Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 10:25
Behavioral task
behavioral1
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe
-
Size
236KB
-
MD5
b2739b7f6d1227761aefa9f256ed9970
-
SHA1
9c3868075147e7815c13008b8e837a387387fa05
-
SHA256
58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
-
SHA512
cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
-
SSDEEP
1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe -
Executes dropped EXE 30 IoCs
pid Process 1860 smss.exe 3300 smss.exe 3676 Gaara.exe 4152 smss.exe 1912 Gaara.exe 3044 csrss.exe 2520 smss.exe 1576 Gaara.exe 1512 csrss.exe 5048 Kazekage.exe 1632 smss.exe 392 Gaara.exe 864 csrss.exe 2996 Kazekage.exe 3004 system32.exe 1292 smss.exe 2468 Gaara.exe 976 csrss.exe 1204 Kazekage.exe 3860 system32.exe 1288 system32.exe 4428 Kazekage.exe 820 system32.exe 4040 csrss.exe 5000 Kazekage.exe 4408 system32.exe 1892 Gaara.exe 2476 csrss.exe 1200 Kazekage.exe 5072 system32.exe -
Loads dropped DLL 18 IoCs
pid Process 1860 smss.exe 3300 smss.exe 3676 Gaara.exe 4152 smss.exe 1912 Gaara.exe 3044 csrss.exe 2520 smss.exe 1576 Gaara.exe 1512 csrss.exe 1632 smss.exe 392 Gaara.exe 864 csrss.exe 1292 smss.exe 2468 Gaara.exe 976 csrss.exe 4040 csrss.exe 1892 Gaara.exe 2476 csrss.exe -
resource yara_rule behavioral2/memory/1980-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023552-18.dat upx behavioral2/memory/1860-32-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x000700000002354e-31.dat upx behavioral2/files/0x0007000000023553-57.dat upx behavioral2/files/0x0007000000023552-53.dat upx behavioral2/memory/3300-72-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023551-49.dat upx behavioral2/files/0x0007000000023550-45.dat upx behavioral2/files/0x000700000002354f-41.dat upx behavioral2/memory/3300-77-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3676-75-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023551-88.dat upx behavioral2/files/0x0007000000023550-84.dat upx behavioral2/files/0x0007000000023553-96.dat upx behavioral2/files/0x0007000000023552-92.dat upx behavioral2/memory/4152-111-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1912-115-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4152-114-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1912-120-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3044-122-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023553-137.dat upx behavioral2/files/0x0007000000023552-133.dat upx behavioral2/files/0x0007000000023551-129.dat upx behavioral2/memory/2520-150-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1576-159-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1512-160-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5048-167-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1512-168-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1980-166-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023553-178.dat upx behavioral2/files/0x0007000000023551-174.dat upx behavioral2/memory/1860-191-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/392-201-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3676-200-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/864-205-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3004-212-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2996-211-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023551-218.dat upx behavioral2/memory/3044-230-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2468-237-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/976-238-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1204-239-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1204-242-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5048-243-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3860-246-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1288-249-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/820-255-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4428-256-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/820-259-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3004-262-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4040-265-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5000-266-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4408-269-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1892-272-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2476-275-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1200-278-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5072-281-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\L:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification D:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\P:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\L:\Desktop.ini Kazekage.