Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 21:53
Static task
static1
Behavioral task
behavioral1
Sample
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
-
Size
148KB
-
MD5
1ce8afbfdcc164926ec336289a269040
-
SHA1
414f3f9bd023c8c5fb6c4151346b2b9d365b438f
-
SHA256
e0d530ca82886916d05342cfc7546aa33f93d99ffc2ac0c79f64c10a8600d755
-
SHA512
56897f751b972edc7e16a832595aad8ce696e5f3af958728e79e33b8ba44ea071c35238f745410271fe7ee79ae578055edd8479939bed219471419d037255a13
-
SSDEEP
1536:GJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:mx6AHjYzaFXg+w17jsgS/jHagQg19V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
Processes:
csrss.exeKazekage.exesmss.exeGaara.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
Processes:
smss.exeGaara.execsrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
Processes:
csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe -
Processes:
csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe -
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 24 IoCs
Processes:
csrss.exeKazekage.exesmss.exeGaara.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
Processes:
csrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exeKazekage.exesystem32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" system32.exe -
Executes dropped EXE 30 IoCs
Processes:
smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exepid process 2236 smss.exe 3984 smss.exe 3312 Gaara.exe 5004 smss.exe 3488 Gaara.exe 4616 csrss.exe 2668 smss.exe 3972 Gaara.exe 3056 csrss.exe 840 Kazekage.exe 3080 smss.exe 3168 Gaara.exe 2340 csrss.exe 1112 Kazekage.exe 4552 system32.exe 3476 smss.exe 1676 Gaara.exe 3816 csrss.exe 1364 Kazekage.exe 2672 system32.exe 4776 system32.exe 1604 Kazekage.exe 2192 system32.exe 2820 csrss.exe 4440 Kazekage.exe 2372 system32.exe 3004 Gaara.exe 4412 csrss.exe 2100 Kazekage.exe 4080 system32.exe -
Loads dropped DLL 18 IoCs
Processes:
smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.execsrss.exeGaara.execsrss.exepid process 2236 smss.exe 3984 smss.exe 3312 Gaara.exe 5004 smss.exe 3488 Gaara.exe 4616 csrss.exe 2668 smss.exe 3972 Gaara.exe 3056 csrss.exe 3080 smss.exe 3168 Gaara.exe 2340 csrss.exe 3476 smss.exe 1676 Gaara.exe 3816 csrss.exe 2820 csrss.exe 3004 Gaara.exe 4412 csrss.exe -
Adds Run key to start application 2 TTPs 24 IoCs
Processes:
system32.exeGaara.exeKazekage.exesmss.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe" Gaara.exe -
Processes:
system32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
smss.execsrss.exeKazekage.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exesystem32.exedescription ioc process File opened for modification \??\U:\Desktop.ini smss.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini Kazekage.exe File opened for modification \??\A:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\H:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini system32.exe File opened for modification \??\W:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\X:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\J:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
csrss.exeKazekage.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exesmss.exeGaara.exedescription ioc process File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\W: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\X: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\E: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\B: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\J: Gaara.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\M: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\A: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\U: 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\M: Gaara.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\A: Kazekage.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exeKazekage.exesystem32.execsrss.exesmss.exedescription ioc process File created \??\T:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created \??