Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee24f786714000111146a1a260147745_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee24f786714000111146a1a260147745_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
ee24f786714000111146a1a260147745_NeikiAnalytics.exe
-
Size
145KB
-
MD5
ee24f786714000111146a1a260147745
-
SHA1
215aece16ee06eeac9ba46d39e6e23704c747fe2
-
SHA256
3a253fb4fcd87497dd4d8d4b2aaba8560b6d8457a38165a1eabd77c47fb37eef
-
SHA512
4e2d15e9998ab60cb835fd8bfb98ed56717c39c7c1455f5e9f3a393067513eded754cb2f0091c157c5f2be67d6e5848a4d37ee5d5b33df3beef1c9b6090ab57f
-
SSDEEP
1536:GJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:mx6AHjYzaFXg+w17jsgS/jHagQg19V
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ee24f786714000111146a1a260147745_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Kazekage.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\SysWOW64\drivers\system32.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe -
Executes dropped EXE 30 IoCs
pid Process 3612 smss.exe 3504 smss.exe 3980 Gaara.exe 388 smss.exe 3332 Gaara.exe 2172 csrss.exe 3372 smss.exe 4440 Gaara.exe 1864 csrss.exe 2724 Kazekage.exe 1712 smss.exe 880 Gaara.exe 2816 csrss.exe 4248 Kazekage.exe 1672 system32.exe 2072 smss.exe 3532 Gaara.exe 4056 csrss.exe 3972 Kazekage.exe 548 system32.exe 5116 system32.exe 4800 Kazekage.exe 3032 system32.exe 3900 csrss.exe 1336 Kazekage.exe 1008 system32.exe 1560 Gaara.exe 8 csrss.exe 5048 Kazekage.exe 4348 system32.exe -
Loads dropped DLL 18 IoCs
pid Process 3612 smss.exe 3504 smss.exe 3980 Gaara.exe 388 smss.exe 3332 Gaara.exe 2172 csrss.exe 3372 smss.exe 4440 Gaara.exe 1864 csrss.exe 1712 smss.exe 880 Gaara.exe 2816 csrss.exe 2072 smss.exe 3532 Gaara.exe 4056 csrss.exe 3900 csrss.exe 1560 Gaara.exe 8 csrss.exe -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 20 - 5 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "20-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 20 - 5 - 2024\\smss.exe" Gaara.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification \??\Z:\Desktop.ini Kazekage.exe File opened for modification \??\N:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\J:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\N:\Desktop.ini system32.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\J:\Desktop.ini Gaara.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\A: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\I: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\O: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\X: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\Y: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\J: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\U: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\E: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\W: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\B: ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\S: system32.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\T: system32.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\P:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\H:\Autorun.inf Gaara.exe File opened for modification C:\Autorun.inf system32.exe File created \??\E:\Autorun.inf smss.exe File created \??\G:\Autorun.inf smss.exe File opened for modification \??\I:\Autorun.inf smss.exe File created \??\T:\Autorun.inf smss.exe File created \??\U:\Autorun.inf Gaara.exe File created \??\V:\Autorun.inf csrss.exe File opened for modification \??\R:\Autorun.inf Kazekage.exe File opened for modification C:\Autorun.inf Gaara.exe File created \??\Z:\Autorun.inf csrss.exe File opened for modification D:\Autorun.inf Kazekage.exe File opened for modification \??\H:\Autorun.inf Kazekage.exe File created \??\L:\Autorun.inf Kazekage.exe File created \??\X:\Autorun.inf system32.exe File created \??\K:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\M:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\Q:\Autorun.inf smss.exe File created \??\O:\Autorun.inf Kazekage.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\A:\Autorun.inf smss.exe File opened for modification \??\A:\Autorun.inf system32.exe File created \??\W:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File created \??