e0d530ca82886916d05342cfc7546aa33f93d99ffc2ac0c79f64c10a8600d755

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Size

148KB
MD5

1ce8afbfdcc164926ec336289a269040
SHA1

414f3f9bd023c8c5fb6c4151346b2b9d365b438f
SHA256

e0d530ca82886916d05342cfc7546aa33f93d99ffc2ac0c79f64c10a8600d755
SHA512

56897f751b972edc7e16a832595aad8ce696e5f3af958728e79e33b8ba44ea071c35238f745410271fe7ee79ae578055edd8479939bed219471419d037255a13
SSDEEP

1536:GJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:mx6AHjYzaFXg+w17jsgS/jHagQg19V

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesmss.exeGaara.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

smss.exeGaara.execsrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

Processes:

csrss.exeKazekage.exesmss.exeGaara.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exeKazekage.exesystem32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe

Executes dropped EXE 30 IoCs

Processes:

smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exe

pid	process
2236	smss.exe
3984	smss.exe
3312	Gaara.exe
5004	smss.exe
3488	Gaara.exe
4616	csrss.exe
2668	smss.exe
3972	Gaara.exe
3056	csrss.exe
840	Kazekage.exe
3080	smss.exe
3168	Gaara.exe
2340	csrss.exe
1112	Kazekage.exe
4552	system32.exe
3476	smss.exe
1676	Gaara.exe
3816	csrss.exe
1364	Kazekage.exe
2672	system32.exe
4776	system32.exe
1604	Kazekage.exe
2192	system32.exe
2820	csrss.exe
4440	Kazekage.exe
2372	system32.exe
3004	Gaara.exe
4412	csrss.exe
2100	Kazekage.exe
4080	system32.exe

Loads dropped DLL 18 IoCs

Processes:

smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.execsrss.exeGaara.execsrss.exe

pid	process
2236	smss.exe
3984	smss.exe
3312	Gaara.exe
5004	smss.exe
3488	Gaara.exe
4616	csrss.exe
2668	smss.exe
3972	Gaara.exe
3056	csrss.exe
3080	smss.exe
3168	Gaara.exe
2340	csrss.exe
3476	smss.exe
1676	Gaara.exe
3816	csrss.exe
2820	csrss.exe
3004	Gaara.exe
4412	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

system32.exeGaara.exeKazekage.exesmss.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "24-5-2024.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 24 - 5 - 2024\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 24 - 5 - 2024\\Gaara.exe"	Gaara.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

system32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

smss.execsrss.exeKazekage.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exesystem32.exe

description	ioc	process
File opened for modification	\??\U:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	csrss.exe
File opened for modification	\??\Q:\Desktop.ini	csrss.exe
File opened for modification	\??\W:\Desktop.ini	csrss.exe
File opened for modification	\??\B:\Desktop.ini	Kazekage.exe
File opened for modification	\??\P:\Desktop.ini	Kazekage.exe
File opened for modification	\??\T:\Desktop.ini	Kazekage.exe
File opened for modification	\??\U:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\E:\Desktop.ini	Kazekage.exe
File opened for modification	\??\A:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\H:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\H:\Desktop.ini	smss.exe
File opened for modification	\??\I:\Desktop.ini	smss.exe
File opened for modification	\??\J:\Desktop.ini	smss.exe
File opened for modification	\??\P:\Desktop.ini	Gaara.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\W:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\X:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	Gaara.exe
File opened for modification	\??\K:\Desktop.ini	csrss.exe
File opened for modification	\??\Y:\Desktop.ini	csrss.exe
File opened for modification	C:\Desktop.ini	Kazekage.exe
File opened for modification	D:\Desktop.ini	Kazekage.exe
File opened for modification	\??\S:\Desktop.ini	smss.exe
File opened for modification	\??\T:\Desktop.ini	smss.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	\??\I:\Desktop.ini	Kazekage.exe
File opened for modification	\??\W:\Desktop.ini	Kazekage.exe
File opened for modification	\??\E:\Desktop.ini	system32.exe
File opened for modification	\??\K:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	smss.exe
File opened for modification	\??\S:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	system32.exe
File opened for modification	\??\T:\Desktop.ini	Gaara.exe
File opened for modification	\??\X:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	C:\Desktop.ini	csrss.exe
File opened for modification	\??\O:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	Gaara.exe
File opened for modification	\??\Z:\Desktop.ini	Gaara.exe
File opened for modification	D:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\K:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	system32.exe
File opened for modification	\??\M:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	F:\Desktop.ini	smss.exe
File opened for modification	\??\M:\Desktop.ini	smss.exe
File opened for modification	F:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\J:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\L:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	smss.exe
File opened for modification	\??\Y:\Desktop.ini	smss.exe
File opened for modification	\??\M:\Desktop.ini	Gaara.exe
File opened for modification	\??\O:\Desktop.ini	Gaara.exe
File opened for modification	\??\G:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	system32.exe
File opened for modification	\??\Z:\Desktop.ini	system32.exe
File opened for modification	D:\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