\I:\Autorun.inf Gaara.exe File created \??\V:\Autorun.inf Kazekage.exe File opened for modification \??\L:\Autorun.inf system32.exe File created \??\A:\Autorun.inf csrss.exe File created \??\M:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Autorun.inf smss.exe File opened for modification \??\I:\Autorun.inf Gaara.exe File opened for modification \??\U:\Autorun.inf system32.exe File opened for modification \??\P:\Autorun.inf csrss.exe File opened for modification \??\A:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File created \??\O:\Autorun.inf csrss.exe File created \??\E:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\Z:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created \??\N:\Autorun.inf smss.exe File opened for modification \??\J:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf csrss.exe File opened for modification \??\B:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf system32.exe File created \??\K:\Autorun.inf system32.exe File created \??\A:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\W:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created \??\U:\Autorun.inf smss.exe File opened for modification \??\R:\Autorun.inf Gaara.exe File opened for modification \??\S:\Autorun.inf Gaara.exe File opened for modification \??\Y:\Autorun.inf system32.exe File created \??\S:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created \??\M:\Autorun.inf Gaara.exe File opened for modification \??\U:\Autorun.inf Gaara.exe File opened for modification \??\P:\Autorun.inf Kazekage.exe File created \??\G:\Autorun.inf system32.exe File created \??\G:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\N:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification D:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\L:\Autorun.inf smss.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File created \??\R:\Autorun.inf Kazekage.exe File opened for modification \??\G:\Autorun.inf csrss.exe File created \??\G:\Autorun.inf smss.exe File created \??\P:\Autorun.inf smss.exe File created \??\G:\Autorun.inf Gaara.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File created \??\H:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf system32.exe File created F:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\X:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created \??\T:\Autorun.inf smss.exe File created \??\P:\Autorun.inf Gaara.exe File created \??\R:\Autorun.inf system32.exe File created \??\S:\Autorun.inf smss.exe File opened for modification \??\V:\Autorun.inf smss.exe File created \??\E:\Autorun.inf system32.exe File created \??\Q:\Autorun.inf Gaara.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File created \??\V:\Autorun.inf 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification \??\Y:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf csrss.exe -
Drops file in System32 directory 39 IoCs
Processes:
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeKazekage.exesystem32.execsrss.exeGaara.exesmss.exedescription ioc process File created C:\Windows\SysWOW64\mscomctl.ocx 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe Gaara.exe File created C:\Windows\SysWOW64\Desktop.ini 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\ 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File created C:\Windows\SysWOW64\24-5-2024.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\24-5-2024.exe system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe -
Sets desktop wallpaper using registry 2 TTPs 6 IoCs
Processes:
system32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe -
Drops file in Windows directory 64 IoCs
Processes:
