Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 22:05
Behavioral task
behavioral1
Sample
997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe
Resource
win7-20231129-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe
-
Size
3.0MB
-
MD5
1138af762ea974c40591ecf18fc08510
-
SHA1
748bf62069ad5e51063ce98fe1cc5b119de18bff
-
SHA256
997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4
-
SHA512
3559ef4ea08feb7a6a7255a6bffa9f8405ae0fb28e6ee6fc302c5f6eae1823b7d55ede073c4a8fe7149fbd587d63a655cc7fce422c4c8fe5555b07b49980e640
-
SSDEEP
24576:PN7VG8rVG8tN7VG8WN7VG8rVG8tN7VG8YN7VG8rVG8tN7VG8kN7VG8rVG8tN7VGX:P55H5455H5i55H5m55H5055H5Q55H5s
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe -
UPX dump on OEP (original entry point) 54 IoCs
resource yara_rule behavioral1/memory/2884-0-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/files/0x0009000000015626-11.dat UPX behavioral1/files/0x0007000000015605-30.dat UPX behavioral1/memory/2884-31-0x00000000005D0000-0x00000000005FB000-memory.dmp UPX behavioral1/files/0x0009000000015b6f-54.dat UPX behavioral1/files/0x0009000000015626-50.dat UPX behavioral1/files/0x0008000000015c52-62.dat UPX behavioral1/files/0x0008000000015c3d-58.dat UPX behavioral1/files/0x000a000000015616-46.dat UPX behavioral1/memory/2612-77-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2612-80-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2472-93-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/files/0x0008000000015c52-110.dat UPX behavioral1/files/0x0008000000015c3d-106.dat UPX behavioral1/files/0x0009000000015b6f-102.dat UPX behavioral1/files/0x0009000000015626-98.dat UPX behavioral1/memory/1984-129-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1188-131-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2536-149-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/files/0x0008000000015c52-158.dat UPX behavioral1/files/0x0008000000015c3d-154.dat UPX behavioral1/files/0x0009000000015b6f-150.dat UPX behavioral1/memory/2884-171-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1712-176-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2272-185-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2088-189-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1436-199-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2188-191-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2188-190-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2472-223-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1916-233-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1436-238-0x0000000000290000-0x00000000002BB000-memory.dmp UPX behavioral1/memory/2336-241-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1056-249-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1188-246-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2536-263-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1560-270-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1628-281-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1436-280-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/844-275-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/400-288-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/900-292-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1056-303-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/3064-302-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/3064-297-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/1628-282-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/844-273-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/2092-266-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/files/0x0008000000015c52-245.dat UPX behavioral1/memory/1916-236-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/572-232-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/284-228-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/memory/284-227-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral1/files/0x0002000000010f02-1037.dat UPX -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe -
Executes dropped EXE 30 IoCs
pid Process 2088 smss.exe 2612 smss.exe 2472 Gaara.exe 1984 smss.exe 1188 Gaara.exe 2536 csrss.exe 1712 smss.exe 2272 Gaara.exe 2188 csrss.exe 1436 Kazekage.exe 284 smss.exe 572 Gaara.exe 1916 csrss.exe 2336 Kazekage.exe 1056 system32.exe 2092 smss.exe 1560 Gaara.exe 844 csrss.exe 1628 Kazekage.exe 400 system32.exe 900 system32.exe 3064 Kazekage.exe 2840 system32.exe 1564 csrss.exe 884 Kazekage.exe 2312 system32.exe 1836 Gaara.exe 2960 csrss.exe 3028 Kazekage.exe 2152 system32.exe -
Loads dropped DLL 62 IoCs