csrss.exeKazekage.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exesmss.exeGaara.exe

description	ioc	process
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\Y:	Kazekage.exe
File opened (read-only)	\??\W:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\X:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\A:	csrss.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\E:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\B:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\W:	Gaara.exe
File opened (read-only)	\??\X:	Gaara.exe
File opened (read-only)	\??\Z:	Gaara.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\B:	Gaara.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\Z:	Kazekage.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\N:	Kazekage.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\J:	Gaara.exe
File opened (read-only)	\??\Q:	Gaara.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\R:	Kazekage.exe
File opened (read-only)	\??\P:	system32.exe
File opened (read-only)	\??\B:	csrss.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\Y:	Gaara.exe
File opened (read-only)	\??\B:	system32.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\S:	Gaara.exe
File opened (read-only)	\??\N:	system32.exe
File opened (read-only)	\??\M:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\A:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\M:	Kazekage.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\L:	Kazekage.exe
File opened (read-only)	\??\V:	system32.exe
File opened (read-only)	\??\R:	csrss.exe
File opened (read-only)	\??\P:	Kazekage.exe
File opened (read-only)	\??\U:	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened (read-only)	\??\L:	Gaara.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\V:	Kazekage.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\M:	Gaara.exe
File opened (read-only)	\??\N:	csrss.exe
File opened (read-only)	\??\A:	Kazekage.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exeKazekage.exesystem32.execsrss.exesmss.exe