csrss.exesmss.exeGaara.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeKazekage.exesystem32.exedescription ioc process File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\mscomctl.ocx 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe system32.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\ 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\Fonts\The Kazekage.jpg 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll smss.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe smss.exe File created C:\Windows\system\msvbvm60.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\mscomctl.ocx 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\ csrss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe system32.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\msvbvm60.dll 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe -
Modifies Control Panel 64 IoCs
Processes:
Kazekage.exesystem32.exesmss.exeGaara.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe -
Processes:
csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe -
Modifies registry class 51 IoCs
Processes:
smss.exeGaara.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exeKazekage.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe -
Runs ping.exe 1 TTPs 36 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 5012 ping.exe 1272 ping.exe 2720 ping.exe 4652 ping.exe 4140 ping.exe 2708 ping.exe 1696 ping.exe 3184 ping.exe 2924 ping.exe 2424 ping.exe 1656 ping.exe 3024 ping.exe 1316 ping.exe 3992 ping.exe 1980 ping.exe 3436 ping.exe 412 ping.exe 4580 ping.exe 3436 ping.exe 1420 ping.exe 544 ping.exe 1924 ping.exe 1784 ping.exe 2936 ping.exe 1816 ping.exe 1528 ping.exe 4116 ping.exe 732 ping.exe 4240 ping.exe 4988 ping.exe 3444 ping.exe 5072 ping.exe 3096 ping.exe 4788 ping.exe 1080 ping.exe 1460 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
csrss.exeKazekage.exesystem32.exepid process 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 4616 csrss.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 840 Kazekage.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe 4552 system32.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
Processes:
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exepid process 2576 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe 2236 smss.exe 3984 smss.exe 3312 Gaara.exe 5004 smss.exe 3488 Gaara.exe 4616 csrss.exe 2668 smss.exe 3972 Gaara.exe 3056 csrss.exe 840 Kazekage.exe 3080 smss.exe 3168 Gaara.exe 2340 csrss.exe 1112 Kazekage.exe 4552 system32.exe 3476 smss.exe 1676 Gaara.exe 3816 csrss.exe 1364 Kazekage.exe 2672 system32.exe 4776 system32.exe 1604 Kazekage.exe 2192 system32.exe 2820 csrss.exe 4440 Kazekage.exe 2372 system32.exe 3004 Gaara.exe 4412 csrss.exe 2100 Kazekage.exe 4080 system32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exedescription pid process target process PID 2576 wrote to memory of 2236 2576 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe smss.exe PID 2576 wrote to memory of 2236 2576 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe smss.exe PID 2576 wrote to memory of 2236 2576 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe smss.exe PID 2236 wrote to memory of 3984 2236 smss.exe smss.exe PID 2236 wrote to memory of 3984 2236 smss.exe smss.exe PID 2236 wrote to memory of 3984 2236 smss.exe smss.exe PID 2236 wrote to memory of 3312 2236 smss.exe Gaara.exe PID 2236 wrote to memory of 3312 2236 smss.exe Gaara.exe PID 2236 wrote to memory of 3312 2236 smss.exe Gaara.exe PID 3312 wrote to memory of 5004 3312 Gaara.exe smss.exe PID 3312 wrote to memory of 5004 3312 Gaara.exe smss.exe PID 3312 wrote to memory of 5004 3312 Gaara.exe smss.exe PID 3312 wrote to memory of 3488 3312 Gaara.exe Gaara.exe PID 3312 wrote to memory of 3488 3312 Gaara.exe Gaara.exe PID 3312 wrote to memory of 3488 3312 Gaara.exe Gaara.exe PID 3312 wrote to memory of 4616 3312 Gaara.exe csrss.exe PID 3312 wrote to memory of 4616 3312 Gaara.exe csrss.exe PID 3312 wrote to memory of 4616 3312 Gaara.exe csrss.exe PID 4616 wrote to memory of 2668 4616 csrss.exe smss.exe PID 4616 wrote to memory of 2668 4616 csrss.exe smss.exe PID 4616 wrote to memory of 2668 4616 csrss.exe smss.exe PID 4616 wrote to memory of 3972 4616 csrss.exe Gaara.exe PID 4616 wrote to memory of 3972 4616 csrss.exe Gaara.exe PID 4616 wrote to memory of 3972 4616 csrss.exe Gaara.exe PID 4616 