\N:\Autorun.inf system32.exe File created \??\O:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created D:\Autorun.inf smss.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification \??\N:\Autorun.inf csrss.exe File created \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\U:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\L:\Autorun.inf smss.exe File opened for modification \??\U:\Autorun.inf smss.exe File opened for modification \??\R:\Autorun.inf Gaara.exe File created \??\V:\Autorun.inf Gaara.exe File opened for modification \??\P:\Autorun.inf Gaara.exe File created \??\A:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification \??\G:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\Q:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\R:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\J:\Autorun.inf smss.exe File created \??\N:\Autorun.inf smss.exe File created \??\X:\Autorun.inf smss.exe File created \??\B:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File opened for modification \??\P:\Autorun.inf csrss.exe File created \??\X:\Autorun.inf csrss.exe File created \??\G:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf system32.exe File opened for modification \??\L:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf system32.exe File created \??\J:\Autorun.inf Kazekage.exe File created \??\K:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created \??\H:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf Gaara.exe File created \??\X:\Autorun.inf Gaara.exe File created \??\Y:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf Kazekage.exe File created D:\Autorun.inf system32.exe File created \??\A:\Autorun.inf Gaara.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe Gaara.exe File created C:\Windows\SysWOW64\mscomctl.ocx ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\20-5-2024.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\ ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\Desktop.ini ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\20-5-2024.exe smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\ ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\system\mscoree.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll smss.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File created C:\Windows\mscomctl.ocx ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\system\msvbvm60.dll ee24f786714000111146a1a260147745_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg ee24f786714000111146a1a260147745_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 20 - 5 - 2024\msvbvm60.dll csrss.exe -
Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Size = "72" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Speed = "4" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Main ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" ee24f786714000111146a1a260147745_NeikiAnalytics.exe -
Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command ee24f786714000111146a1a260147745_NeikiAnalytics.exe -
Runs ping.exe 1 TTPs 34 IoCs
pid Process 3768 ping.exe 2508 ping.exe 4392 ping.exe 1704 ping.exe 4080 ping.exe 3048 ping.exe 3896 ping.exe 3560 ping.exe 4032 ping.exe 4600 ping.exe 1496 ping.exe 3972 ping.exe 2952 ping.exe 672 ping.exe 4852 ping.exe 5048 ping.exe 1600 ping.exe 864 ping.exe 3404 ping.exe 2276 ping.exe 4632 ping.exe 2776 ping.exe 592 ping.exe 2256 ping.exe 1028 ping.exe 3108 ping.exe 4860 ping.exe 2428 ping.exe 5108 ping.exe 1472 ping.exe 1664 ping.exe 776 ping.exe 4232 ping.exe 1856 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3612 smss.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 3980 Gaara.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe 2172 csrss.