Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe
-
Size
145KB
-
MD5
0ff036ee4306066aa80d8bd4cdc917a0
-
SHA1
0a52f53550f038954163f7b78806d13ee23b4033
-
SHA256
ae0b9eddb3e2ca5a60825f7ecf8b0719082d78fba96b81bcf91cb37cf08b5fc3
-
SHA512
684145ea4363ec603f1767f13523cb82834843b8e5fb1ae787486ac29d19b301c589d844c70f6828b5bb4169062dbe5f0652e57e8323cefd554fbfa8974a8d82
-
SSDEEP
1536:FJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Dx6AHjYzaFXg+w17jsgS/jHagQg19V
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe -
Executes dropped EXE 30 IoCs
pid Process 2736 smss.exe 212 smss.exe 3704 Gaara.exe 4924 smss.exe 2760 Gaara.exe 3384 csrss.exe 1532 smss.exe 2288 Gaara.exe 1340 csrss.exe 2212 Kazekage.exe 4460 smss.exe 4240 Gaara.exe 1708 csrss.exe 4808 Kazekage.exe 1764 system32.exe 228 smss.exe 3340 Gaara.exe 2928 csrss.exe 2508 Kazekage.exe 2752 system32.exe 2748 system32.exe 4680 Kazekage.exe 1524 system32.exe 876 csrss.exe 2560 Kazekage.exe 456 system32.exe 4944 Gaara.exe 2904 csrss.exe 1340 Kazekage.exe 5072 system32.exe -
Loads dropped DLL 18 IoCs
pid Process 2736 smss.exe 212 smss.exe 3704 Gaara.exe 4924 smss.exe 2760 Gaara.exe 3384 csrss.exe 1532 smss.exe 2288 Gaara.exe 1340 csrss.exe 4460 smss.exe 4240 Gaara.exe 1708 csrss.exe 228 smss.exe 3340 Gaara.exe 2928 csrss.exe 876 csrss.exe 4944 Gaara.exe 2904 csrss.exe -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 9 - 5 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "9-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 9 - 5 - 2024\\smss.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\E:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\A:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification D:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\K:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\O:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\L:\Desktop.ini Kazekage.exe File opened for modification D:\Desktop.ini smss.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\W:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: system32.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\S: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\A: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\E: system32.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\N: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\Z: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\H: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\W: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\J: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\K: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\B: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\T: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\L: 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\M: Gaara.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\N:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\S:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\N:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\H:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf Gaara.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File created \??\Q:\Autorun.inf Kazekage.exe File opened for modification F:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\Y:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File created \??\E:\Autorun.inf csrss.exe File created \??\I:\Autorun.inf csrss.exe File created \??\K:\Autorun.inf Kazekage.exe File opened for modification \??\J:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\K:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\H:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf system32.exe File created \??\Y:\Autorun.inf system32.exe File created C:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\I:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf smss.exe File created \??\K:\Autorun.inf Gaara.exe File created \??\G:\Autorun.inf csrss.exe File created \??