pid Process 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2088 smss.exe 2088 smss.exe 2612 smss.exe 2088 smss.exe 2088 smss.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 1984 smss.exe 1188 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2536 csrss.exe 2536 csrss.exe 1712 smss.exe 2536 csrss.exe 2272 Gaara.exe 2188 csrss.exe 2536 csrss.exe 2536 csrss.exe 1436 Kazekage.exe 284 smss.exe 1436 Kazekage.exe 572 Gaara.exe 1436 Kazekage.exe 1916 csrss.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1056 system32.exe 2092 smss.exe 1056 system32.exe 1560 Gaara.exe 1056 system32.exe 844 csrss.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 2536 csrss.exe 2536 csrss.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2088 smss.exe 1564 csrss.exe 2088 smss.exe 2088 smss.exe 2088 smss.exe 2088 smss.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 1836 Gaara.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2960 csrss.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe -
resource yara_rule behavioral1/memory/2884-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0009000000015626-11.dat upx behavioral1/files/0x0007000000015605-30.dat upx behavioral1/memory/2884-31-0x00000000005D0000-0x00000000005FB000-memory.dmp upx behavioral1/files/0x0009000000015b6f-54.dat upx behavioral1/files/0x0009000000015626-50.dat upx behavioral1/files/0x0008000000015c52-62.dat upx behavioral1/files/0x0008000000015c3d-58.dat upx behavioral1/files/0x000a000000015616-46.dat upx behavioral1/memory/2612-77-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2612-80-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2472-93-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0008000000015c52-110.dat upx behavioral1/files/0x0008000000015c3d-106.dat upx behavioral1/files/0x0009000000015b6f-102.dat upx behavioral1/files/0x0009000000015626-98.dat upx behavioral1/memory/1984-129-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1188-131-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2536-149-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0008000000015c52-158.dat upx behavioral1/files/0x0008000000015c3d-154.dat upx behavioral1/files/0x0009000000015b6f-150.dat upx behavioral1/memory/2884-171-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1712-176-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2272-185-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2088-189-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1436-199-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2188-191-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2188-190-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2472-223-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1916-233-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1436-238-0x0000000000290000-0x00000000002BB000-memory.dmp upx behavioral1/memory/2336-241-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1056-249-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1188-246-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2536-263-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1560-270-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1628-281-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1436-280-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/844-275-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/400-288-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/900-292-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1056-303-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3064-302-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3064-297-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1628-282-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/844-273-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2092-266-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0008000000015c52-245.dat upx behavioral1/memory/1916-236-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/572-232-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/284-228-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/284-227-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0002000000010f02-1037.dat upx -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 4 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-4-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 4 - 2024\\Gaara.exe" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\P:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\K:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\W:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\A:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\W:\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\M:\Desktop.ini smss.