description	ioc	process
File created	\??\T:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	\??\I:\Autorun.inf	Gaara.exe
File created	\??\V:\Autorun.inf	Kazekage.exe
File opened for modification	\??\L:\Autorun.inf	system32.exe
File created	\??\A:\Autorun.inf	csrss.exe
File created	\??\M:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Autorun.inf	smss.exe
File opened for modification	\??\I:\Autorun.inf	Gaara.exe
File opened for modification	\??\U:\Autorun.inf	system32.exe
File opened for modification	\??\P:\Autorun.inf	csrss.exe
File opened for modification	\??\A:\Autorun.inf	Gaara.exe
File opened for modification	\??\J:\Autorun.inf	Gaara.exe
File opened for modification	\??\K:\Autorun.inf	Gaara.exe
File opened for modification	\??\Z:\Autorun.inf	Kazekage.exe
File created	\??\O:\Autorun.inf	csrss.exe
File created	\??\E:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\Z:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	\??\N:\Autorun.inf	smss.exe
File opened for modification	\??\J:\Autorun.inf	Kazekage.exe
File opened for modification	\??\B:\Autorun.inf	csrss.exe
File opened for modification	\??\B:\Autorun.inf	system32.exe
File opened for modification	\??\E:\Autorun.inf	system32.exe
File created	\??\K:\Autorun.inf	system32.exe
File created	\??\A:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\W:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	\??\U:\Autorun.inf	smss.exe
File opened for modification	\??\R:\Autorun.inf	Gaara.exe
File opened for modification	\??\S:\Autorun.inf	Gaara.exe
File opened for modification	\??\Y:\Autorun.inf	system32.exe
File created	\??\S:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	\??\M:\Autorun.inf	Gaara.exe
File opened for modification	\??\U:\Autorun.inf	Gaara.exe
File opened for modification	\??\P:\Autorun.inf	Kazekage.exe
File created	\??\G:\Autorun.inf	system32.exe
File created	\??\G:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\N:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\W:\Autorun.inf	Gaara.exe
File opened for modification	\??\E:\Autorun.inf	Kazekage.exe
File opened for modification	\??\A:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	D:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\L:\Autorun.inf	smss.exe
File opened for modification	\??\L:\Autorun.inf	Kazekage.exe
File created	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	\??\G:\Autorun.inf	csrss.exe
File created	\??\G:\Autorun.inf	smss.exe
File created	\??\P:\Autorun.inf	smss.exe
File created	\??\G:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	Gaara.exe
File created	\??\H:\Autorun.inf	Kazekage.exe
File created	\??\Y:\Autorun.inf	system32.exe
File created	F:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\X:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	\??\T:\Autorun.inf	smss.exe
File created	\??\P:\Autorun.inf	Gaara.exe
File created	\??\R:\Autorun.inf	system32.exe
File created	\??\S:\Autorun.inf	smss.exe
File opened for modification	\??\V:\Autorun.inf	smss.exe
File created	\??\E:\Autorun.inf	system32.exe
File created	\??\Q:\Autorun.inf	Gaara.exe
File opened for modification	\??\Q:\Autorun.inf	Kazekage.exe
File created	\??\V:\Autorun.inf	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	\??\Y:\Autorun.inf	smss.exe
File opened for modification	\??\W:\Autorun.inf	system32.exe
File opened for modification	\??\U:\Autorun.inf	csrss.exe

Drops file in System32 directory 39 IoCs

Processes:

1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeKazekage.exesystem32.execsrss.exeGaara.exesmss.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mscomctl.ocx	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	Gaara.exe
File created	C:\Windows\SysWOW64\Desktop.ini	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File created	C:\Windows\SysWOW64\24-5-2024.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\24-5-2024.exe	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

system32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe

Drops file in Windows directory 64 IoCs

Processes:

csrss.exesmss.exeGaara.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeKazekage.exesystem32.exe

description	ioc	process
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Gaara.exe
File created	C:\Windows\mscomctl.ocx	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\mscoree.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	system32.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	Gaara.exe
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	smss.exe
File created	C:\Windows\system\msvbvm60.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	smss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\	csrss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\mscoree.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	system32.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\msvbvm60.dll	Gaara.exe
File created	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	system32.exe
File opened for modification	C:\Windows\	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe

Modifies Control Panel 64 IoCs

evasion

Processes:

Kazekage.exesystem32.exesmss.exeGaara.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe

Modifies registry class 51 IoCs

Processes:

smss.exeGaara.execsrss.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesystem32.exeKazekage.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe

Runs ping.exe 1 TTPs 36 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
5012	ping.exe
1272	ping.exe
2720	ping.exe
4652	ping.exe
4140	ping.exe
2708	ping.exe
1696	ping.exe
3184	ping.exe
2924	ping.exe
2424	ping.exe
1656	ping.exe
3024	ping.exe
1316	ping.exe
3992	ping.exe
1980	ping.exe
3436	ping.exe
412	ping.exe
4580	ping.exe
3436	ping.exe
1420	ping.exe
544	ping.exe
1924	ping.exe
1784	ping.exe
2936	ping.exe
1816	ping.exe
1528	ping.exe
4116	ping.exe
732	ping.exe
4240	ping.exe
4988	ping.exe
3444	ping.exe
5072	ping.exe
3096	ping.exe
4788	ping.exe
1080	ping.exe
1460	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exeKazekage.exesystem32.exe