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\U:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini Kazekage.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification C:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\S:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini system32.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\N:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\V:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification D:\Desktop.ini smss.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: smss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\J: system32.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\T: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\V: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\Q: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\O: Gaara.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\B: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\E: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\H: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\W: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\J: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\G: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\S: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\R: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\U: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\X: b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\T: Kazekage.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\R:\Autorun.inf system32.exe File created \??\U:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf system32.exe File opened for modification \??\I:\Autorun.inf csrss.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\I:\Autorun.inf Gaara.exe File opened for modification \??\Y:\Autorun.inf Gaara.exe File opened for modification \??\X:\Autorun.inf csrss.exe File created \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\K:\Autorun.inf system32.exe File created \??\K:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\M:\Autorun.inf Gaara.exe File opened for modification \??\X:\Autorun.inf smss.exe File opened for modification \??\N:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\J:\Autorun.inf smss.exe File opened for modification \??\A:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\A:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\U:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf Kazekage.exe File opened for modification F:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\A:\Autorun.inf smss.exe File created \??\H:\Autorun.inf smss.exe File opened for modification \??\Q:\Autorun.inf smss.exe File created \??\U:\Autorun.inf Gaara.exe File created \??\Y:\Autorun.inf csrss.exe File opened for modification \??\X:\Autorun.inf system32.exe File opened for modification \??\B:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\B:\Autorun.inf smss.exe File opened for modification \??\E:\Autorun.inf Gaara.exe File opened for modification \??\N:\Autorun.inf Gaara.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File created \??\O:\Autorun.inf system32.exe File opened for modification \??\L:\Autorun.inf smss.exe File created \??\M:\Autorun.inf smss.exe File opened for modification \??\M:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\H:\Autorun.inf smss.exe File opened for modification \??\K:\Autorun.inf smss.exe File created \??\S:\Autorun.inf smss.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification \??\J:\Autorun.inf Kazekage.exe File created \??\G:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\K:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\N:\Autorun.inf system32.exe File created \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf system32.exe File created \??\W:\Autorun.inf smss.exe File opened for modification C:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf csrss.exe File opened for modification \??\R:\Autorun.inf Kazekage.exe File opened for modification \??\O:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\Y:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\P:\Autorun.inf csrss.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created \??\Q:\Autorun.inf b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification \??\Z:\Autorun.inf csrss.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe Kazekage.exe File created C:\Windows\SysWOW64\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\13-5-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\13-5-2024.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File created C:\Windows\system\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\The Kazekage.jpg b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\ b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\system\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe csrss.exe File created C:\Windows\mscomctl.ocx b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\system\mscoree.dll b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\msvbvm60.dll smss.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe system32.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe -
Modifies Control Panel 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop smss.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main smss.exe -
Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe -
Runs ping.exe 1 TTPs 34 IoCs
pid Process 3600 ping.exe 4072 ping.exe 4984 ping.exe 4616 ping.exe 1288 ping.exe 2976 ping.exe 1996 ping.exe 1104 ping.exe 840 ping.exe 2024 ping.exe 4532 ping.exe 4920 ping.exe 4304 ping.exe 3588 ping.exe 1488 ping.exe 4588 ping.exe 1032 ping.exe 3180 ping.exe 1420 ping.exe 4308 ping.exe 4772 ping.exe 4432 ping.exe 4404 ping.exe 4592 ping.exe 2496 ping.exe 4808 ping.exe 4480 ping.exe 3612 ping.exe 2272 ping.exe 1108 ping.exe 3620 ping.exe 2964 ping.exe 2300 ping.exe 4356 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3676 Gaara.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 3044 csrss.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe 5048 Kazekage.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 1980 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 1860 smss.exe 3300 smss.exe 3676 Gaara.exe 4152 smss.exe 1912 Gaara.exe 3044 csrss.exe 2520 smss.exe 1576 Gaara.exe 1512 csrss.exe 5048 Kazekage.exe 1632 smss.exe 392 Gaara.exe 864 csrss.exe 2996 Kazekage.exe 3004 system32.exe 1292 smss.exe 2468 Gaara.exe 976 csrss.exe 1204 Kazekage.exe 3860 system32.exe 1288 system32.exe 4428 Kazekage.exe 820 system32.exe 4040 csrss.exe 5000 Kazekage.exe 4408 system32.exe 1892 Gaara.exe 2476 csrss.exe 1200 Kazekage.exe 5072 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1860 1980 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 91 PID 1980 wrote to memory of 1860 1980 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 91 PID 1980 wrote to memory of 1860 1980 b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe 91 PID 1860 wrote to memory of 3300 1860 smss.exe 93 PID 1860 wrote to memory of 3300 1860 smss.exe 93 PID 1860 wrote to memory of 3300 1860 smss.exe 93 PID 1860 wrote to memory of 3676 1860 smss.exe 96 PID 1860 wrote to memory of 3676 1860 smss.exe 96 PID 1860 wrote to memory of 3676 1860 smss.exe 96 PID 3676 wrote to memory of 4152 3676 Gaara.exe 97 PID 3676 wrote to memory of 4152 3676 Gaara.exe 97 PID 3676 wrote to memory of 4152 3676 Gaara.exe 97 PID 3676 wrote to memory of 1912 3676 Gaara.exe 98 PID 3676 wrote to memory of 1912 3676 Gaara.exe 98 PID 3676 wrote to memory of 1912 3676 Gaara.exe 98 PID 3676 wrote to memory of 3044 3676 Gaara.exe 99 PID 3676 wrote to memory of 3044 3676 Gaara.exe 99 PID 3676 wrote to memory of 3044 3676 Gaara.exe 99 PID 3044 wrote to memory of 2520 3044 csrss.exe 100 PID 3044 wrote to memory of 2520 3044 csrss.exe 100 PID 3044 wrote to memory of 2520 3044 csrss.exe 100 PID 3044 wrote to memory of 1576 3044 csrss.exe 102 PID 3044 wrote to memory of 1576 3044 csrss.exe 102 PID 3044 wrote to memory of 1576 3044 csrss.exe 102 PID 3044 wrote to memory of 1512 3044 csrss.exe 103 PID 3044 wrote to memory of 1512 3044 csrss.exe 103 PID 3044 wrote to memory of 1512 3044 csrss.exe 103 PID 3044 wrote to memory of 5048 3044 csrss.exe 104 PID 3044 wrote to memory of 5048 3044 csrss.exe 104 PID 3044 wrote to memory of 5048 3044 csrss.exe 104 PID 5048 wrote to memory of 1632 5048 Kazekage.exe 105 PID 5048 wrote to memory of 1632 5048 Kazekage.exe 105 PID 5048 wrote to memory of 1632 5048 Kazekage.exe 105 PID 5048 wrote to memory of 392 5048 Kazekage.exe 106 PID 5048 wrote to memory of 392 5048 Kazekage.exe 106 PID 5048 wrote to memory of 392 5048 Kazekage.exe 106 PID 5048 wrote to memory of 864 5048 Kazekage.exe 107 PID 5048 wrote to memory of 864 5048 Kazekage.exe 107 PID 5048 wrote to memory