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\O: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\B: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\E: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\L: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\R: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\I: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\P: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\J: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\V: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\M: Gaara.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\W: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\S: 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\E: Kazekage.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\R:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created \??\I:\Autorun.inf system32.exe File created D:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf Kazekage.exe File created \??\S:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\V:\Autorun.inf csrss.exe File created \??\B:\Autorun.inf Kazekage.exe File opened for modification \??\K:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created \??\A:\Autorun.inf csrss.exe File created \??\S:\Autorun.inf system32.exe File opened for modification \??\R:\Autorun.inf csrss.exe File opened for modification \??\T:\Autorun.inf csrss.exe File opened for modification \??\M:\Autorun.inf system32.exe File created \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Autorun.inf Gaara.exe File opened for modification \??\N:\Autorun.inf Gaara.exe File created \??\M:\Autorun.inf csrss.exe File created D:\Autorun.inf smss.exe File created \??\K:\Autorun.inf smss.exe File created \??\L:\Autorun.inf smss.exe File opened for modification \??\A:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File created \??\S:\Autorun.inf csrss.exe File created \??\Y:\Autorun.inf Kazekage.exe File opened for modification D:\Autorun.inf Gaara.exe File opened for modification F:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf Kazekage.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\W:\Autorun.inf Kazekage.exe File created \??\E:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf smss.exe File opened for modification \??\Q:\Autorun.inf Gaara.exe File created \??\V:\Autorun.inf system32.exe File created \??\R:\Autorun.inf system32.exe File opened for modification \??\T:\Autorun.inf smss.exe File created \??\B:\Autorun.inf Gaara.exe File created \??\I:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf csrss.exe File created \??\H:\Autorun.inf csrss.exe File opened for modification \??\U:\Autorun.inf system32.exe File created \??\G:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\Z:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\O:\Autorun.inf smss.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification F:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf system32.exe File created \??\U:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification \??\I:\Autorun.inf smss.exe File created \??\Y:\Autorun.inf smss.exe File opened for modification \??\M:\Autorun.inf csrss.exe File opened for modification \??\Z:\Autorun.inf smss.exe File opened for modification C:\Autorun.inf system32.exe File created \??\W:\Autorun.inf system32.exe File opened for modification \??\H:\Autorun.inf Kazekage.exe File opened for modification \??\Y:\Autorun.inf 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created \??\M:\Autorun.inf smss.exe File created \??\N:\Autorun.inf smss.exe File created \??\W:\Autorun.inf smss.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File created \??\L:\Autorun.inf Kazekage.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\9-4-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\9-4-2024.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\9-4-2024.exe system32.exe File created C:\Windows\SysWOW64\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\9-4-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\ 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File created C:\Windows\SysWOW64\9-4-2024.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\SysWOW64\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\9-4-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\9-4-2024.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\msvbvm60.dll smss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\WBEM\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\ smss.