pid	process
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
4616	csrss.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
840	Kazekage.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe
4552	system32.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exe

pid	process
2576	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
2236	smss.exe
3984	smss.exe
3312	Gaara.exe
5004	smss.exe
3488	Gaara.exe
4616	csrss.exe
2668	smss.exe
3972	Gaara.exe
3056	csrss.exe
840	Kazekage.exe
3080	smss.exe
3168	Gaara.exe
2340	csrss.exe
1112	Kazekage.exe
4552	system32.exe
3476	smss.exe
1676	Gaara.exe
3816	csrss.exe
1364	Kazekage.exe
2672	system32.exe
4776	system32.exe
1604	Kazekage.exe
2192	system32.exe
2820	csrss.exe
4440	Kazekage.exe
2372	system32.exe
3004	Gaara.exe
4412	csrss.exe
2100	Kazekage.exe
4080	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exe

description	pid	process	target process
PID 2576 wrote to memory of 2236	2576	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe	smss.exe
PID 2576 wrote to memory of 2236	2576	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe	smss.exe
PID 2576 wrote to memory of 2236	2576	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe	smss.exe
PID 2236 wrote to memory of 3984	2236	smss.exe	smss.exe
PID 2236 wrote to memory of 3984	2236	smss.exe	smss.exe
PID 2236 wrote to memory of 3984	2236	smss.exe	smss.exe
PID 2236 wrote to memory of 3312	2236	smss.exe	Gaara.exe
PID 2236 wrote to memory of 3312	2236	smss.exe	Gaara.exe
PID 2236 wrote to memory of 3312	2236	smss.exe	Gaara.exe
PID 3312 wrote to memory of 5004	3312	Gaara.exe	smss.exe
PID 3312 wrote to memory of 5004	3312	Gaara.exe	smss.exe
PID 3312 wrote to memory of 5004	3312	Gaara.exe	smss.exe
PID 3312 wrote to memory of 3488	3312	Gaara.exe	Gaara.exe
PID 3312 wrote to memory of 3488	3312	Gaara.exe	Gaara.exe
PID 3312 wrote to memory of 3488	3312	Gaara.exe	Gaara.exe
PID 3312 wrote to memory of 4616	3312	Gaara.exe	csrss.exe
PID 3312 wrote to memory of 4616	3312	Gaara.exe	csrss.exe
PID 3312 wrote to memory of 4616	3312	Gaara.exe	csrss.exe
PID 4616 wrote to memory of 2668	4616	csrss.exe	smss.exe
PID 4616 wrote to memory of 2668	4616	csrss.exe	smss.exe
PID 4616 wrote to memory of 2668	4616	csrss.exe	smss.exe
PID 4616 wrote to memory of 3972	4616	csrss.exe	Gaara.exe
PID 4616 wrote to memory of 3972	4616	csrss.exe	Gaara.exe
PID 4616 wrote to memory of 3972	4616	csrss.exe	Gaara.exe
PID 4616 wrote to memory of 3056	4616	csrss.exe	csrss.exe
PID 4616 wrote to memory of 3056	4616	csrss.exe	csrss.exe
