Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
13/05/2024, 10:25
Behavioral task
behavioral1
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
- Size 236KB
- Sample240513-mf7tysbb89
- SHA256 58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
- MD5 b2739b7f6d1227761aefa9f256ed9970
- SHA1 9c3868075147e7815c13008b8e837a387387fa05
- SHA512 cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
- SSDEEP 1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe - Executes dropped EXE 30 IoCs
pid Process 2676 smss.exe 2664 smss.exe 2488 Gaara.exe 1668 smss.exe 2776 Gaara.exe 2580 csrss.exe 1872 smss.exe 1284 Gaara.exe 2276 csrss.exe 2236 Kazekage.exe 480 smss.exe 1112 Gaara.exe 1488 csrss.exe 1088 Kazekage.exe 1868 system32.exe 2304 smss.exe 2312 Gaara.exe 1648 csrss.exe 1684 Kazekage.exe 2192 system32.exe 668 system32.exe 2404 Kazekage.exe 2092 system32.exe 2008 csrss.exe 2156 Kazekage.exe 1704 system32.exe 812 Gaara.exe 2948 csrss.exe 2220 Kazekage.exe 1508 system32.exe - Loads dropped DLL 63 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2676 smss.exe 2664 smss.exe 2676 smss.exe 2676 smss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 1668 smss.exe 2488 Gaara.exe 2776 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2580 csrss.exe 2580 csrss.exe 1872 smss.exe 2580 csrss.exe 1284 Gaara.exe 2276 csrss.exe 2580 csrss.exe 2580 csrss.exe 2236 Kazekage.exe 480 smss.exe 2236 Kazekage.exe 1112 Gaara.exe 2236 Kazekage.exe 1488 csrss.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 1868 system32.exe 2304 smss.exe 1868 system32.exe 2312 Gaara.exe 1868 system32.exe 1648 csrss.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 2580 csrss.exe 2580 csrss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2676 smss.exe 2008 csrss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 812 Gaara.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2948 csrss.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d28-11.dat upx behavioral1/files/0x0007000000015d13-30.dat upx behavioral1/memory/2676-38-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d1e-47.dat upx behavioral1/files/0x0007000000015d28-51.dat upx behavioral1/files/0x0006000000016ca1-63.dat upx behavioral1/files/0x0008000000016c5b-59.dat upx behavioral1/files/0x0009000000015d89-55.dat upx behavioral1/memory/2664-80-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2488-89-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016ca1-108.dat upx behavioral1/files/0x0008000000016c5b-104.dat upx behavioral1/files/0x0009000000015d89-100.dat upx behavioral1/memory/1668-126-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1668-129-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2776-130-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2580-143-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d28-142.dat upx behavioral1/memory/2776-141-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0009000000015d89-151.dat upx behavioral1/memory/1872-175-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2904-174-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1872-179-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1284-189-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2276-188-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2676-187-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2276-192-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0008000000016c5b-193.dat upx behavioral1/memory/2236-201-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016ca1-212.dat upx behavioral1/memory/480-226-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2488-227-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1112-230-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1088-235-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1488-234-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1088-240-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1868-245-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2580-244-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2304-260-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2312-263-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2236-264-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1648-267-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1684-270-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2192-274-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/668-278-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1868-277-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/668-279-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2404-282-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2092-286-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2092-287-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2156-295-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1704-299-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/812-302-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/812-303-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2948-306-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2220-309-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1508-312-0x0000000000400000-0x000000000043B000-memory.dmp upx - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Gaara.