wrote to memory of 3056 4616 csrss.exe csrss.exe PID 4616 wrote to memory of 3056 4616 csrss.exe csrss.exe PID 4616 wrote to memory of 3056 4616 csrss.exe csrss.exe PID 4616 wrote to memory of 840 4616 csrss.exe Kazekage.exe PID 4616 wrote to memory of 840 4616 csrss.exe Kazekage.exe PID 4616 wrote to memory of 840 4616 csrss.exe Kazekage.exe PID 840 wrote to memory of 3080 840 Kazekage.exe smss.exe PID 840 wrote to memory of 3080 840 Kazekage.exe smss.exe PID 840 wrote to memory of 3080 840 Kazekage.exe smss.exe PID 840 wrote to memory of 3168 840 Kazekage.exe Gaara.exe PID 840 wrote to memory of 3168 840 Kazekage.exe Gaara.exe PID 840 wrote to memory of 3168 840 Kazekage.exe Gaara.exe PID 840 wrote to memory of 2340 840 Kazekage.exe csrss.exe PID 840 wrote to memory of 2340 840 Kazekage.exe csrss.exe PID 840 wrote to memory of 2340 840 Kazekage.exe csrss.exe PID 840 wrote to memory of 1112 840 Kazekage.exe Kazekage.exe PID 840 wrote to memory of 1112 840 Kazekage.exe Kazekage.exe PID 840 wrote to memory of 1112 840 Kazekage.exe Kazekage.exe PID 840 wrote to memory of 4552 840 Kazekage.exe system32.exe PID 840 wrote to memory of 4552 840 Kazekage.exe system32.exe PID 840 wrote to memory of 4552 840 Kazekage.exe system32.exe PID 4552 wrote to memory of 3476 4552 system32.exe smss.exe PID 4552 wrote to memory of 3476 4552 system32.exe smss.exe PID 4552 wrote to memory of 3476 4552 system32.exe smss.exe PID 4552 wrote to memory of 1676 4552 system32.exe Gaara.exe PID 4552 wrote to memory of 1676 4552 system32.exe Gaara.exe PID 4552 wrote to memory of 1676 4552 system32.exe Gaara.exe PID 4552 wrote to memory of 3816 4552 system32.exe csrss.exe PID 4552 wrote to memory of 3816 4552 system32.exe csrss.exe PID 4552 wrote to memory of 3816 4552 system32.exe csrss.exe PID 4552 wrote to memory of 1364 4552 system32.exe Kazekage.exe PID 4552 wrote to memory of 1364 4552 system32.exe Kazekage.exe PID 4552 wrote to memory of 1364 4552 system32.exe Kazekage.exe PID 4552 wrote to memory of 2672 4552 system32.exe system32.exe PID 4552 wrote to memory of 2672 4552 system32.exe system32.exe PID 4552 wrote to memory of 2672 4552 system32.exe system32.exe PID 4616 wrote to memory of 4776 4616 csrss.exe system32.exe PID 4616 wrote to memory of 4776 4616 csrss.exe system32.exe PID 4616 wrote to memory of 4776 4616 csrss.exe system32.exe PID 3312 wrote to memory of 1604 3312 Gaara.exe Kazekage.exe -
System policy modification 1 TTPs 12 IoCs
Processes:
csrss.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exeKazekage.exesmss.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
9Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Admin Games\Readme.txtFilesize
736B
MD5bb5d6abdf8d0948ac6895ce7fdfbc151
SHA19266b7a247a4685892197194d2b9b86c8f6dddbd
SHA2565db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
SHA512878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
-
C:\Autorun.infFilesize
196B
MD51564dfe69ffed40950e5cb644e0894d1
SHA1201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA256be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
SHA51272df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
-
C:\Gaara.exeFilesize
148KB
MD51ce8afbfdcc164926ec336289a269040
SHA1414f3f9bd023c8c5fb6c4151346b2b9d365b438f
SHA256e0d530ca82886916d05342cfc7546aa33f93d99ffc2ac0c79f64c10a8600d755
SHA51256897f751b972edc7e16a832595aad8ce696e5f3af958728e79e33b8ba44ea071c35238f745410271fe7ee79ae578055edd8479939bed219471419d037255a13
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exeFilesize
148KB
MD54d7dc4e2751cda2ec670324b648f9699
SHA16ddaea9d8394f2a443f62c547e059052f72c4d47
SHA256912d53850d642eadf97cfd26071f59e8c9e7a18f694c120426206e30bd6393d8
SHA512097363f25a2c93e9bd155d6bc9edcb934e2bcf3f258f27537345089554d2cd1e7d3803cdc910838cf9f7c3f7b8eade0ccc750549818c94d2fa5651b971707f21
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exeFilesize
148KB
MD5584aa0422aa52c8d1c66749963b51d3a
SHA1379cca6d6db1d4e79b142f5e828ac92f9f1b17c7
SHA25670caa4bd81a70db14e0a8f3774e0a8cf44a660ef75be66d28963dd13e713d46a