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 1656 ee24f786714000111146a1a260147745_NeikiAnalytics.exe 3612 smss.exe 3504 smss.exe 3980 Gaara.exe 388 smss.exe 3332 Gaara.exe 2172 csrss.exe 3372 smss.exe 4440 Gaara.exe 1864 csrss.exe 2724 Kazekage.exe 1712 smss.exe 880 Gaara.exe 2816 csrss.exe 4248 Kazekage.exe 1672 system32.exe 2072 smss.exe 3532 Gaara.exe 4056 csrss.exe 3972 Kazekage.exe 548 system32.exe 5116 system32.exe 4800 Kazekage.exe 3032 system32.exe 3900 csrss.exe 1336 Kazekage.exe 1008 system32.exe 1560 Gaara.exe 8 csrss.exe 5048 Kazekage.exe 4348 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 3612 1656 ee24f786714000111146a1a260147745_NeikiAnalytics.exe 82 PID 1656 wrote to memory of 3612 1656 ee24f786714000111146a1a260147745_NeikiAnalytics.exe 82 PID 1656 wrote to memory of 3612 1656 ee24f786714000111146a1a260147745_NeikiAnalytics.exe 82 PID 3612 wrote to memory of 3504 3612 smss.exe 83 PID 3612 wrote to memory of 3504 3612 smss.exe 83 PID 3612 wrote to memory of 3504 3612 smss.exe 83 PID 3612 wrote to memory of 3980 3612 smss.exe 84 PID 3612 wrote to memory of 3980 3612 smss.exe 84 PID 3612 wrote to memory of 3980 3612 smss.exe 84 PID 3980 wrote to memory of 388 3980 Gaara.exe 85 PID 3980 wrote to memory of 388 3980 Gaara.exe 85 PID 3980 wrote to memory of 388 3980 Gaara.exe 85 PID 3980 wrote to memory of 3332 3980 Gaara.exe 87 PID 3980 wrote to memory of 3332 3980 Gaara.exe 87 PID 3980 wrote to memory of 3332 3980 Gaara.exe 87 PID 3980 wrote to memory of 2172 3980 Gaara.exe 89 PID 3980 wrote to memory of 2172 3980 Gaara.exe 89 PID 3980 wrote to memory of 2172 3980 Gaara.exe 89 PID 2172 wrote to memory of 3372 2172 csrss.exe 90 PID 2172 wrote to memory of 3372 2172 csrss.exe 90 PID 2172 wrote to memory of 3372 2172 csrss.exe 90 PID 2172 wrote to memory of 4440 2172 csrss.exe 91 PID 2172 wrote to memory of 4440 2172 csrss.exe 91 PID 2172 wrote to memory of 4440 2172 csrss.exe 91 PID 2172 wrote to memory of 1864 2172 csrss.exe 92 PID 2172 wrote to memory of 1864 2172 csrss.exe 92 PID 2172 wrote to memory of 1864 2172 csrss.exe 92 PID 2172 wrote to memory of 2724 2172 csrss.exe 93 PID 2172 wrote to memory of 2724 2172 csrss.exe 93 PID 2172 wrote to memory of 2724 2172 csrss.exe 93 PID 2724 wrote to memory of 1712 2724 Kazekage.exe 95 PID 2724 wrote to memory of 1712 2724 Kazekage.exe 95 PID 2724 wrote to memory of 1712 2724 Kazekage.exe 95 PID 2724 wrote to memory of 880 2724 Kazekage.exe 96 PID 2724 wrote to memory of 880 2724 Kazekage.exe 96 PID 2724 wrote to memory of 880 2724 Kazekage.exe 96 PID 2724 wrote to memory of 2816 2724 Kazekage.exe 97 PID 2724 wrote to memory of 2816 2724 Kazekage.exe 97 PID 2724 wrote to memory of 2816 2724 Kazekage.exe 97 PID 2724 wrote to memory of 4248 2724 Kazekage.exe 98 PID 2724 wrote to memory of 4248 2724 Kazekage.exe 98 PID 2724 wrote to memory of 4248 2724 Kazekage.exe 98 PID 2724 wrote to memory of 1672 2724 Kazekage.exe 99 PID 2724 wrote to memory of 1672 2724 Kazekage.exe 99 PID 2724 wrote to memory of 1672 2724 Kazekage.exe 99 PID 1672 wrote to memory of 2072 1672 system32.exe 100 PID 1672 wrote to memory of 2072 1672 system32.exe 100 PID 1672 wrote to memory of 2072 1672 system32.exe 100 PID 1672 wrote to memory of 3532 1672 system32.exe 101 PID 1672 wrote to memory of 3532 1672 system32.exe 101 PID 1672 wrote to memory of 3532 1672 system32.exe 101 PID 1672 wrote to memory of 4056 1672 system32.exe 102 PID 1672 wrote to memory of 4056 1672 system32.exe 102 PID 1672 wrote to memory of 4056 1672 system32.exe 102 PID 1672 wrote to memory of 3972 1672 system32.exe 103 PID 1672 wrote to memory of 3972 1672 system32.exe 103 PID 1672 wrote to memory of 3972 1672 system32.exe 103 PID 1672 wrote to memory of 548 1672 system32.exe 104 PID 1672 wrote to memory of 548 1672 system32.exe 104 PID 1672 wrote to memory of 548 1672 system32.exe 104 PID 2172 wrote to memory of 5116 2172 csrss.exe 105 PID 2172 wrote to memory of 5116 2172 csrss.exe 105 PID 2172 wrote to memory of 5116 2172 csrss.exe 105 PID 3980 wrote to memory of 4800 3980 Gaara.exe 106 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ee24f786714000111146a1a260147745_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ee24f786714000111146a1a260147745_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee24f786714000111146a1a260147745_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ee24f786714000111146a1a260147745_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1656 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3612 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3504
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3980 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:388