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\U:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\M: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\X: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\Z: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\B: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\S: system32.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\S: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\G: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\K: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\L: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\A: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\W: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\K: Gaara.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\Y:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf csrss.exe File opened for modification \??\O:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\O:\Autorun.inf system32.exe File created \??\P:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\Q:\Autorun.inf smss.exe File created \??\U:\Autorun.inf smss.exe File opened for modification \??\O:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf smss.exe File created \??\G:\Autorun.inf Gaara.exe File created \??\T:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf csrss.exe File created \??\N:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf system32.exe File opened for modification \??\I:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf system32.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File created \??\X:\Autorun.inf csrss.exe File created \??\Y:\Autorun.inf csrss.exe File created \??\W:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\N:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf Gaara.exe File created \??\U:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\T:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\B:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification \??\Y:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\V:\Autorun.inf Gaara.exe File created \??\Y:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf csrss.exe File created \??\G:\Autorun.inf smss.exe File created \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf Kazekage.exe File created \??\O:\Autorun.inf Kazekage.exe File created \??\V:\Autorun.inf Kazekage.exe File created \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File created \??\L:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf system32.exe File created \??\Z:\Autorun.inf system32.exe File opened for modification \??\B:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\U:\Autorun.inf smss.exe File created \??\A:\Autorun.inf system32.exe File created \??\A:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File created \??\E:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification F:\Autorun.inf system32.exe File created \??\V:\Autorun.inf system32.exe File created \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf csrss.exe - Drops file in System32 directory 38 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe system32.exe File created C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\system\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe system32.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\ csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe smss.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe - Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe - Runs ping.exe 1 TTPs 28 IoCs