\O:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification F:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf csrss.exe File created D:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Autorun.inf csrss.exe File created \??\S:\Autorun.inf Kazekage.exe File opened for modification \??\G:\Autorun.inf smss.exe File created \??\I:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\S:\Autorun.inf smss.exe File created \??\T:\Autorun.inf smss.exe File created \??\M:\Autorun.inf csrss.exe File opened for modification \??\A:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf Kazekage.exe File created \??\A:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\L:\Autorun.inf Gaara.exe File created \??\R:\Autorun.inf Kazekage.exe File opened for modification \??\J:\Autorun.inf system32.exe File created \??\X:\Autorun.inf smss.exe File created F:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\U:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\Z:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created \??\B:\Autorun.inf smss.exe File opened for modification \??\U:\Autorun.inf smss.exe File created \??\B:\Autorun.inf system32.exe File created \??\S:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\E:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf csrss.exe File created \??\P:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf system32.exe File created \??\M:\Autorun.inf 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification \??\I:\Autorun.inf smss.exe File created \??\O:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf csrss.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\9-5-2024.exe smss.exe File created C:\Windows\SysWOW64\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\9-5-2024.exe system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\9-5-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\9-5-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\9-5-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File created C:\Windows\SysWOW64\9-5-2024.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\9-5-2024.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\mscomctl.ocx 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\The Kazekage.jpg 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\WBEM\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe csrss.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe system32.exe File created C:\Windows\system\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe smss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\msvbvm60.dll 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\ 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\msvbvm60.dll Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe -
Runs ping.exe 1 TTPs 34 IoCs
pid Process 1456 ping.exe 1928 ping.exe 2096 ping.exe 2788 ping.exe 4508 ping.exe 5096 ping.exe 212 ping.exe 4648 ping.exe 1232 ping.exe 2940 ping.exe 1932 ping.exe 1196 ping.exe 4784 ping.exe 2924 ping.exe 3512 ping.exe 5032 ping.exe 3424 ping.exe 4388 ping.exe 1940 ping.exe 4556 ping.exe 1348 ping.exe 1532 ping.exe 2056 ping.exe 2800 ping.exe 2284 ping.exe 4860 ping.exe 1436 ping.exe 4180 ping.exe 3664 ping.exe 2928 ping.exe 2140 ping.exe 2136 ping.exe 2684 ping.exe 2804 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3704 Gaara.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 3384 csrss.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe 2212 Kazekage.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 3684 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe 2736 smss.exe 212 smss.exe 3704 Gaara.exe 4924 smss.exe 2760 Gaara.exe 3384 csrss.exe 1532 smss.exe 2288 Gaara.exe 1340 csrss.exe 2212 Kazekage.exe 4460 smss.exe 4240 Gaara.exe 1708 csrss.exe 4808 Kazekage.exe 1764 system32.exe 228 smss.exe 3340 Gaara.exe 2928 csrss.exe 2508 Kazekage.exe 2752 system32.exe 2748 system32.exe 4680 Kazekage.exe 1524 system32.exe 876 csrss.exe 2560 Kazekage.exe 456 system32.exe 4944 Gaara.exe 2904 csrss.exe 1340 Kazekage.exe 5072 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 2736 3684 