PID 4616 wrote to memory of 3056	4616	csrss.exe	csrss.exe
PID 4616 wrote to memory of 840	4616	csrss.exe	Kazekage.exe
PID 4616 wrote to memory of 840	4616	csrss.exe	Kazekage.exe
PID 4616 wrote to memory of 840	4616	csrss.exe	Kazekage.exe
PID 840 wrote to memory of 3080	840	Kazekage.exe	smss.exe
PID 840 wrote to memory of 3080	840	Kazekage.exe	smss.exe
PID 840 wrote to memory of 3080	840	Kazekage.exe	smss.exe
PID 840 wrote to memory of 3168	840	Kazekage.exe	Gaara.exe
PID 840 wrote to memory of 3168	840	Kazekage.exe	Gaara.exe
PID 840 wrote to memory of 3168	840	Kazekage.exe	Gaara.exe
PID 840 wrote to memory of 2340	840	Kazekage.exe	csrss.exe
PID 840 wrote to memory of 2340	840	Kazekage.exe	csrss.exe
PID 840 wrote to memory of 2340	840	Kazekage.exe	csrss.exe
PID 840 wrote to memory of 1112	840	Kazekage.exe	Kazekage.exe
PID 840 wrote to memory of 1112	840	Kazekage.exe	Kazekage.exe
PID 840 wrote to memory of 1112	840	Kazekage.exe	Kazekage.exe
PID 840 wrote to memory of 4552	840	Kazekage.exe	system32.exe
PID 840 wrote to memory of 4552	840	Kazekage.exe	system32.exe
PID 840 wrote to memory of 4552	840	Kazekage.exe	system32.exe
PID 4552 wrote to memory of 3476	4552	system32.exe	smss.exe
PID 4552 wrote to memory of 3476	4552	system32.exe	smss.exe
PID 4552 wrote to memory of 3476	4552	system32.exe	smss.exe
PID 4552 wrote to memory of 1676	4552	system32.exe	Gaara.exe
PID 4552 wrote to memory of 1676	4552	system32.exe	Gaara.exe
PID 4552 wrote to memory of 1676	4552	system32.exe	Gaara.exe
PID 4552 wrote to memory of 3816	4552	system32.exe	csrss.exe
PID 4552 wrote to memory of 3816	4552	system32.exe	csrss.exe
PID 4552 wrote to memory of 3816	4552	system32.exe	csrss.exe
PID 4552 wrote to memory of 1364	4552	system32.exe	Kazekage.exe
PID 4552 wrote to memory of 1364	4552	system32.exe	Kazekage.exe
PID 4552 wrote to memory of 1364	4552	system32.exe	Kazekage.exe
PID 4552 wrote to memory of 2672	4552	system32.exe	system32.exe
PID 4552 wrote to memory of 2672	4552	system32.exe	system32.exe
PID 4552 wrote to memory of 2672	4552	system32.exe	system32.exe
PID 4616 wrote to memory of 4776	4616	csrss.exe	system32.exe
PID 4616 wrote to memory of 4776	4616	csrss.exe	system32.exe
PID 4616 wrote to memory of 4776	4616	csrss.exe	system32.exe
PID 3312 wrote to memory of 1604	3312	Gaara.exe	Kazekage.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.exesystem32.exe1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exeGaara.exeKazekage.exesmss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