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\system\mscoree.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\mscomctl.ocx 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\system\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe smss.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe smss.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File created C:\Windows\Fonts\The Kazekage.jpg 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe csrss.exe File created C:\Windows\Fonts\Admin 9 - 4 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\ 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Size = "72" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Screen Saver.Marquee system32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main smss.exe -
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe -
Runs ping.exe 1 TTPs 36 IoCs
pid Process 2436 ping.exe 2980 ping.exe 1732 ping.exe 1872 ping.exe 2768 ping.exe 2308 ping.exe 2300 ping.exe 1760 ping.exe 2800 ping.exe 1804 ping.exe 1580 ping.exe 2932 ping.exe 2096 ping.exe 2872 ping.exe 2000 ping.exe 1744 ping.exe 1684 ping.exe 3052 ping.exe 2736 ping.exe 2744 ping.exe 1564 ping.exe 2500 ping.exe 2316 ping.exe 1668 ping.exe 2812 ping.exe 2080 ping.exe 2240 ping.exe 2368 ping.exe 1596 ping.exe 3048 ping.exe 784 ping.exe 2412 ping.exe 1860 ping.exe 2312 ping.exe 1992 ping.exe 536 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2472 Gaara.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 2536 csrss.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 1436 Kazekage.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 1056 system32.exe 2088 smss.exe 2088 smss.exe 2088 smss.exe 2088 smss.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
pid Process 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 2088 smss.exe 2612 smss.exe 2472 Gaara.exe 1984 smss.exe 1188 Gaara.exe 2536 csrss.exe 1712 smss.exe 2272 Gaara.exe 2188 csrss.exe 1436 Kazekage.exe 284 smss.exe 572 Gaara.exe 1916 csrss.exe 2336 Kazekage.exe 1056 system32.exe 2092 smss.exe 1560 Gaara.exe 844 csrss.exe 1628 Kazekage.exe 400 system32.exe 900 system32.exe 3064 Kazekage.exe 2840 system32.exe 1564 csrss.exe 884 Kazekage.exe 2312 system32.exe 2960 csrss.exe 3028 Kazekage.exe 2152 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2088 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 28 PID 2884 wrote to memory of 2088 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 28 PID 2884 wrote to memory of 2088 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 28 PID 2884 wrote to memory of 2088 2884 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe 28 PID 2088 wrote to memory of 2612 2088 smss.exe 29 PID 2088 wrote to memory of 2612 2088 smss.exe 29 PID 2088 wrote to memory of 2612 2088 smss.exe 29 PID 2088 wrote to memory of 2612 2088 smss.exe 29 PID 2088 wrote to memory of 2472 2088 smss.exe 30 PID 2088 wrote to memory of 2472 2088 smss.exe 30 PID 2088 wrote to memory of 2472 2088 smss.exe 30 PID 2088 wrote to memory of 2472 2088 smss.exe 30 PID 2472 wrote to memory of 1984 2472 Gaara.exe 31 PID 2472 wrote to memory of 1984 2472 Gaara.exe 31 PID 2472 wrote to memory of 1984 2472 Gaara.exe 31 PID 2472 wrote to memory of 1984 2472 Gaara.exe 31 PID 2472 wrote to memory of 1188 2472 Gaara.exe 32 PID 2472 wrote to memory of 1188 2472 Gaara.exe 32 PID 2472 wrote to memory of 1188 2472 Gaara.exe 32 PID 2472 wrote to memory of 1188 2472 Gaara.exe 32 PID 2472 wrote to memory of 2536 2472 Gaara.exe 33 PID 2472 wrote to memory of 2536 2472 Gaara.exe 33 PID 2472 wrote to memory of 2536 2472 Gaara.exe 33 PID 2472 wrote to memory of 2536 2472 Gaara.exe 33 PID 2536 wrote to memory of 1712 2536 csrss.exe 34 PID 2536 wrote to memory of 1712 2536 csrss.exe 34 PID 2536 wrote to memory of 1712 2536 csrss.exe 34 PID 2536 wrote to memory of 1712 2536 csrss.exe 34 PID 2536 wrote to memory of 2272 2536 csrss.exe 35 PID 2536 wrote to memory of 2272 2536 csrss.exe 35 PID 2536 wrote to memory of 2272 2536 csrss.exe 35 PID 2536 wrote to memory of 2272 2536 csrss.exe 35 PID 2536 wrote to memory of 2188 2536 csrss.exe 36 PID 2536 wrote to memory of 2188 2536 csrss.exe 36 PID 2536 wrote to memory of 2188 2536 csrss.exe 36 PID 2536 wrote to memory of 2188 2536 csrss.exe 36 PID 2536 wrote to memory of 1436 2536 csrss.exe 37 PID 2536 wrote to memory of 1436 2536 csrss.exe 37 PID 2536 wrote to memory of 1436 2536 csrss.exe 37 PID 2536 wrote to memory of 1436 2536 csrss.exe 37 PID 1436 wrote to memory