c64dd320cfddd06614a2ab7af2
SHA25672424cc8831eccd132639f5a2b6541c9bb2d638baf4397186a984bc353b7b579
SHA512d816faa1abdee5c0879a4240b30abd156962a5dabb6d072bfcb84aae1d69d8c50ad8f8519db1db9a6fbdeee8a10c643f110800aed1c84957573501bcae178d4f
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
283KB
MD5cec746d696cb4f757e98d90924583307
SHA1084c5f3bf330a356304fa71778d1c5a177a00d43
SHA2567a689ea913f22f7f4bc13ab1d1cf3aa60cdd9faf7292bfe9665fa80333c83f66
SHA5120534f868fa60c61e673073c74a9c1b2e3326857f21d69d58b0f3f737e8b3faa74d6f470d02fc78cbf2051ed2076a82c142d43473bc3a110e7d8ac05da3b9747a
-
Filesize
283KB
MD5ef1c075c6203a56a08336cd7b68a6321
SHA1e51ac2f519f0bd1e45ec7d432e7bf0d91d86148a
SHA256b6f3b6ef47e7914e77bb2e08ad8455580741f6231bf9296734344409d61f2e7c
SHA512217790b8b365a969ba2cf78cf02ebdea8eb86f4363e42cb9d49144478e6a5477ec3676490e6139ab3cbc5a83cced1144352f1a8c9dadfcf9e63f9ac51d6537a6
-
Filesize
283KB
MD5578428cb232435fd50e103cc60681945
SHA10784f28d2369a493f16f8b401b54afa392d2bbf3
SHA2563ff558115775d38a27b7bc2002fa0bd982ab7b72e1b2ed8502486819c59baf60
SHA512774fd2df00e7e5d50be06da6e7d47e58a3216c5f7c707ed6ce3589057c410208979c7947a5d696def603e9a0a78cc89c813736aeecab16816d71920e148c8818
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
283KB
MD5c242fa984403d8be4c0022a5be558e8a
SHA1a7627d5387ded645814be6b040db773d680be4c2
SHA25622aa46aa7ffd969e8bd0bce42420443887d90600215972136d9cc11169c4dfda
SHA512c779d92408653906da49a546e89b0f8297eeb9bbd9b7d6f7153b24045a1d2108424631f5cfd9ab60fe4a22e9e0e6428bc894b80f89051dacbfb3a8254fe91d40
-
Filesize
283KB
MD514731ca33c3f0179a6b526e9bf6f016d
SHA17fbc4c0512abcddffb791928af8ba0f9ffbf9867
SHA256700f0fef481c267ba2ea53a924d5dc332a3770faadf1b35954e5d58e8b7bb1c1
SHA5128d1fa98dc5636ba03b09dceee3a7f2f64976aae4f24e22edbcd2d7eb12732ccf27ba254cc4d85f6040b9c0e50a77ee05d56e372e1ae9de357f37fe46dcdf29ba
-
Filesize
283KB
MD510a64cdeafd9525f6e792ed07af3fa0f
SHA11dfde168070ed994e978b53e900031da15cdbe00
SHA2561b0dbf3eaccdcf87dfb9bb922bbfb3fbe3c64da28dd6b8f342e00287bd76dbf5
SHA5122c75de9f360613d73db5c98b2de8c07528c24f3664c399f42ff09423409e34883670689fdfdcc95e8a78765f8562c47ee8ff8d74bd904a8eaaca3fbc44fe3119
-
Filesize
283KB
MD5658f8009030cf144c87a375799f8a61d
SHA1e568164fd861d41fee8c69223aada966f48f2915
SHA256da29644b5d67ffa593b7e4be923635009f2e885d9e14fd0b70ea9f65941ed370
SHA512d1e9c2eba8d619f7d373104448b6c4270ca5c695c32388ed96e37ad65d8105ae4266eea4fb4cdca785eb5375e0d75987bf1506ead7fea2da5a20958c64fed376
-
Filesize
283KB
MD54c232fdc0911dd9d835d6b4bba02acb4
SHA1403eb3f63340fc3aab7737ebde843c8879a2ef9a
SHA25612d5825699921a32c5de37f768f89fc370ee341348775528784ec086afab46e6
SHA5121d7493e21e032f15b1ae24d0a804ab9a209eb8b57733925b594a5a5226c25e988fb699497b55d3fc9b5175c797ea9745ea2a7fa9437dc7e0f1f36a7940641ad1
-
Filesize
283KB
MD560d43132d7aa4733e57694c6f3ca2d98
SHA1f8590aa968ed8519a1c24e2d28259c6285a2bdb5
SHA2569603bbc5954de44379362ffd392f41320f808201e589f83d634896e217eb5441
SHA512f920117fa9b1fa814d011b1ec6a5610560eec8ebb6cea9213dea27deafe9dbbf3b33f88c99184bd2429069684c311b862f5434840bf77c873a2c19e4b410bfd9
-
Filesize
283KB
MD5d4441296406929e11424dfef921cbe52
SHA1417d1802639e6546ec968576bea8d7ffdf668ffe
SHA2568fde2594404e53e848f94552088e74bce4c54b1aa580e6fa773e9dd2a161994c
SHA512e15f341d3ed5db1a2b5a40e3543678c50ff664408e70b92e22625e62d43fbcdf1faf1efc2152c9d490462e41494ea7dd67bee96dc395f7b772dc3c846cba2882
-
Filesize
283KB
MD5043808fb3a9211548e3502e04eebd256
SHA146d87a931f353881b7cb437c974c7f06d5b79fd7
SHA25623bcc152d585bd33aa1a3db0cb4cdfebd2f960a17172a5f7c25598979c76ecf8
SHA51212c61fbfba3914940d94db38d846111cdb2f9e06255eed85934a2f5b6d5e7d518d8bd73d29e370de485bb4f5249586c7407a76d9c24537b09d7b4b5f5bb8ab79
-
Filesize
283KB
MD54defa3909cf965fb742e3e6b543bac2f
SHA1b65c72c37a28e579c1beec28cb98beab84665b76
SHA256eba64d6f7afb8915a6b919e68567a083ccf0dbcff16cf34f9d4e0e416d3f5c52
SHA51292c8b83dcf19649b8cc674e5cce7bc9fd320ee8933787fd4236786d5b4fe2d06c195da0407188eb1f66f7ad18ebb2e7b42511f39ccb5054b1633853546789cc1
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
283KB
MD5b1c406094a434702180a0eb5aaf39222
SHA173f731b0f5b05ab72d59155220d7278079b084d4
SHA256ced215856f3cf94ae61e7492b7a95de7a7c7dd34799b3f8655f8dc70817a5512
SHA5124c13743a6d19adff759e5f643ac046060b5b61e2ef227d3cd2fd1ee8f16384591c8d01c0be5881e7c92000c1efeeb9f3fb82b84d8f8d5860757531a3f8717db2
-
Filesize
283KB
MD5c1453a7c950915bdba802797a64dd579
SHA15b59beb9823cda586c5d9c0ecb181951bdb95fc2
SHA256192af599ae2f442970383cfc1b2c8d8b685c3e46eb36253f5d42d8af4195f22d
SHA512a8556fac90ba252c1f3cbd1578fe41f64d810e8a8560fe3340a9be3625861a0e3668000def4c81e11c000893f33edbc619b1ee49ce1d37d280ad39f1cc61972f