C:\Users\Admin\AppData\Local\Temp\1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ce8afbfdcc164926ec336289a269040_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2576

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2236

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3312

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:840

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3080

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3168

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4552

C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3476

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
7⤵
- Runs ping.exe
PID:3096

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
7⤵
- Runs ping.exe
PID:1816

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
7⤵
- Runs ping.exe
PID:412

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
7⤵
- Runs ping.exe
PID:3184

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
7⤵
- Runs ping.exe
PID:1460

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
7⤵
- Runs ping.exe
PID:1656

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
6⤵
- Runs ping.exe
PID:5072

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
6⤵
- Runs ping.exe
PID:4580

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
6⤵
- Runs ping.exe
PID:1924

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
6⤵
- Runs ping.exe
PID:4116

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
6⤵
- Runs ping.exe
PID:4240

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
6⤵
- Runs ping.exe
PID:4988

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:1316

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:2936

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:1528

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:4788

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:2708

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:2720

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
4⤵
- Runs ping.exe
PID:3436

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
4⤵
- Runs ping.exe
PID:3444

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
4⤵
- Runs ping.exe
PID:1980

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
4⤵
- Runs ping.exe
PID:3436

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
4⤵
- Runs ping.exe
PID:544

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
4⤵
- Runs ping.exe
PID:732

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4440

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
3⤵
- Runs ping.exe
PID:4140

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
3⤵
- Runs ping.exe
PID:5012

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
3⤵
- Runs ping.exe
PID:1420

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
3⤵
- Runs ping.exe
PID:1696

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
3⤵
- Runs ping.exe
PID:2424

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
3⤵
- Runs ping.exe
PID:3024

C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4080

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:1784

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:4652

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:3992

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:1272

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Admin Games\Readme.txt
Filesize
736B

MD5
bb5d6abdf8d0948ac6895ce7fdfbc151

SHA1
9266b7a247a4685892197194d2b9b86c8f6dddbd

SHA256
5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

SHA512
878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

Download Submit
C:\Autorun.inf
Filesize
196B

MD5
1564dfe69ffed40950e5cb644e0894d1

SHA1
201b6f7a01cc49bb698bea6d4945a082ed454ce4

SHA256
be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

SHA512
72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

Download Submit
C:\Gaara.exe
Filesize
148KB

MD5
1ce8afbfdcc164926ec336289a269040

SHA1
414f3f9bd023c8c5fb6c4151346b2b9d365b438f

SHA256
e0d530ca82886916d05342cfc7546aa33f93d99ffc2ac0c79f64c10a8600d755

SHA512
56897f751b972edc7e16a832595aad8ce696e5f3af958728e79e33b8ba44ea071c35238f745410271fe7ee79ae578055edd8479939bed219471419d037255a13

Download Submit
C:\Windows\Fonts\Admin 24 - 5 - 2024\Gaara.exe
Filesize
148KB

MD5
4d7dc4e2751cda2ec670324b648f9699

SHA1
6ddaea9d8394f2a443f62c547e059052f72c4d47

SHA256
912d53850d642eadf97cfd26071f59e8c9e7a18f694c120426206e30bd6393d8

SHA512
097363f25a2c93e9bd155d6bc9edcb934e2bcf3f258f27537345089554d2cd1e7d3803cdc910838cf9f7c3f7b8eade0ccc750549818c94d2fa5651b971707f21

Download Submit
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
Filesize
148KB

MD5
584aa0422aa52c8d1c66749963b51d3a

SHA1
379cca6d6db1d4e79b142f5e828ac92f9f1b17c7

SHA256
70caa4bd81a70db14e0a8f3774e0a8cf44a660ef75be66d28963dd13e713d46a

SHA512
a65b981895eef2b934e5710c8152997fd1207c8045a1c2ae2b3bce769b2785ad86a63f7f0b41a9d033654c4ca027becae55d7b8634990d8a61127958ad6ba255

Download Submit
C:\Windows\Fonts\Admin 24 - 5 - 2024\csrss.exe
Filesize
148KB

MD5
ce588fbb6605e5a46c2336aed1e1a3ce

SHA1
196845a65912087034aa5f2b41788db16895f234

SHA256
07ab5512513d9eefe88f9b4279243627db934c840dc099da040603d7a24ff7f0

SHA512
49c68bbe37d4b38e7effc980c045a1baa98b135c8a0cbe4953c189f9da57fc82e92d01e14fb96d93198cfd01ea91503079e923f00e6fdc4526c0252eaf77d6fc

Download Submit
C:\Windows\Fonts\Admin 24 - 5 - 2024\smss.exe
Filesize
148KB

MD5
7961291c3f46c3ef9060489f1861741f

SHA1
ec895484f482dcf15ef2b8749bcca19320f09d70

SHA256
994bdcd39aaebbff491404fabf3bc466522199ae5c182d0ffbbc56fed2e0c168

SHA512
4a5bef10bf8e797feb8f1261cffd93aa9c5e95328105ebcc1721bac584af8f9efed33564ce9ba2eaa411801a882ffccde9b359f788dd9818fd61d53f630d16f4

Download Submit
C:\Windows\Fonts\The Kazekage.jpg
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Fonts\The Kazekage.jpg
Filesize
1.4MB

MD5
d6b05020d4a0ec2a3a8b687099e335df

SHA1
df239d830ebcd1cde5c68c46a7b76dad49d415f4

SHA256
9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

SHA512
78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

Download Submit
C:\Windows\SysWOW64\24-5-2024.exe
Filesize
148KB

MD5
95202d7be5aefcc46cf83bf2b299c298

SHA1
cb5e220209983cff9b8ab1547ec5c45d9cbbc452

SHA256
79cce3e9ea8fd980c43672095964191a134189cbbb15601e6ad471fa592bff92

SHA512
76b87bb4ab4d713f850357bf855b5530103fd5ff3ae5849ce1056c3106295b3d820e1845e0f763aac945daf27a3867c07a55599c94f96663da324ecc332c881b

Download Submit
C:\Windows\SysWOW64\24-5-2024.exe
Filesize
148KB

MD5
f411c89a17bb337ddeb0b4047d524c93

SHA1
36c8cd24ea35c528cd1b5afa3df4cfc0dc7c8b30

SHA256
4355cadb985ec234633e002743be3f143d8603c344659847e301fefab662208a

SHA512
f63659cd9c1c35bc0ea5b98e6ce74d28e19d5307f1c3d1d73ddfd77e88e4c1469d0a3d4b28704ee07f550e1e9c1b288f332c87968d4d41303658819580ad695c

Download Submit
C:\Windows\SysWOW64\24-5-2024.exe
Filesize
148KB

MD5
42bd36b82b25f9bdb60ff65295aefbcd

SHA1
f19e27a947058032a432c8fad84f8b3f29e1870c

SHA256
fd486e3aefb77102ca5f972ed096a1e9785cf5b154dfb1f4def1a3a0f979867c

SHA512
f3e45cba1640ea26939638cc0be60a0126f3b0c9ba1508a1015d1f31bab027130945bcd475314330d8721f441fc85381ded161c5d9b093e1f42c9ddf3adb101e

Download Submit
C:\Windows\SysWOW64\24-5-2024.exe
Filesize
148KB

MD5
fc319a8fa7eb74b4af016d8fcd057f29

SHA1
05ea072f5dae1de80d013a748de8ee9c2196f2af

SHA256
eef94d6ff99576b21deb196bda7957a050e6a0605f8638e4e94a19b141acc0fb

SHA512
97ff7cb4d7d78da2e0f9cfe3722034e9e5672932584036e902a379d4ec33808ff55870fccd92207a3de40df8d9f63865e44c9a56ab2a0b18b200ead82e96e05d

Download Submit
C:\Windows\SysWOW64\24-5-2024.exe
Filesize
148KB

MD5
8ef5667f8e5f0b8860666268a84e8c93

SHA1
0bac585f131f17fc2bbe55bae16b4118c22d3c84

SHA256
9288701f8f8940b3405bb005b02850f1778cae0eb84f3f407b7d4543809e9e8e

SHA512
72eabaceb2e5ba4d153015840e9b6a5585e821c31f7110955a31327f12478acc92d8096d1fbc354391048a005cc4b3d8e84cbe9aeb39c6e28ecb1b9379558023

Download Submit
C:\Windows\SysWOW64\Desktop.ini
Filesize
65B

MD5
64acfa7e03b01f48294cf30d201a0026

SHA1
10facd995b38a095f30b4a800fa454c0bcbf8438

SHA256
ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

SHA512
65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
148KB

MD5
3f8be47914f97a02e72568ebebf7989f

SHA1
5d604f49dabb0f9c95cbdf4687d776b5c1c0cbcc

SHA256
2cafac2e32a0b7cadddf20e174d79df19c14ae5a2332c2b73ddadb72bf5b857b

SHA512
bb0a48e1fe28527a03d6e41301c7400f45cbcb00ade46dd3f95d24e9849db4afd733936bf5c557173ae6ac9ab6275ba6e82b8b7a6c12bf6543e719515139fa4f

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
148KB

MD5
140b98ef047bdc7b56ce7336d2d533b4

SHA1
131a679022740c5155d4827e2567e8042d9ae738

SHA256
bc34d2258ade51b3ca02b3e343e32b9a04477f479ae08c51b0544a7e02427de0

SHA512
c740348f70c2a0ef2e740ab624f1431a774aed314dace1f84ab49ca8b3da43c3ce42e79f04ad07050c9a2c4025b886335f39316bbb62686c1cc86d0b4c794efe

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
148KB

MD5
39b82fccef58bb9ecc439fdbaf8ee1ff

SHA1
a70f4c38fac9c3b17ac2278db864b9fd45f41a1d

SHA256
1d7250d179ab6e369ae70a2a953e14882ea4823befe31b7b7f9d74b40e9130a4

SHA512
6d1240253302f22b1143340077bc31997090a5ddd55d7b0ad12cda8bd77b74f746676a54d294c69de2ec08d2de0cd9f6b727db88b12b6db06b7843036849a76d

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
148KB

MD5
3728f7316dc8f5e5d35281696a502d8c

SHA1
65147d0ae6fc80c858230752429ad4756947fd84

SHA256
b1f401cfb9090d0edcaac7318a811f9636b5c3f7462865af931f792cf1404e79

SHA512
a6d77c1d1617e0e221f88ca856f631a6ffb21963e0eb158a142d5017100cf71154c57038467a89ac8ae990f9b400e20291aa74c8f306073fef0a358b908af95c

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
148KB

MD5
080d6e142976994f1a381aad3081ebc8

SHA1
e9639dbfcb2d6d9974028c11040a084db7a6b329

SHA256
a78f3810a10f4efb6278fb5bd5f418b88fffd90c0f218137c88c2cc489c2f88d

SHA512
7073de347d577fa5635b6fdbc3be77518c5b8efeec867798068cdca65ed9e1e4fc95b0862bad7339236c50d3522419ba05db169b75dcf258a1527dd40407f39f

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
148KB

MD5
fc527a23edfb135318cb066430fefed4

SHA1
8a325233c9efd6b045af9aa3860ce409c7a0c5c0

SHA256
1e3783cde58f8dc520fc3d8a19e25a39e6b3e5aaa58ced408d0ff177bb26e4f4

SHA512
2b420f9755938d2b71205448072aec942eaba65ed7f139ba73808c4580b5119a3722d8c3211d4e268cbdd13b22a4e1474cc4983796166791ee92143989d2243e

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
148KB

MD5
0b464b094990da9e36e2ca4901da17a9

SHA1
e9a79333ed106994f77aa2c33850b6aab3710f62

SHA256
b53459060010c0475d1bf34aa0116577e08ade62f13c35544bb89a74f50ca599

SHA512
4394a56b3035aeb03f25f135b551cd04628232be081fa48fc682a78479d27cc377e7c0b301be460c1d197b88a2c02d5ddc9a531977073b3bb6be1adce6888890

Download Submit
C:\Windows\System\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
memory/840-943-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/840-164-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1112-206-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1364-237-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1604-250-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1676-231-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2100-271-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2192-253-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2236-33-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2236-940-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2340-200-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2372-262-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2576-939-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2576-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2672-238-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2672-241-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2820-256-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3004-265-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3056-161-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3080-191-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3168-196-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3312-941-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3312-78-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3476-227-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3488-119-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3488-114-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3816-234-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3816-230-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3972-156-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3984-76-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3984-70-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4080-274-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4412-268-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4440-259-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4552-205-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4616-120-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4616-942-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4776-247-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/5004-111-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download