of 284 1436 Kazekage.exe 38 PID 1436 wrote to memory of 284 1436 Kazekage.exe 38 PID 1436 wrote to memory of 284 1436 Kazekage.exe 38 PID 1436 wrote to memory of 284 1436 Kazekage.exe 38 PID 1436 wrote to memory of 572 1436 Kazekage.exe 39 PID 1436 wrote to memory of 572 1436 Kazekage.exe 39 PID 1436 wrote to memory of 572 1436 Kazekage.exe 39 PID 1436 wrote to memory of 572 1436 Kazekage.exe 39 PID 1436 wrote to memory of 1916 1436 Kazekage.exe 40 PID 1436 wrote to memory of 1916 1436 Kazekage.exe 40 PID 1436 wrote to memory of 1916 1436 Kazekage.exe 40 PID 1436 wrote to memory of 1916 1436 Kazekage.exe 40 PID 1436 wrote to memory of 2336 1436 Kazekage.exe 41 PID 1436 wrote to memory of 2336 1436 Kazekage.exe 41 PID 1436 wrote to memory of 2336 1436 Kazekage.exe 41 PID 1436 wrote to memory of 2336 1436 Kazekage.exe 41 PID 1436 wrote to memory of 1056 1436 Kazekage.exe 42 PID 1436 wrote to memory of 1056 1436 Kazekage.exe 42 PID 1436 wrote to memory of 1056 1436 Kazekage.exe 42 PID 1436 wrote to memory of 1056 1436 Kazekage.exe 42 PID 1056 wrote to memory of 2092 1056 system32.exe 43 PID 1056 wrote to memory of 2092 1056 system32.exe 43 PID 1056 wrote to memory of 2092 1056 system32.exe 43 PID 1056 wrote to memory of 2092 1056 system32.exe 43 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe"C:\Users\Admin\AppData\Local\Temp\997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2884 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2088 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2472 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2536 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2188
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1436 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:284
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:572
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1056 -
C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:400
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2736
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2500
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1744
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1732
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2080
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1668
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1760
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1564
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2000
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2800
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2744
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:536
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1684
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1596
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2980
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1580
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2312
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3064
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2812
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2368
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2872
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2436
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2768
-
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2240
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2300
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3048
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:3052
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1872
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1860
-
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836
-
-
C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 4 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2152
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1992
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2932
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2096
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2308
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2412
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:1804
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
3.0MB
MD571767b4f0bf4cde562a1d309becf4482
SHA184610be17ec86610e1deedc271e63f85db1ca79b
SHA256ece258824cd703f0356d53d6e1be048257d81c7329eb5d3ebeb372c6876c80d3
SHA5128cdb1ec4ccb70b240a2ca14e2a076b5e9e7886e286c3fe9a1313c4d3915ad10f7b198bd5e6c6b9d48cbb0411b778aa1aa5a2c5951c8e37e2a832d6972d7c5ce1
-
Filesize
3.0MB
MD51138af762ea974c40591ecf18fc08510
SHA1748bf62069ad5e51063ce98fe1cc5b119de18bff