SHA512a65b981895eef2b934e5710c8152997fd1207c8045a1c2ae2b3bce769b2785ad86a63f7f0b41a9d033654c4ca027becae55d7b8634990d8a61127958ad6ba255
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exeFilesize
148KB
MD5ce588fbb6605e5a46c2336aed1e1a3ce
SHA1196845a65912087034aa5f2b41788db16895f234
SHA25607ab5512513d9eefe88f9b4279243627db934c840dc099da040603d7a24ff7f0
SHA51249c68bbe37d4b38e7effc980c045a1baa98b135c8a0cbe4953c189f9da57fc82e92d01e14fb96d93198cfd01ea91503079e923f00e6fdc4526c0252eaf77d6fc
-
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exeFilesize
148KB
MD57961291c3f46c3ef9060489f1861741f
SHA1ec895484f482dcf15ef2b8749bcca19320f09d70
SHA256994bdcd39aaebbff491404fabf3bc466522199ae5c182d0ffbbc56fed2e0c168
SHA5124a5bef10bf8e797feb8f1261cffd93aa9c5e95328105ebcc1721bac584af8f9efed33564ce9ba2eaa411801a882ffccde9b359f788dd9818fd61d53f630d16f4
-
C:\Windows\Fonts\The Kazekage.jpgMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Fonts\The Kazekage.jpgFilesize
1.4MB
MD5d6b05020d4a0ec2a3a8b687099e335df
SHA1df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA2569824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
SHA51278fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
-
C:\Windows\SysWOW64\24-5-2024.exeFilesize
148KB
MD595202d7be5aefcc46cf83bf2b299c298
SHA1cb5e220209983cff9b8ab1547ec5c45d9cbbc452
SHA25679cce3e9ea8fd980c43672095964191a134189cbbb15601e6ad471fa592bff92
SHA51276b87bb4ab4d713f850357bf855b5530103fd5ff3ae5849ce1056c3106295b3d820e1845e0f763aac945daf27a3867c07a55599c94f96663da324ecc332c881b
-
C:\Windows\SysWOW64\24-5-2024.exeFilesize
148KB
MD5f411c89a17bb337ddeb0b4047d524c93
SHA136c8cd24ea35c528cd1b5afa3df4cfc0dc7c8b30
SHA2564355cadb985ec234633e002743be3f143d8603c344659847e301fefab662208a
SHA512f63659cd9c1c35bc0ea5b98e6ce74d28e19d5307f1c3d1d73ddfd77e88e4c1469d0a3d4b28704ee07f550e1e9c1b288f332c87968d4d41303658819580ad695c
-
C:\Windows\SysWOW64\24-5-2024.exeFilesize
148KB
MD542bd36b82b25f9bdb60ff65295aefbcd
SHA1f19e27a947058032a432c8fad84f8b3f29e1870c
SHA256fd486e3aefb77102ca5f972ed096a1e9785cf5b154dfb1f4def1a3a0f979867c
SHA512f3e45cba1640ea26939638cc0be60a0126f3b0c9ba1508a1015d1f31bab027130945bcd475314330d8721f441fc85381ded161c5d9b093e1f42c9ddf3adb101e
-
C:\Windows\SysWOW64\24-5-2024.exeFilesize
148KB
MD5fc319a8fa7eb74b4af016d8fcd057f29
SHA105ea072f5dae1de80d013a748de8ee9c2196f2af
SHA256eef94d6ff99576b21deb196bda7957a050e6a0605f8638e4e94a19b141acc0fb
SHA51297ff7cb4d7d78da2e0f9cfe3722034e9e5672932584036e902a379d4ec33808ff55870fccd92207a3de40df8d9f63865e44c9a56ab2a0b18b200ead82e96e05d
-
C:\Windows\SysWOW64\24-5-2024.exeFilesize
148KB
MD58ef5667f8e5f0b8860666268a84e8c93
SHA10bac585f131f17fc2bbe55bae16b4118c22d3c84
SHA2569288701f8f8940b3405bb005b02850f1778cae0eb84f3f407b7d4543809e9e8e
SHA51272eabaceb2e5ba4d153015840e9b6a5585e821c31f7110955a31327f12478acc92d8096d1fbc354391048a005cc4b3d8e84cbe9aeb39c6e28ecb1b9379558023
-
C:\Windows\SysWOW64\Desktop.iniFilesize
65B
MD564acfa7e03b01f48294cf30d201a0026
SHA110facd995b38a095f30b4a800fa454c0bcbf8438
SHA256ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
SHA51265a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
-
C:\Windows\SysWOW64\drivers\Kazekage.exeFilesize
148KB
MD53f8be47914f97a02e72568ebebf7989f
SHA15d604f49dabb0f9c95cbdf4687d776b5c1c0cbcc
SHA2562cafac2e32a0b7cadddf20e174d79df19c14ae5a2332c2b73ddadb72bf5b857b
SHA512bb0a48e1fe28527a03d6e41301c7400f45cbcb00ade46dd3f95d24e9849db4afd733936bf5c557173ae6ac9ab6275ba6e82b8b7a6c12bf6543e719515139fa4f
-
C:\Windows\SysWOW64\drivers\Kazekage.exeFilesize
148KB
MD5140b98ef047bdc7b56ce7336d2d533b4
SHA1131a679022740c5155d4827e2567e8042d9ae738
SHA256bc34d2258ade51b3ca02b3e343e32b9a04477f479ae08c51b0544a7e02427de0
SHA512c740348f70c2a0ef2e740ab624f1431a774aed314dace1f84ab49ca8b3da43c3ce42e79f04ad07050c9a2c4025b886335f39316bbb62686c1cc86d0b4c794efe
-
C:\Windows\SysWOW64\drivers\Kazekage.exeFilesize
148KB
MD539b82fccef58bb9ecc439fdbaf8ee1ff
SHA1a70f4c38fac9c3b17ac2278db864b9fd45f41a1d
SHA2561d7250d179ab6e369ae70a2a953e14882ea4823befe31b7b7f9d74b40e9130a4