of 864 5048 Kazekage.exe 107 PID 5048 wrote to memory of 2996 5048 Kazekage.exe 108 PID 5048 wrote to memory of 2996 5048 Kazekage.exe 108 PID 5048 wrote to memory of 2996 5048 Kazekage.exe 108 PID 5048 wrote to memory of 3004 5048 Kazekage.exe 110 PID 5048 wrote to memory of 3004 5048 Kazekage.exe 110 PID 5048 wrote to memory of 3004 5048 Kazekage.exe 110 PID 3004 wrote to memory of 1292 3004 system32.exe 111 PID 3004 wrote to memory of 1292 3004 system32.exe 111 PID 3004 wrote to memory of 1292 3004 system32.exe 111 PID 3004 wrote to memory of 2468 3004 system32.exe 112 PID 3004 wrote to memory of 2468 3004 system32.exe 112 PID 3004 wrote to memory of 2468 3004 system32.exe 112 PID 3004 wrote to memory of 976 3004 system32.exe 113 PID 3004 wrote to memory of 976 3004 system32.exe 113 PID 3004 wrote to memory of 976 3004 system32.exe 113 PID 3004 wrote to memory of 1204 3004 system32.exe 114 PID 3004 wrote to memory of 1204 3004 system32.exe 114 PID 3004 wrote to memory of 1204 3004 system32.exe 114 PID 3004 wrote to memory of 3860 3004 system32.exe 115 PID 3004 wrote to memory of 3860 3004 system32.exe 115 PID 3004 wrote to memory of 3860 3004 system32.exe 115 PID 3044 wrote to memory of 1288 3044 csrss.exe 116 PID 3044 wrote to memory of 1288 3044 csrss.exe 116 PID 3044 wrote to memory of 1288 3044 csrss.exe 116 PID 3676 wrote to memory of 4428 3676 Gaara.exe 117 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3676 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4152
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3044 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5048 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:392
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3004 -
C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4308
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4772
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3620
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1104
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4480
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3180
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2976
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2496
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:4592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:840
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:4808
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1420
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2024
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:4072
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1108
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3612
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2300
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4356
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3600
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2272
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3588
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4588
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4432
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5000
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4404
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1288
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1488
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4616
-
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4304
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:4532
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1996
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:4920
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4984
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:81⤵PID:1064
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
Filesize
236KB
MD5fa4d516270abf380423c8e3520597775
SHA194ed2ed01408c8d8193dabdebae246090a41bd13
SHA256c1659bad99d3de2d7bff99a1a02b9ae3fe8269b7e495f35d849ba3d654f80488
SHA51224d3934e33dd2ec58d611035acf4148ebc5948b81b72bec91a9eb7404b53a3a0300693a93b97b61e9196d04d04ec8a0dfec23e06f30ec669f5221e764194f1bb
-
Filesize
236KB
MD5ecbd72e83c6526f8b04c7499c3e063c9
SHA12c36e51dc6d655c98463b6b9171f040506ecfdc2
SHA25673050ecb18a3899ee43081ba6f4aa7556647c6bfbf186fc147f9ed584d103b3e
SHA512972d7634427234f625c2bc8b75f6848c4b6310f9f7ba77e984490698f922b5b4c6f4b0ebfc93aec4cf7cb1f91bad4612507f6e4051fcfefd626a18dd4c73d924
-
Filesize
236KB
MD5fe32c87dfb13528bb8befa1edcfcd4e4
SHA1a817c88790c85184f122d9091ca16f57fc0dfdb3
SHA2563008c6068b2f99c38dc5c26cef3f72f490e3de9ca47a6e8be32e31e9c269decf