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2172 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4440
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2724 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:880
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4248
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1672 -
C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3532
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4392
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4600
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2256
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4852
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1856
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3108
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:864
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1600
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2428
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1028
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1472
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3560
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2776
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:776
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1664
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1496
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:5108
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4800
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4632
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1704
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2276
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4232
-
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3900
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3896
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:5048
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:3404
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3768
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:3048
-
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 20 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4348
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:3972
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2952
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4080
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:672
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
Filesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
Filesize
145KB
MD5ee24f786714000111146a1a260147745
SHA1215aece16ee06eeac9ba46d39e6e23704c747fe2
SHA2563a253fb4fcd87497dd4d8d4b2aaba8560b6d8457a38165a1eabd77c47fb37eef
SHA5124e2d15e9998ab60cb835fd8bfb98ed56717c39c7c1455f5e9f3a393067513eded754cb2f0091c157c5f2be67d6e5848a4d37ee5d5b33df3beef1c9b6090ab57f
-
Filesize
145KB
MD552f6abefe60670434609688bb2756239
SHA18559544ce845903af7e2b42e65cc9b9a2a325053
SHA256a28f648ed6a6d0c4be8029b956de4fc0882542a257a716ef1741271fe9e1bfb4
SHA51221b0d55c460a23dc6b1bcd1f229520ff765535519a89c172d72721a7af9d92c9898ce0dd8f6bf57d8c8aa8ba95e3cf498ae969f54c06060b51575aaedb903370
-
Filesize
145KB
MD59c17fa66ca590247fa767ef42eddc4fa
SHA1d08138e2e0576f5e11eec7e941b31c534b5c6596
SHA25632400d1067259bccdc571486e96f39317b88140d23ea19af77513601558f0318
SHA5127ebd936a5b5ecc3d3cf4162df364a1c48a738a4f94f112cb7edee1689ff3e440260bd00af6fde2ec964d0001efe77dcaae3d6b6bfbb3fecd7c55f1f6f814a0a7
-
Filesize
145KB
MD54857698a4901fd0d39dcdfd208a4f1d2
SHA1559a3bff6f7f2c23f562bd4b90b5a199a95e1666
SHA256730edad05c64bb1b81476a6293c4aef8839122838ea2d2d91deeedf88d9390c4
SHA512ee0588718150de1517e95a1104ddfd1dede90a13dc6f5b01b38ea77b312ce982c569b4e3c00c9bee093f13cac8915c02ff373cf1b37906fc5eb59f77a92c85fe
-
Filesize
145KB
MD573ed9aa5f2237ea19d1c7bb645c5c84b
SHA1ff7d5bb552a7a808d08cd3f1a6f71bb4fa03e0c2
SHA256a17b7e12fb898d80461f3f21c246ba5680726d00ac062cc99e5224c039fbac58
SHA512a988bf31e0cec3b418b96cd63f5125b210fb3ac3d1c6c160df3e25eb370c7665dc748dd6dc9736da3ff93915d29e7c9a7a16f121863ca2d000a8a8dd4b2cd1e8
-
Filesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
Filesize
145KB
MD55372688675300effa546963dcc50727d
SHA1c83b81e8b4a2b7113fe3936321565ab6a736aec9