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe 89 PID 3684 wrote to memory of 2736 3684 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe 89 PID 3684 wrote to memory of 2736 3684 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe 89 PID 2736 wrote to memory of 212 2736 smss.exe 91 PID 2736 wrote to memory of 212 2736 smss.exe 91 PID 2736 wrote to memory of 212 2736 smss.exe 91 PID 2736 wrote to memory of 3704 2736 smss.exe 93 PID 2736 wrote to memory of 3704 2736 smss.exe 93 PID 2736 wrote to memory of 3704 2736 smss.exe 93 PID 3704 wrote to memory of 4924 3704 Gaara.exe 95 PID 3704 wrote to memory of 4924 3704 Gaara.exe 95 PID 3704 wrote to memory of 4924 3704 Gaara.exe 95 PID 3704 wrote to memory of 2760 3704 Gaara.exe 96 PID 3704 wrote to memory of 2760 3704 Gaara.exe 96 PID 3704 wrote to memory of 2760 3704 Gaara.exe 96 PID 3704 wrote to memory of 3384 3704 Gaara.exe 97 PID 3704 wrote to memory of 3384 3704 Gaara.exe 97 PID 3704 wrote to memory of 3384 3704 Gaara.exe 97 PID 3384 wrote to memory of 1532 3384 csrss.exe 98 PID 3384 wrote to memory of 1532 3384 csrss.exe 98 PID 3384 wrote to memory of 1532 3384 csrss.exe 98 PID 3384 wrote to memory of 2288 3384 csrss.exe 99 PID 3384 wrote to memory of 2288 3384 csrss.exe 99 PID 3384 wrote to memory of 2288 3384 csrss.exe 99 PID 3384 wrote to memory of 1340 3384 csrss.exe 100 PID 3384 wrote to memory of 1340 3384 csrss.exe 100 PID 3384 wrote to memory of 1340 3384 csrss.exe 100 PID 3384 wrote to memory of 2212 3384 csrss.exe 102 PID 3384 wrote to memory of 2212 3384 csrss.exe 102 PID 3384 wrote to memory of 2212 3384 csrss.exe 102 PID 2212 wrote to memory of 4460 2212 Kazekage.exe 103 PID 2212 wrote to memory of 4460 2212 Kazekage.exe 103 PID 2212 wrote to memory of 4460 2212 Kazekage.exe 103 PID 2212 wrote to memory of 4240 2212 Kazekage.exe 104 PID 2212 wrote to memory of 4240 2212 Kazekage.exe 104 PID 2212 wrote to memory of 4240 2212 Kazekage.exe 104 PID 2212 wrote to memory of 1708 2212 Kazekage.exe 105 PID 2212 wrote to memory of 1708 2212 Kazekage.exe 105 PID 2212 wrote to memory of 1708 2212 Kazekage.exe 105 PID 2212 wrote to memory of 4808 2212 Kazekage.exe 107 PID 2212 wrote to memory of 4808 2212 Kazekage.exe 107 PID 2212 wrote to memory of 4808 2212 Kazekage.exe 107 PID 2212 wrote to memory of 1764 2212 Kazekage.exe 108 PID 2212 wrote to memory of 1764 2212 Kazekage.exe 108 PID 2212 wrote to memory of 1764 2212 Kazekage.exe 108 PID 1764 wrote to memory of 228 1764 system32.exe 109 PID 1764 wrote to memory of 228 1764 system32.exe 109 PID 1764 wrote to memory of 228 1764 system32.exe 109 PID 1764 wrote to memory of 3340 1764 system32.exe 110 PID 1764 wrote to memory of 3340 1764 system32.exe 110 PID 1764 wrote to memory of 3340 1764 system32.exe 110 PID 1764 wrote to memory of 2928 1764 system32.exe 111 PID 1764 wrote to memory of 2928 1764 system32.exe 111 PID 1764 wrote to memory of 2928 1764 system32.exe 111 PID 1764 wrote to memory of 2508 1764 system32.exe 112 PID 1764 wrote to memory of 2508 1764 system32.exe 112 PID 1764 wrote to memory of 2508 1764 system32.exe 112 PID 1764 wrote to memory of 2752 1764 system32.exe 113 PID 1764 wrote to memory of 2752 1764 system32.exe 113 PID 1764 wrote to memory of 2752 1764 system32.exe 113 PID 3384 wrote to memory of 2748 3384 csrss.exe 114 PID 3384 wrote to memory of 2748 3384 csrss.exe 114 PID 3384 wrote to memory of 2748 3384 csrss.exe 114 PID 3704 wrote to memory of 4680 3704 Gaara.exe 115 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ff036ee4306066aa80d8bd4cdc917a0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3684 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:212
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3704 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2760
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3384 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2288
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2212 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4460
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4240