SHA256997d9073490f99d3ab201aab5dc7c0ffa14fa018a003d24495477758c83539a4
SHA5123559ef4ea08feb7a6a7255a6bffa9f8405ae0fb28e6ee6fc302c5f6eae1823b7d55ede073c4a8fe7149fbd587d63a655cc7fce422c4c8fe5555b07b49980e640
-
Filesize
3.0MB
MD51753650f12a44688257e074a255a5bce
SHA1db58fd8d0e1b973d3590787e9518c176d291a1c4
SHA2566ba171c79cf5bd2677b36306ee2f634d738867728f6b76a9e7da66d032352a6b
SHA51201f43c6f5fa022a3566ad09ea1d215199eba688b601f67a9cbb41e3c2564d3db5a0a551132c4a840a8cd169e19ce7bdfd97c43dea2886b4f790e4b1b97f1e236
-
Filesize
3.0MB
MD5da5f7259018abd015b807e49a7756986
SHA1570a0ff95c5bc0cbcdbafebb14a5eccfb1aa15fa
SHA2567e6da3a6f0baa54ff0328ea563655ccd1d1dce79aebc81f91dfd49ef7269669c
SHA5122c885b102572df2e4722753be0b0a0dcb9ab672693b61976b44df50cd15b9c5c8f1734d19d41c28207b962f937ca81661046ecf22c3659886a04a4692e5ee055
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
3.0MB
MD510994bc7dd15f50c932dcbb1db4c6da7
SHA17bf4ca8c6bb9e4b95dddd4b7b29d66ec95b8f9bd
SHA2568ebc627b703e68af78d6a06da759f278bb8b2fad70dbb546b1ec27da698ad1c0
SHA51242f7e1a25120412ee3d88c813115507c8a4a0760d2d7d79945be0b568f2afb648d6189792634d1454739b70ee21a332b9b38de85c487a913258f83a1dd6ff0ac
-
Filesize
3.0MB
MD557c579ae4e101ba3204fc130142c4519
SHA12365faa997a8cf4c2b272dacf78ddb9721d19197
SHA2565f024aaf8b0b5b202dbe8c21624bbf934eb5ee89d2c4f7f76170c92ff236d3b9
SHA512477243bd01c48bafd11f8214c9bd3307b4f9e1368ac2472220dfa784d434524eeee07dbd2100e5666909fc78a4ef4447ba60c47b06b76225c2fbccf9978e735d
-
Filesize
3.0MB
MD5d697c80e9070668d1d095ad53a07a5be
SHA1453c3d8d51fd9646d4e6f2b8d9fb16351b980165
SHA25600beb52434bffcecd69ea2ce5bc40eca2659f336a5f8792fe4e7e64f6870c819
SHA51208ac154b2367f112b2551a3c4a1f7c309af1595ceb6dc87d2575506326f20143b57256a7be19b23794047bab119b6d033c592ecbc435b44b5924d6ef3fb36655
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
3.0MB
MD57ee634d9c6ef8fcfb7e22017c04bd41e
SHA1a04f72b84a7be3bd67e0236bf3fe3a197eb0026a
SHA25650b1cc2818f53b1c2e544dd8b7ee2c949f30b0aaec9b5dfad011b30b2a7230a0
SHA5129d54ef7d63290eceacd0c05d3c9fabe21470a22f22e431e4bb8b52acc634472f8ee9511f5746e5d397a903d36292a08b67a0c38397caae0f9f349e2e155576b9
-
Filesize
3.0MB
MD51f46e60fd6c7a143c9a86fa214670640
SHA103036cd75a64253731767015a4f2e49b205778ed
SHA2567d3187aaa4d71358eee4ad920cfc66669821025c6930dde0995fe0f25128de31
SHA5126e47932c4357617b0758051e7b5a8d2449a1ccf19ece52d155fb74feda88b427c689f9e43caab75124738cad372801bbd244e559fe6617a12cc8e90fe8540f8e
-
Filesize
3.0MB
MD52dfe813c993452e244b225914ff3cfff
SHA14607927ab64170571921328382e8b2810b5497dd
SHA256e5543b9807259cb4d7939e9ffcaf64ef7c6b637d308e8d848464a54c4ed2b7a1
SHA51272035855413cd6cae0913b78adf17eac5bcfd5a52f98c9b74a5287eaaa6551ea43a81dcc15bf88dc739085555fd86cb4ba0dd6127de10576c180d27b4d5d85d7
-
Filesize
3.0MB
MD52319fff7ae68aec324c67d0c4159f357
SHA153d121bf0b840a56bdfe479b68275e76591ed1a8
SHA256b4b1ea47e5727e13cfee5e73d2eaea942d2604cef94a891f0f9c11e4a4f782a8
SHA51237466bb2a545649d4051e3ed28ac35483a96c42e16f9e5e217905f8818e4f25e5ef650309c379fdbd59bf330ff1a71c552e0752811ddb2955270394e6256102b
-
Filesize
3.0MB
MD56fa7bc20874f575bced0a31f67bf3da7
SHA1cb14e974f6e0841843609cfd6428ed6dc10cc02b
SHA256d6adc280be20ab1decad0d7b9a0e2d100c14e586ba9f05fb2c790372c003d1c2
SHA5124d89fd1fb731faa397501cbdfb3de89bb2f2d01dbf3e8ae954d138bde95acde7fd03f577b73ebc954ea844d730fba7a83896492bf43da2cd10f11db689811c23
-
Filesize
2.2MB
MD5264970adf7ee7276da0420df738885f9
SHA1d5a47b1588979b510fd5f28b6e24af28c9866935
SHA25691239b473966d0f5d4999fc1aab3caaa8d7b15d85b1b594950cf360f73088d38
SHA512497ffbbe8abc5f18c9119e0d90b160dd76a3b2cf05cad671d60460c1d509f5665743e8c5ddd300b17903dcd9696adfefbbc2677692f11ed152ed114605b4f20e
-
Filesize
3.0MB
MD5bbca5fe7dfe5882fc9e04984abe4974e
SHA1fe9d88e3fd22f29be2f07b70aa69b275473c4200
SHA256feeb7dc9cdd53aa8a13f7968fa68e89d18f41ec24fe9d1f745348d480a86b546
SHA5125f1596559d153d667aa82a926c80c607edf8216c03ddec480d5dd609b2ec514bd0422013b5001c56ccfefc0a43b3bac16c4ab0c83a2af97bdddeca6ce77949d3
-
Filesize
3.0MB
MD59b64ef4d1d7557fc58adaf7ef11b4b3e
SHA1b824bb429dd755bb6c25977bc0c43048a795a8b1
SHA2565020e3f3e24bde0041589fb461b43727094fcdda6e2f27f43f809ac6514328bf
SHA5122c10b91c7b748e4bef72783d151a2452ed0d9497bc89b538db1e7192a4c61e4572dfde6e1bb2e06655c4e569f1c83da867bb36a53858770580fecca7b2dee5b0
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
3.0MB
MD5b63e3c53ff7eea5f00fccd38d7ef7011
SHA1542509d5ac4a7e45eec51df0c8d8726b7a6e99f1
SHA25680b94d52516e29fbbf6b9baee688772f12363398dd607891c4b4487bf5773332
SHA51246f004f9792276b90400931664202d0ddc3059eb9cddef26579505a5376deee10899487ea13da928615b2fe750eb5455c5c0755de0827854cfbdbec02e6b1f52