SHA5120bc22664fa8bdd069681792e4c3b445d50ff161eb8207ff81149c1e971d756ae2fc596782e5021e9af15e0d17ab150bb8b6e2f986e8687824f1bf5f34ddb3e4e
-
Filesize
236KB
MD5aef2ed7d07d9c6ec77422f17a9ad84ce
SHA1ba5fa17c159b27fc9762b1632d082a9c96306feb
SHA256a5bfd4b66dcdfe1a370f1416c8c29883ada56a80a71220b89351e35e867c9665
SHA512df435998e9b42821c9c8137e871079152521d9ffca316e4feee5f604b060e7dc69c78b708763d4366c79ae5c22cfe4ee3124dc2f45980e3be2c1ef8b73b782e3
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
236KB
MD51cf439ee0548aebc9508337d4f27c170
SHA1c2cbcf4c4ad37850dbcc40c8b49a9266deccd3a0
SHA2563c3b3b16fd964743a83f3c0f22617184bcde80e89e4649c7ba8fa1cfe9b5d920
SHA512a528c4b58e3f473def09f98bdd9b9d285b3dcb7eda69b8c1a9bbf7704d7e68e07d351ae857119e0d111ab08621031be75377cfb01b267163741859c05105a7d3
-
Filesize
236KB
MD5a35d894e122d876b6c4cb7805ff63d44
SHA171bb98d70826372fd13435d296328811ddc74f27
SHA2562b82f98f439c4c8b1aaadabf65efc0c7a85965565941b6fceb4d16bd8641bf06
SHA512bcf8e628c5fb3b61108a328f0914579a02cd95e0a311da18b99f92a1b1bbf3ead6c170be8d8b83183bd8000c3ba8815f98642a910309bcf346b3932a39757108
-
Filesize
236KB
MD5fda515d9a49cbe696bf31c76b3c8999d
SHA1ca00877268d2b048eec820685d45898f73c38fbf
SHA2566bf56dc0d66b90c9944850f4dc7a55e11655faef443d247b03b477a1024b4759
SHA512916dc635c7140c5468a198f105d4459cc439a84a41f4f6264c41f008e41b908adb8e21a111b1a477da388615ce3442522ad7127ee65db512aff84b95fc528163
-
Filesize
236KB
MD5f38b1e193390c463ca2ab3c6a149b034
SHA1d467ad54d7ad482413f22543442696d6936b1bc5
SHA2564072fe1c253d8d02dbdd58435d28f208d96a29a1c50c79dc10499e9b3fe06278
SHA512bd9367a379a30748202bf9e13825d48e247277608020506b0fc69aeb28edc8892eed8350f053cae86f8c82f8bda77741ac999de4d6059fcc589d23e45ddb5dbe
-
Filesize
236KB
MD54245607b10555ae6dc2a09c393c24570
SHA15c469a3cd6252cdbbfd12601a58cf7295a91ad36
SHA2564090c7bcae7b528ac496c02390988bc7d88cc37d236fe1eea1d9009d4f3d1944
SHA512bcecf6b57195428d7b4865d193425b32ac57306fd4f6497df90cb3b6fae53aa890ac341b319045d2bb4b9787bb05827242b82e42b04fc31bdaecc1114e337e89
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
236KB
MD52e4fb84b11fdefca70dde890e60baa9c
SHA1a2f4d9d079fe3a69fbc004b953a65f3065f36e88
SHA2561e5b2c8c11cfae0bb53be7fbda633778c6efecd6e18eb368c7bb40b3fc4066b0
SHA512488acc2a2c28c4b4ee7aa208ea2bce30125e53a635efa16de0f8a6c5589602701f4445155bfaa607784deebf8e844ceaac86022a6cd28a6cfc21f3064929e190
-
Filesize
236KB
MD56f3e0050880d6525738710a877727b05
SHA19356ee27a9d08c50120428b5692d186e91e438e6
SHA2565130857d2c72e3832b77a88096c4c6c4065d518876883575f677f151f90b349d
SHA512d2575a0e8e12c3421c410abff4007c49fc53ea7975fd2312962157a87a3471bdd9b84c4ab05f58bd9e87fadc157d7fba3c697cdf11d259f26700a5eee73b728e
-
Filesize
236KB
MD5eec64ee5175c599f800568f62ec93b00
SHA16046c5b9ae52821a00fdfb5e6dd4624c813534d5
SHA2562421994bff990382f0b701ef31dca567aa1f4f9fe99d46c157504c079fc07f93
SHA5127101761e2a51acb6ca8608470626e41cd4a4403c0d680fbc6b0fe0ed15d67eab832ed9beef3c4eb0bcedf5eec4dbb3cbce1bb0a4e72da85f0a33063f40012ebf
-
Filesize
236KB
MD5075e0ad1c8298e7b03b1e76c90e45222
SHA13f360c145156f87c0b51c545cd6023a181c2c2c6
SHA2564cd918f25a2e895a0ed7ffddb46bffce87d7196f7ea11361aebfad1662b84049
SHA5126235e12b45187489b7b78993c915782c4382e6312a4142d22d54cf80a9c39b81782413d91d37705bff624f783756f388c3b57503c4aeb0c5a1d7be68607424fd
-
Filesize
236KB
MD5456d1e63e88a0f18f118bc965faf7cfa
SHA19e0c05689583f56cd01e4f303a29ae39520ed445
SHA25603e25226168cdcae6a9c0e14b753eccc979028089562375d6a4e3845b8155f15
SHA512740529570e6f0485c78370f0e73c10db88aca9955f1a1fc958b04c4f0379434ac8819c74260d7440a560b705ce4abd2c068da113d97e7f5da1b2279ddbebb0f1
-
Filesize
236KB
MD5b1cf06d4594906680d71c5f11e05614b
SHA13b6abd6cc8c71340f386e3b973eb0f85e1011f42
SHA256120a5394cac4089d28977d3ddf9a4708b29e785a247719ea7b7eedbb0e5bb9c9
SHA5121fcd62e17f3a28bb0e78766d99ebd42fa20ae4d5e3f512de5a4e4a529e741e88fa029958fb37915e2381811f01466ed523bdc7c8e6ca0e8641d4f63ead37cb04
-
Filesize
236KB
MD529eb6ff8a664ad5ce1e461f4043c0fb0
SHA1081889330cf83b2954504e192fa8a5ff0ee1e649
SHA25693bcaaf56727c23a5d7841c4607ca843ecfdeacde638eed3ebb891e3ccddaaaf
SHA5120adbfb03789575f12ddbf9c0d2e2a700c98b3b231b1fa8736d364b92513f0afd814344b8b5e2c1a69390d9ce76308d2a234048214e992e20249b49a762eaea02
-
Filesize
236KB
MD5432bf4990c150c818b09e5d1ff317264
SHA10615a5b7f477b0d058bd07b78f33f1e809272665
SHA256c09866674246250f52ca9a3552d7eb90d324161e559b2af85efac87d439dc218
SHA5124c29e992743056bb5133a935391cf6ecd9d27d9674b4fb45e2c0f2920f79ade69271880852b7a7cbc7eff600781561147c27ff182f5ed3f7af0fa12f9d9dd5ec
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a