SHA2564449dbd67915448474fad5c876c685d751066c4b8b642bac57459d30c9999588
SHA5129141ccc4e6a2f1a2a0121bc7fadd6d5f695e09385c4244b95a7e710d168391cbb288bea746cc251b6da98dddc92c1ea9204878399770dd7106de2e69ab5731da
-
Filesize
145KB
MD562cbd3a799377a8fe943eb2a5b635ace
SHA19ed405c625616e19e50f4d5b95f128ade701076b
SHA2560aee7f1600bfda2605be67c77f88fc5e55bc64d36e7b60e71930db6a53bc5295
SHA512acdf611db4e43afdde445477d04820e488bcd2d99115d8beda634c5a2c9601a3f212b34d01659e1eaaec417c11990dce8231635c61f62ea31a9eb7677d4e2543
-
Filesize
145KB
MD504fbe04e6afa4e44300f9f280c2430e8
SHA17a43f68b27ae00f6bafa14cf06a9fc3a88ae2a41
SHA256544d38003b20ced2ce5825bbd62120a16c4fa27ddd9ce89f5f5c3d3f5c97443c
SHA512c84b51fca1485e393fd24c6d24204fc1d677d304f7cd922bebf3ade3edc411d5308444aeaf897a590c5bd09ee543263fc23aa346045695559e4d782be8e3a621
-
Filesize
145KB
MD59612268bd475c1d97cd804216304e2c4
SHA13bcb67f409ea162fbc50c3d15b67ac3579c860d0
SHA256708260d4927cd31876a007f6aa4b05e4cfa5eb555a2bb7ae4ed782941e6b84ce
SHA512c82ca95375754fb5746e6f874917fb33978cce38239189347e3d5f655c0ac5e99950e9fc0bb01c348e668aba2d43a499d62e429fe0e6272356a57cfdca4f149f
-
Filesize
145KB
MD511fd12c40df71c64356741882e2cbdf3
SHA1f7df8798179c51c3cfe7038838a01544ef3a663a
SHA25630a78058267a4b3965aa3ddbb76dd081f14628c6fa1b9cb96a03ae1c94286d7b
SHA512899616635f5506f10be965639d7fc9aefcbf32706ab7e0d99f93f9489cee0abb5080657989059486ee002743489f757b4c1c2eb0ee89629896af5a6624c4ba76
-
Filesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
Filesize
145KB
MD5776ff76d2da523fb27f069f0fddb0777
SHA1db4300717c145c57aae984208daa25d0abaf8237
SHA256f6f3211db35a0f44dc645a4a0d12281c964d32b8ee714bcdc23e9c1411965b09
SHA5121f14018ed07afb0206b100a4bce0e3946978ea0b342c76bac87295e897836f40be966d63b987b68d6239da2ee9ddd74ba103d6010d82c71ac08f10249c9d0625
-
Filesize
145KB
MD5987180f3cf5f3b47b017997032c0f877
SHA12dafcdcac9b214ecf3a7d1becdba6da206ed8d2a
SHA2565c71dd584f0bacaa8edca790040ce9446ade8cb2b2c0280d403cf5f2ce77abdf
SHA512d453fae39778b0966789af79648e64b749190f1e7502d41caaff668e7e654cf739bb68267ea01f01bdf98fbad427e4a69d9369e9172fb9d59f3ba95ec9ac005b
-
Filesize
145KB
MD5848f0206622952fed16e13d36a25aaeb
SHA1dac8982299fe895c4b094e1ef20a657c843d1805
SHA25675c4784f5c634cb79fae0120a4b0c570913c8e93484f35aca5a27b94262f701c
SHA512b57c7f8591fd27d9a9be71e9c9657cadafacc613252665501e4e2a2873336c6847f1be684e6db2118a3bd05c4366afe6f515816c9adcd7518acbf2fec02d5107
-
Filesize
145KB
MD54a3ff7c5f68719768109b03cd845e27d
SHA1c0dbea6a5b712f77a6c59175cea4f508d4171a4e
SHA2569bd7576f2b1e5f2220933ac5a76747f9c1dd79833afedab84515be20b9aa6222
SHA51264df3cb25a5e8130c62a039a65737bc8aef6fb0b50f66ecdf3f26defae0ac6d97884892048f3721163488fac84204fd267eb1c7069b45edf9917ba5a596a9d6a
-
Filesize
145KB
MD52c7b72b5d0b29353ea85ecbe39ac99eb
SHA1e9e2102e37c0cfee86a58243b0703ac5791a311f
SHA25643c8e96ccfa1d492840488ff81ae5fecfefe28b1decc3254b151334c92637bf3
SHA512161a60b8b8a099804d080a1aff191c4f5f4a3cbc604ce565a7f851f92369dc1f0cfd231d2953064213bda876959f66ac6f6281fde72d9dd80c9695196f202142
-
Filesize
145KB
MD5b04c77b56dafc519bb07eca987380c61
SHA183aa4461767080760a852b36eed0572047dfd964
SHA2561da4affe228e6349cbb4ed28cca23ce4140c1aeda2b5073287dfb986e4d68148
SHA51214a506a3e9dc6c4ebe8ac85361b6e571164e9a7ec7931c2c8c21d6f832dbb6a627ef14f6735eb097acc8c630f5d2cfc0bf37649bc6eda95d324f557cab40826a
-
Filesize
145KB
MD544497e949d32bcec0105fc04373ab98d
SHA1f13222203a33d92dc3a58b6380735fdc8212c775
SHA256bf0b90b5154c10a96fd86b1aa0914349194a84843a9c48ffc57d2ba95b3f3ef4
SHA51256fd386ae7fff3aac4f740a8ba76ae7243732831c42a91e35550d009e53a8cb4d7b1e2ff42be9d75545201a2b5117970df7e4f3036079828df59f6696a76bd75
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
145KB
MD5c3d8c36f3f03c6c5a2776a405f052fb4
SHA1fbcaa8d37843d119d6247a38634ed08ee3c0cf15
SHA25635fe7df99f8638604753d2b606572c0acc69bfd9a69b85f2a9f8c7e9a29139bf
SHA512e56065b9282e8c21429416cff20b4728e504c9458930b308ec34162030538d8bf2ab48b2ede80dab6eb2d28ac21d164125123e313cccaa6331a784de83f029b0
-
Filesize
145KB
MD5de15efa70ba465d31864eed4157e62fc
SHA162a20dda1f91672c316bf1899f4e7275979f4702
SHA256b741c575c1a9d2bfc641e898fa4e64b09f9b68b29df3c845d8bd7a62ec923e65
SHA51285b92e8201f6b5e0f75fabd91604cc3bb36b621634b2f4573ffb06f9c4afab9a50b582d87e9f13dbd7e1c5c534366e6d885cdceb3c4ec2fefabcd7476af2fb6d