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4808
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1764 -
C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:228
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3340
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:5032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2940
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2924
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1436
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1532
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2788
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3424
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:4784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:4556
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:212
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2096
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1196
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2284
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:5096
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3664
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1928
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4680
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2684
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1932
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2804
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:3512
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1456
-
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:876
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2560
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:456
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1348
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1232
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2800
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4180
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2056
-
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4944
-
-
C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 9 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4648
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2928
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4388
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2140
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2136
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:81⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
Filesize
145KB
MD5dd8baf386f8fdb468d13b37fcbe6ddc8
SHA119e107d939f50bbda53d51b4f3f3c741008604ac
SHA2567fba845a2e7ab9befbf02197ac81cd30014d51bac1a31ce879ab9ffb84040505
SHA5124fafcecc72e74f5347f533ab41cff6fe8f5a3aa681b2d441bf73d36da5e586de269215a4250c81fa2e888a94f88d1f7210240f0e989c11aa7abf9713dff34790
-
Filesize
145KB
MD54a2ac123db824fa573eec8775a23c5f2
SHA119eb14fa7c0537bfb3c787d0c9ce7b748a12811e
SHA256d992e238016c78ae8d7ebafa388c01d84e5ca4e498b39c9796c10d7653a40438
SHA5124d2a90f479647f225ea0be3378dbeddfc0c2469404eb9b1f069e48aa20e7d84a6b9730ffd228c3ae6fe03e5515a1277017aa1b0cbfed6c420f5c7ccd84894646
-
Filesize
145KB
MD5913e15da655c10f8cec177cda05e549f
SHA19075a05da13926f9e36945f05668a3753cf80d72
SHA256fe5aa97beb313b1a5b18b3700ea21b09898535760e466af288fc2bcf990a42d3
SHA512c59442fb6dcccf078e620b80edeb4e060661d40314f25d91593c1b37be4645296c58bfe503485498328da159c2160b7146dfd3bbea1dbb259e878a24d55b69cc
-
Filesize
145KB
MD51120b2f82fadc9fc5aa1bb973a9ad703
SHA1a064343d2be5146fdb907891b8dae20dee70fdf3
SHA2564611ba7d606011ca7bf6fba160d586ab5792997e29203749ca94efbf29fab4e4
SHA5121bbe03872ed08fad5719267929ff3e25079a0d7f67b3e2912a3f31fcdc5bc6057ffc7e7540e3666e6f17bc7e5ae85e3b1f9c110613943a59f131142e7fa03aa5
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
145KB
MD579af3f344ba9cd0c31feef957ba2c917
SHA1e9f2b5462c121892cac634e7b68a304956ad209e
SHA256050513508d06db94b70722684ce177d8bf1e61ac5e1e0418dda1b177c337e1f8
SHA512aa5bf6b19783f4f1a6a3608ae1524f01970c019f1e84b04c68b516c81330b81f56b6e60b4eb8db086fddceb4fa7cfa8b79b2c783f051dda8d3d1ec604b2ed9f9
-
Filesize
145KB
MD50ff036ee4306066aa80d8bd4cdc917a0
SHA10a52f53550f038954163f7b78806d13ee23b4033
SHA256ae0b9eddb3e2ca5a60825f7ecf8b0719082d78fba96b81bcf91cb37cf08b5fc3
SHA512684145ea4363ec603f1767f13523cb82834843b8e5fb1ae787486ac29d19b301c589d844c70f6828b5bb4169062dbe5f0652e57e8323cefd554fbfa8974a8d82
-
Filesize
145KB
MD59b4764eaacd65d9f744a59a196fe8a6f
SHA1a62e9afd2d16df11d451a552522af81a374418f3
SHA256f6c4f16bf66f551aadc8056879059026f2e3c091f79c46720e8b567eef3dfabc
SHA512287d94a2e826b5650073ca57426d4385af151bfbbb303f03064ecde078dd83d064f37115e08ba15972b9d9fedc7bb5e85d3cb6dc9139ff46460c3f7271268928
-
Filesize
145KB
MD5fb3c0d34471aa0f6939e8e3e069baafd
SHA19d07558c2262b2cc21358f8caf292930181d2338
SHA256dc07e7dcd85acdf00f1c005fb61b38fb01ee158593063e9d8d0cf72c16f9e858
SHA512e6b1ffc02351d7f4f8fc7e0c0be3b7ee39fb5cb8d7059aa5a3701429845fe9bdb81f0bf129a526c823b6db065b3b4ae4e488036d882b365a14ff99debc149651
-
Filesize
145KB
MD53d297425fa47f3eae1829bdde6951fb6
SHA1d675539329abecfd2b56146f82782a6ab390ccf0
SHA256c33b1fa1c21524a404f729c997b37dd014dd9ec817e8cd58b9788baabc27e5ff
SHA512fa0ac69e89d948da29a952e9d3ee7ee6997cdb604f3d7c4da6e99daf6b62ddc58dec793d9ade74fd73f4609b26f13cbb7036aa97361c9e879aa6eea04ba2c866
-
Filesize
145KB
MD52486d486d11966352263c43854e06875
SHA167a0b074fb14bc7d062b44bab2709a8fa28c672f
SHA256e69421b2c0dfee48b6cbaec937339e266756e5cb4f904568b31e15cde6dd84b0
SHA5122e290f13fcf1d59b404dbd6f7f6926bc552fe6f76e54f177985ee7e81cb7023e6f63b79b44c9bf8a783b71b5c4b7c33701c5805a3defc7600a7349b288493cfb
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
145KB
MD545ba1d65d99bb546beb488b1eb603bc5
SHA1e240743e713aae1bc4a3ff50468a62d99393c8c4
SHA25699638c4fa277ff819c0aa5fb821876862f6e8fbfa98fd9f447e542a8c0ae8a7c
SHA51252d283b0602991c8d850fd593b918ebe0e0b9bf56d9f76431c466388621bba9580db24a9747132282586ae524d37cd8aef1a5a91e7ffa85c7a19d8f9701c379d
-
Filesize
145KB
MD5cd8374bd963f4aad7b726c0568399ba8
SHA1df1f28d1bb0a002e9d2374b8d44408df834ac944
SHA2561bd123316406676c7165791cb2d724a16bcaa88f629fd0309b11ae759d81df93
SHA512cb57cf28abbad408d56811acd056266c7bd91734ccc48558fc414014ba9202e0c8a65f4db3e2aa66ddffd4a8c21cf488c02be244811f97668f5ea46ff17714d2
-
Filesize
145KB
MD52faab1f830f5b101949126e658fd701b
SHA12445f3c8487dbe5f602b6b3f34458413056172db
SHA2564e248d6606b9b3128e482ac957cf302a70af7bc9119a789ac7bcd9a6ebcb3401
SHA51299496c3b2703e6983f13df41e83124ed9275019b765c2545968e0b288ea26ff5c33137aa315a0a1d2d1e09fa2ae518c2df2f55cca616129f830537ddff08c2cd
-
Filesize
145KB
MD546ff17a2a58e558f106f932079b4fa3a
SHA198e79e591dce2462dca2bbbe6a4cde8686daaa17
SHA256f24e2d78f02cc7540d1c480c411038a932903db1088b3844826dad902ee5aa99
SHA5120eed8c89b373d7af01531e837b404351d8caa0c54ff2dc6be60433fe42f40950fb4c3ee4bb5f5ef369da3f4f293e45cdb74751714f0fbae06b5a1b4e6a98dde7
-
Filesize
145KB
MD5cbbf740bbfe23d7e48f7eb1dd0fd506f
SHA159331b38649da9ca4cc29dc8cc996d3d9ae17fae
SHA256e90712a553d013a9090ff3ce0932ac9e3bf2980e018a51fe9ae7de72ef0ee9ac
SHA512246e4c1aa924759d5270d6b50d26957497aa5893cee6cb3b30d18ff72bce4de97f4f72e4d1c2a36cca977f8d18161c7d52265e86e2cb400e88f8a4022cb33f9b
-
Filesize
145KB
MD5b3f20dfeb7f1a1562db404cdb3d15fdb
SHA1f262d7002c6d09f2743491c86a26baee65633c91
SHA2568a41beefa07586108c192ee92961bc1912ad96300edf811520fa3d3068c3592d
SHA512f75e12c7255143b87f17cce7daa1978bfcb8f3bd3d8abd728a74b72f4211ebdf1cccd6d7d927191c07674e8c12a9d9b66871ba445267a30ab48a7163feac37f1
-
Filesize
145KB
MD5f8fc506d56075abd774047fa811dc63b
SHA1944ea47984db6f632a5e9e330ce0f92830bb041a
SHA256f8f92ef25f3654463132f6262455d18877fe336328ff320c9dff7910943ae70d
SHA512a9eb2955b858058c95e7e5cc31c894426639c86082ddfe28b1972ef6d6b5220c385e9fa59d2606b1d9f3e286958dc2e4373a6eb2df85710c008961e3601df91c
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
127KB
MD5798463db5e72245eb6bfcd0d6e73e963
SHA1160142781ee3ae994f0e5816e825501c807c7fd7
SHA2560e13311342b03f886c1d8dedcaadb039986b88aae6bc9426d727072de82839bd
SHA5125e3e08d959b28ab6f61a64a15e1495aaaf23a038535141e622617895d1460454434300b0c174ae8a849790d1aad4bddc88f9f9e9a46910686d37fb89cb28774b