pid Process 2508 ping.exe 996 ping.exe 1668 ping.exe 2804 ping.exe 592 ping.exe 2640 ping.exe 2176 ping.exe 2748 ping.exe 2396 ping.exe 2316 ping.exe 1624 ping.exe 2656 ping.exe 2784 ping.exe 2540 ping.exe 1328 ping.exe 1936 ping.exe 264 ping.exe 1116 ping.exe 2476 ping.exe 1924 ping.exe 2884 ping.exe 2536 ping.exe 1508 ping.exe 656 ping.exe 1524 ping.exe 2592 ping.exe 1048 ping.exe 632 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2664 smss.exe 2488 Gaara.exe 1668 smss.exe 2776 Gaara.exe 2580 csrss.exe 1872 smss.exe 1284 Gaara.exe 2276 csrss.exe 2236 Kazekage.exe 480 smss.exe 1112 Gaara.exe 1488 csrss.exe 1088 Kazekage.exe 1868 system32.exe 2304 smss.exe 2312 Gaara.exe 1648 csrss.exe 1684 Kazekage.exe 2192 system32.exe 668 system32.exe 2404 Kazekage.exe 2092 system32.exe 2008 csrss.exe 2156 Kazekage.exe 1704 system32.exe 812 Gaara.exe 2948 csrss.exe 2220 Kazekage.exe 1508 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2676 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2236 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:480
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1936
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:632
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2476
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2656
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:656
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:264
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2884
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2540
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:668
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1328
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1116
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1924
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2176
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2536
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1624
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1668
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2804
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2748
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2640
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:996
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:812
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2396
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe
- Size 236KB
- SHA256 f8e5e7efb8a1dc2f4aae56ab917c6665607af13b225ac96bcfc1819ad47ad1a4
- MD5 3412bfc1bb9be1f9e3b405f1661b18a9
- SHA1 6104c05904cd57bf36b593ce338f1499fe5ef0e8
- SHA512 753f095295e936c4a4267e853869eeff525b21b3ff3caf39e6846b6d5039a79805d67260528fb4a7240c791cb591088bec3f158c3e0be3031c1ba28c2d242e17
- SSDEEP 1536:DDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Wox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe
- Size 236KB
- SHA256 58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
- MD5 b2739b7f6d1227761aefa9f256ed9970
- SHA1 9c3868075147e7815c13008b8e837a387387fa05
- SHA512 cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
- SSDEEP 1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe
- Size 236KB
- SHA256 fcd90c5f37b6952bd3f2495a13370cf332df40eb3274c6940bc68a4dc648800e
- MD5 fee973f247e0bbe12884a4c170da8fe9
- SHA1 ccf46679479f365db8e7531d829fa3c94e97518f
- SHA512 25c8a7be74e14d647bc6f711fe72523f06b79fb00f466b35d00b5d99588cac98c6ee8e5b110d8032cdcf652b185d29308a799647f800f98ccfec15b4e892d4a2
- SSDEEP 1536:VDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:wox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe
- Size 236KB
- SHA256 1139534ac62f937a0707e6200f953ed5e9098880845c569914238e614b69efca
- MD5 d68c0b7d15d2af8ace724b582cff672a
- SHA1 5ba5d210d609677b4b86d326ccb939e6a3d74b56
- SHA512 2e921ed66fc3f75916979e5c5559b2b0d3c37169a7b65d2bb64834de4315bb228669eb81bbfcd8b65c669039069daeb006ba686c664f4d8133571acb18a90b99
- SSDEEP 1536:EDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Lox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-5-2024.exe
- Size 236KB
- SHA256 d08a100bdd7f577a41431481607943b884289daff678815e8efc71c387e4b1f8
- MD5 0207eec289123b5c7c4c6d23ba00c025
- SHA1 a36fa3753817be724ad4d6e47a639e9f9cf1bb5b
- SHA512 cd0740df6f6fbba200a3f89bac79353383d482d628ddde1dceaf04cd24e86ecb96a79a40182153d804157d2fe4248ea1bd94ddab47dd6a908ee9c016a650dc87
- SSDEEP 1536:jDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:2ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-5-2024.exe
- Size 63KB
- SHA256 f719bb8ac9caac4dc9ce44e641391a3516d7826596146d7496f27ed367b0fd94
- MD5 93dd72a68fe11cf07935171703ffc367
- SHA1 65ed0be76d9e5f4bb0e0a1b6434e20e7e05b4419
- SHA512 525621923e5db1532fa72cc3efb6346504fd005977ee43c9ec74763c6f65484f342305a00da91fb76addd9da5a76aa34c45c4963d490ee6a5577cd960a70fc1e
- SSDEEP 1536:VDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y14:wox6AHjYzaFXg+w14
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-5-2024.exe
- Size 236KB
- SHA256 3ed047e89bfcc268666682dc6eef25949a060d936b415d82cf3b0fab2348a5b4