SHA5126d1240253302f22b1143340077bc31997090a5ddd55d7b0ad12cda8bd77b74f746676a54d294c69de2ec08d2de0cd9f6b727db88b12b6db06b7843036849a76d
-
C:\Windows\SysWOW64\drivers\system32.exeFilesize
148KB
MD53728f7316dc8f5e5d35281696a502d8c
SHA165147d0ae6fc80c858230752429ad4756947fd84
SHA256b1f401cfb9090d0edcaac7318a811f9636b5c3f7462865af931f792cf1404e79
SHA512a6d77c1d1617e0e221f88ca856f631a6ffb21963e0eb158a142d5017100cf71154c57038467a89ac8ae990f9b400e20291aa74c8f306073fef0a358b908af95c
-
C:\Windows\SysWOW64\drivers\system32.exeFilesize
148KB
MD5080d6e142976994f1a381aad3081ebc8
SHA1e9639dbfcb2d6d9974028c11040a084db7a6b329
SHA256a78f3810a10f4efb6278fb5bd5f418b88fffd90c0f218137c88c2cc489c2f88d
SHA5127073de347d577fa5635b6fdbc3be77518c5b8efeec867798068cdca65ed9e1e4fc95b0862bad7339236c50d3522419ba05db169b75dcf258a1527dd40407f39f
-
C:\Windows\SysWOW64\drivers\system32.exeFilesize
148KB
MD5fc527a23edfb135318cb066430fefed4
SHA18a325233c9efd6b045af9aa3860ce409c7a0c5c0
SHA2561e3783cde58f8dc520fc3d8a19e25a39e6b3e5aaa58ced408d0ff177bb26e4f4
SHA5122b420f9755938d2b71205448072aec942eaba65ed7f139ba73808c4580b5119a3722d8c3211d4e268cbdd13b22a4e1474cc4983796166791ee92143989d2243e
-
C:\Windows\SysWOW64\drivers\system32.exeFilesize
148KB
MD50b464b094990da9e36e2ca4901da17a9
SHA1e9a79333ed106994f77aa2c33850b6aab3710f62
SHA256b53459060010c0475d1bf34aa0116577e08ade62f13c35544bb89a74f50ca599
SHA5124394a56b3035aeb03f25f135b551cd04628232be081fa48fc682a78479d27cc377e7c0b301be460c1d197b88a2c02d5ddc9a531977073b3bb6be1adce6888890
-
C:\Windows\System\msvbvm60.dllFilesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
memory/840-943-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/840-164-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1112-206-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1364-237-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1604-250-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1676-231-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2100-271-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2192-253-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2236-33-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2236-940-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2340-200-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2372-262-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2576-939-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2576-0-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2672-238-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2672-241-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2820-256-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3004-265-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3056-161-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3080-191-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3168-196-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3312-941-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3312-78-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3476-227-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3488-119-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3488-114-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3816-234-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3816-230-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3972-156-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3984-76-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3984-70-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4080-274-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4412-268-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4440-259-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4552-205-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4616-120-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4616-942-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4776-247-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/5004-111-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB