Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 10:25
Behavioral task
behavioral1
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
-
Size
236KB
-
MD5
b2739b7f6d1227761aefa9f256ed9970
-
SHA1
9c3868075147e7815c13008b8e837a387387fa05
-
SHA256
58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
-
SHA512
cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
-
SSDEEP
1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe -
Executes dropped EXE 30 IoCs
pid Process 2676 smss.exe 2664 smss.exe 2488 Gaara.exe 1668 smss.exe 2776 Gaara.exe 2580 csrss.exe 1872 smss.exe 1284 Gaara.exe 2276 csrss.exe 2236 Kazekage.exe 480 smss.exe 1112 Gaara.exe 1488 csrss.exe 1088 Kazekage.exe 1868 system32.exe 2304 smss.exe 2312 Gaara.exe 1648 csrss.exe 1684 Kazekage.exe 2192 system32.exe 668 system32.exe 2404 Kazekage.exe 2092 system32.exe 2008 csrss.exe 2156 Kazekage.exe 1704 system32.exe 812 Gaara.exe 2948 csrss.exe 2220 Kazekage.exe 1508 system32.exe -
Loads dropped DLL 63 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2676 smss.exe 2664 smss.exe 2676 smss.exe 2676 smss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 1668 smss.exe 2488 Gaara.exe 2776 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2580 csrss.exe 2580 csrss.exe 1872 smss.exe 2580 csrss.exe 1284 Gaara.exe 2276 csrss.exe 2580 csrss.exe 2580 csrss.exe 2236 Kazekage.exe 480 smss.exe 2236 Kazekage.exe 1112 Gaara.exe 2236 Kazekage.exe 1488 csrss.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 1868 system32.exe 2304 smss.exe 1868 system32.exe 2312 Gaara.exe 1868 system32.exe 1648 csrss.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 2580 csrss.exe 2580 csrss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2676 smss.exe 2008 csrss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 812 Gaara.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2948 csrss.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d28-11.dat upx behavioral1/files/0x0007000000015d13-30.dat upx behavioral1/memory/2676-38-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d1e-47.dat upx behavioral1/files/0x0007000000015d28-51.dat upx behavioral1/files/0x0006000000016ca1-63.dat upx behavioral1/files/0x0008000000016c5b-59.dat upx behavioral1/files/0x0009000000015d89-55.dat upx behavioral1/memory/2664-80-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2488-89-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016ca1-108.dat upx behavioral1/files/0x0008000000016c5b-104.dat upx behavioral1/files/0x0009000000015d89-100.dat upx behavioral1/memory/1668-126-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1668-129-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2776-130-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2580-143-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015d28-142.dat upx behavioral1/memory/2776-141-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0009000000015d89-151.dat upx behavioral1/memory/1872-175-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2904-174-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1872-179-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1284-189-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2276-188-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2676-187-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2276-192-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0008000000016c5b-193.dat upx behavioral1/memory/2236-201-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016ca1-212.dat upx behavioral1/memory/480-226-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2488-227-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1112-230-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1088-235-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1488-234-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1088-240-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1868-245-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2580-244-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2304-260-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2312-263-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2236-264-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1648-267-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1684-270-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2192-274-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/668-278-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1868-277-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/668-279-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2404-282-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2092-286-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2092-287-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2156-295-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1704-299-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/812-302-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/812-303-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2948-306-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2220-309-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1508-312-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Gaara.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\U:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\M: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\X: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\Z: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\B: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\S: system32.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\S: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\G: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\K: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\L: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\A: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\W: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\K: Gaara.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\Y:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf csrss.exe File opened for modification \??\O:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\O:\Autorun.inf system32.exe File created \??\P:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\Q:\Autorun.inf smss.exe File created \??\U:\Autorun.inf smss.exe File opened for modification \??\O:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf smss.exe File created \??\G:\Autorun.inf Gaara.exe File created \??\T:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf csrss.exe File created \??\N:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf system32.exe File opened for modification \??\I:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf system32.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File created \??\X:\Autorun.inf csrss.exe File created \??\Y:\Autorun.inf csrss.exe File created \??\W:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\N:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf Gaara.exe File created \??\U:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\T:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\B:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification \??\Y:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\V:\Autorun.inf Gaara.exe File created \??\Y:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf csrss.exe File created \??\G:\Autorun.inf smss.exe File created \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf Kazekage.exe File created \??\O:\Autorun.inf Kazekage.exe File created \??\V:\Autorun.inf Kazekage.exe File created \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File created \??\L:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf system32.exe File created \??\Z:\Autorun.inf system32.exe File opened for modification \??\B:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\U:\Autorun.inf smss.exe File created \??\A:\Autorun.inf system32.exe File created \??\A:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File created \??\E:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification F:\Autorun.inf system32.exe File created \??\V:\Autorun.inf system32.exe File created \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf csrss.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe system32.exe File created C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\system\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe system32.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\ csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe smss.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe -
Runs ping.exe 1 TTPs 28 IoCs
pid Process 2508 ping.exe 996 ping.exe 1668 ping.exe 2804 ping.exe 592 ping.exe 2640 ping.exe 2176 ping.exe 2748 ping.exe 2396 ping.exe 2316 ping.exe 1624 ping.exe 2656 ping.exe 2784 ping.exe 2540 ping.exe 1328 ping.exe 1936 ping.exe 264 ping.exe 1116 ping.exe 2476 ping.exe 1924 ping.exe 2884 ping.exe 2536 ping.exe 1508 ping.exe 656 ping.exe 1524 ping.exe 2592 ping.exe 1048 ping.exe 632 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2676 smss.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2488 Gaara.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2580 csrss.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 2236 Kazekage.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe 1868 system32.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 2676 smss.exe 2664 smss.exe 2488 Gaara.exe 1668 smss.exe 2776 Gaara.exe 2580 csrss.exe 1872 smss.exe 1284 Gaara.exe 2276 csrss.exe 2236 Kazekage.exe 480 smss.exe 1112 Gaara.exe 1488 csrss.exe 1088 Kazekage.exe 1868 system32.exe 2304 smss.exe 2312 Gaara.exe 1648 csrss.exe 1684 Kazekage.exe 2192 system32.exe 668 system32.exe 2404 Kazekage.exe 2092 system32.exe 2008 csrss.exe 2156 Kazekage.exe 1704 system32.exe 812 Gaara.exe 2948 csrss.exe 2220 Kazekage.exe 1508 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2676 2904 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 28 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2664 2676 smss.exe 29 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2676 wrote to memory of 2488 2676 smss.exe 30 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 1668 2488 Gaara.exe 31 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2776 2488 Gaara.exe 32 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2488 wrote to memory of 2580 2488 Gaara.exe 33 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1872 2580 csrss.exe 34 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 1284 2580 csrss.exe 35 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2276 2580 csrss.exe 36 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2580 wrote to memory of 2236 2580 csrss.exe 37 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 480 2236 Kazekage.exe 38 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1112 2236 Kazekage.exe 39 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1488 2236 Kazekage.exe 40 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1088 2236 Kazekage.exe 41 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 2236 wrote to memory of 1868 2236 Kazekage.exe 42 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 PID 1868 wrote to memory of 2304 1868 system32.exe 43 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2676 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2236 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:480
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1936
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:632
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2476
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2656
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:656
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:264
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2884
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2540
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:668
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1328
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1116
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1924
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2176
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2536
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1624
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1668
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2804
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2748
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2640
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:996
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:812
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2396
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
Filesize
236KB
MD53412bfc1bb9be1f9e3b405f1661b18a9
SHA16104c05904cd57bf36b593ce338f1499fe5ef0e8
SHA256f8e5e7efb8a1dc2f4aae56ab917c6665607af13b225ac96bcfc1819ad47ad1a4
SHA512753f095295e936c4a4267e853869eeff525b21b3ff3caf39e6846b6d5039a79805d67260528fb4a7240c791cb591088bec3f158c3e0be3031c1ba28c2d242e17
-
Filesize
236KB
MD5b2739b7f6d1227761aefa9f256ed9970
SHA19c3868075147e7815c13008b8e837a387387fa05
SHA25658676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
SHA512cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
-
Filesize
236KB
MD5fee973f247e0bbe12884a4c170da8fe9
SHA1ccf46679479f365db8e7531d829fa3c94e97518f
SHA256fcd90c5f37b6952bd3f2495a13370cf332df40eb3274c6940bc68a4dc648800e
SHA51225c8a7be74e14d647bc6f711fe72523f06b79fb00f466b35d00b5d99588cac98c6ee8e5b110d8032cdcf652b185d29308a799647f800f98ccfec15b4e892d4a2
-
Filesize
236KB
MD5d68c0b7d15d2af8ace724b582cff672a
SHA15ba5d210d609677b4b86d326ccb939e6a3d74b56
SHA2561139534ac62f937a0707e6200f953ed5e9098880845c569914238e614b69efca
SHA5122e921ed66fc3f75916979e5c5559b2b0d3c37169a7b65d2bb64834de4315bb228669eb81bbfcd8b65c669039069daeb006ba686c664f4d8133571acb18a90b99
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
236KB
MD50207eec289123b5c7c4c6d23ba00c025
SHA1a36fa3753817be724ad4d6e47a639e9f9cf1bb5b
SHA256d08a100bdd7f577a41431481607943b884289daff678815e8efc71c387e4b1f8
SHA512cd0740df6f6fbba200a3f89bac79353383d482d628ddde1dceaf04cd24e86ecb96a79a40182153d804157d2fe4248ea1bd94ddab47dd6a908ee9c016a650dc87
-
Filesize
63KB
MD593dd72a68fe11cf07935171703ffc367
SHA165ed0be76d9e5f4bb0e0a1b6434e20e7e05b4419
SHA256f719bb8ac9caac4dc9ce44e641391a3516d7826596146d7496f27ed367b0fd94
SHA512525621923e5db1532fa72cc3efb6346504fd005977ee43c9ec74763c6f65484f342305a00da91fb76addd9da5a76aa34c45c4963d490ee6a5577cd960a70fc1e
-
Filesize
236KB
MD559f40d4fe51a2d2431780f1354a9bf51
SHA179eec2a7c212d8e7bad704e6899db6e991615d3c
SHA2563ed047e89bfcc268666682dc6eef25949a060d936b415d82cf3b0fab2348a5b4
SHA512bcfcf5adabdae58eab6fd597dbf163e9fbea0313a192ee05d3a08bcafd56f4382ab6ea631cc08875f227de1a4c4094b7749c3a72687e56da36a214af4e09cb08
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
236KB
MD5af7c143227a33cec83212cde5ee7ac7c
SHA14e664c30655419af6272e5fc8bfd7902bc0aa621
SHA2560c00311d49f0aceedd41e8598ef91848f2e2a2f7373a6cd40a99bcc14fe58aaa
SHA51294a59d408be551f4f32b37ec98ca2880473f13f03aba4ee5973f1e09f2e9fc4e8794a66de32455ba1d547668f60a83dc92d45dac94825fbbd9c2273666c66caf
-
Filesize
236KB
MD5c320553ec5a98b19f78407f41be8d36d
SHA17972634ac99a73684288dad4d1482bdeb6ba6b1c
SHA2568a2608da871830ce2b799951d0d208b82edff3a989735869cc32d32a842ce95d
SHA512a40f2a93cbc1693a7d2beeb06753c04d5536483ab8017549d194906eac9b5ce8920677b4d454931689085736a55e4ad709a93314341c2df04fce3e50a796dcd5
-
Filesize
236KB
MD5c2c313a0141172ae5df5d991b0040bed
SHA1f5a7c12b93f5cf409ee4977ecdac5add8bcde533
SHA2567c45ca8df08566c135e30dc1ccb127868270f92381e2f0488221a464408fb3d1
SHA512397ad7cd7a24a35739fa223af49ddc5eaabf0a9c7637802c41854483b41b8352ffcb0fe4976cc08f68ccc1a20af0f14329add378ee2c59ba93d8265de306ddde
-
Filesize
236KB
MD57987b40ff701218579f7328c096842dc
SHA1b72ecb91bf49140d4801ade8c083c3d65fb1f77c
SHA2562b9769f8a86c506afa83e2ace724b4149cb86ef1269387c4346bfbf462cddace
SHA5126af04a6b414b7a8d4ecb557fe5eb6c2b202acb7742043c47a4867a937871a01b541be557aa95d61582c7c93e6ba673db3eb783f00254c6b599d4d7c71ac209b6
-
Filesize
236KB
MD586bcafd8b4f12a22a7b333695f5aa11b
SHA10a3d3adb360bd5d3b7e5788177a6d2aa3cd2fd19
SHA25697ccab657d668dbc8ef58f12b67daed7aaa0ad6de6c4fe67297a81fb1e26c3fe
SHA5123da44e1ad0e0ca0c5123d954ab3181b1fa89b5c28d8873ce29baabf9062045c811cf52e940eb00c66b6f4e67777ea57dc1cce5222c1e24431b01dca2c2f153ab
-
Filesize
762KB
MD50f5d2f66c4e06ebf95ac153f970c0b5a
SHA153de34a837cfeb95382c9c6ab709f08a2c76ccac
SHA2565ef9079a0fd4feac911cfa17da29e339e1b7751772aced34a7edc04162df8918
SHA512458c962ad4a13e7e3b23955c4195841b2046bd6acf78b51e4b9be62c43350bfa6057eb259d393495e65b07c631060d2d027a023165528b9c59fc9889c3fbe5b0
-
Filesize
254KB
MD5890dbc51ba4bded354d352e815c29b79
SHA192c776bf6e9654b90846bb90674e33f71b4a5544
SHA2568680cc3bad912183370aed028c5b4f210ba346b013105b2334476e17197583f3
SHA512edc9fb5d22c228347394e593ec4950aee949bce5f7a055e1ba0e3c3ee64d1377e732e139025ffbd2bd2f22759ea100f2df325080dcd3d4220d1602b716ac9e96
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
236KB
MD5f3d4477cc0b336f0f6a71dfbeefdf5ec
SHA1b998524e2a55a4edf14da3c15f8a551b3c000ed3
SHA256465db24909448ebd7f283e4edbf025ba626ea97d8cbf517d4dbe8906c24bcec0
SHA512250e5650d29084e7a3c4a8806d62d46139f8f04eddbc29989665ae639f0f613b405e72cc0c56c6dc9b9897c315e4bf7f77eed55534adb3b101be6490bd9622cd
-
Filesize
236KB
MD5eec64ee5175c599f800568f62ec93b00
SHA16046c5b9ae52821a00fdfb5e6dd4624c813534d5
SHA2562421994bff990382f0b701ef31dca567aa1f4f9fe99d46c157504c079fc07f93
SHA5127101761e2a51acb6ca8608470626e41cd4a4403c0d680fbc6b0fe0ed15d67eab832ed9beef3c4eb0bcedf5eec4dbb3cbce1bb0a4e72da85f0a33063f40012ebf