- MD5 59f40d4fe51a2d2431780f1354a9bf51
- SHA1 79eec2a7c212d8e7bad704e6899db6e991615d3c
- SHA512 bcfcf5adabdae58eab6fd597dbf163e9fbea0313a192ee05d3a08bcafd56f4382ab6ea631cc08875f227de1a4c4094b7749c3a72687e56da36a214af4e09cb08
- SSDEEP 1536:ODusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Nox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 0c00311d49f0aceedd41e8598ef91848f2e2a2f7373a6cd40a99bcc14fe58aaa
- MD5 af7c143227a33cec83212cde5ee7ac7c
- SHA1 4e664c30655419af6272e5fc8bfd7902bc0aa621
- SHA512 94a59d408be551f4f32b37ec98ca2880473f13f03aba4ee5973f1e09f2e9fc4e8794a66de32455ba1d547668f60a83dc92d45dac94825fbbd9c2273666c66caf
- SSDEEP 1536:PDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:yox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 8a2608da871830ce2b799951d0d208b82edff3a989735869cc32d32a842ce95d
- MD5 c320553ec5a98b19f78407f41be8d36d
- SHA1 7972634ac99a73684288dad4d1482bdeb6ba6b1c
- SHA512 a40f2a93cbc1693a7d2beeb06753c04d5536483ab8017549d194906eac9b5ce8920677b4d454931689085736a55e4ad709a93314341c2df04fce3e50a796dcd5
- SSDEEP 1536:2DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Vox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 7c45ca8df08566c135e30dc1ccb127868270f92381e2f0488221a464408fb3d1
- MD5 c2c313a0141172ae5df5d991b0040bed
- SHA1 f5a7c12b93f5cf409ee4977ecdac5add8bcde533
- SHA512 397ad7cd7a24a35739fa223af49ddc5eaabf0a9c7637802c41854483b41b8352ffcb0fe4976cc08f68ccc1a20af0f14329add378ee2c59ba93d8265de306ddde
- SSDEEP 1536:LDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:+ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 2b9769f8a86c506afa83e2ace724b4149cb86ef1269387c4346bfbf462cddace
- MD5 7987b40ff701218579f7328c096842dc
- SHA1 b72ecb91bf49140d4801ade8c083c3d65fb1f77c
- SHA512 6af04a6b414b7a8d4ecb557fe5eb6c2b202acb7742043c47a4867a937871a01b541be557aa95d61582c7c93e6ba673db3eb783f00254c6b599d4d7c71ac209b6
- SSDEEP 1536:9DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Yox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 97ccab657d668dbc8ef58f12b67daed7aaa0ad6de6c4fe67297a81fb1e26c3fe
- MD5 86bcafd8b4f12a22a7b333695f5aa11b
- SHA1 0a3d3adb360bd5d3b7e5788177a6d2aa3cd2fd19
- SHA512 3da44e1ad0e0ca0c5123d954ab3181b1fa89b5c28d8873ce29baabf9062045c811cf52e940eb00c66b6f4e67777ea57dc1cce5222c1e24431b01dca2c2f153ab
- SSDEEP 1536:CDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:xox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\msvbvm60.dll
- Size 762KB
- SHA256 5ef9079a0fd4feac911cfa17da29e339e1b7751772aced34a7edc04162df8918
- MD5 0f5d2f66c4e06ebf95ac153f970c0b5a
- SHA1 53de34a837cfeb95382c9c6ab709f08a2c76ccac
- SHA512 458c962ad4a13e7e3b23955c4195841b2046bd6acf78b51e4b9be62c43350bfa6057eb259d393495e65b07c631060d2d027a023165528b9c59fc9889c3fbe5b0
- SSDEEP 12288:Ll+yYhca4obtayx8LtMOlEVcQtDpyBw2fO+wgwoMZHsl8pIf7ngic9G+QryQF63G:LlDYRayxYMsEVcQtFyBw2fO+wgw7HslF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 254KB
- SHA256 8680cc3bad912183370aed028c5b4f210ba346b013105b2334476e17197583f3
- MD5 890dbc51ba4bded354d352e815c29b79
- SHA1 92c776bf6e9654b90846bb90674e33f71b4a5544
- SHA512 edc9fb5d22c228347394e593ec4950aee949bce5f7a055e1ba0e3c3ee64d1377e732e139025ffbd2bd2f22759ea100f2df325080dcd3d4220d1602b716ac9e96
- SSDEEP 6144:Ll+yY2iHcvS4/IjbAuM3yx8LtMOlEFLcQHWL01pnK:Ll+yYhca4obtayx8LtMOlEVcQtK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 1.3MB
- SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
- MD5 5343a19c618bc515ceb1695586c6c137
- SHA1 4dedae8cbde066f31c8e6b52c0baa3f8b1117742
- SHA512 708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
- SSDEEP 24576:LlDYRayxYMsEVcQtFyBw2fO+wgw7HsltDngDG+QryQF63xxWPByACxlQ6kMX1Kse:BOayxtXyrgs3DngDyyQFwxxWPcxlQ3cf
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Fonts\Admin 13 - 5 - 2024\smss.exe
- Size 236KB
- SHA256 465db24909448ebd7f283e4edbf025ba626ea97d8cbf517d4dbe8906c24bcec0
- MD5 f3d4477cc0b336f0f6a71dfbeefdf5ec
- SHA1 b998524e2a55a4edf14da3c15f8a551b3c000ed3
- SHA512 250e5650d29084e7a3c4a8806d62d46139f8f04eddbc29989665ae639f0f613b405e72cc0c56c6dc9b9897c315e4bf7f77eed55534adb3b101be6490bd9622cd
- SSDEEP 1536:7DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:uox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 2421994bff990382f0b701ef31dca567aa1f4f9fe99d46c157504c079fc07f93
- MD5 eec64ee5175c599f800568f62ec93b00
- SHA1 6046c5b9ae52821a00fdfb5e6dd4624c813534d5
- SHA512 7101761e2a51acb6ca8608470626e41cd4a4403c0d680fbc6b0fe0ed15d67eab832ed9beef3c4eb0bcedf5eec4dbb3cbce1bb0a4e72da85f0a33063f40012ebf
- SSDEEP 1536:3DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:6ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP