1cf92536c3efe3af302b54ecd48cea8a301ce1a0b68a6c6231c7783aa4866a95

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Size

146KB
MD5

320867c337db174c60200b23d21a16a0
SHA1

49032d1539d5cb93d4bd0dbf28f40cf983c5e004
SHA256

1cf92536c3efe3af302b54ecd48cea8a301ce1a0b68a6c6231c7783aa4866a95
SHA512

8d171fc12e6c0d11babab2b0b3badfa677c269b41ba5087fb96c234ded97a4ee33a398b87745233fbd994d8d49d14e0a34faa16f8ad82c0574c6b91e72b9b7ba
SSDEEP

3072:tx6AHjYzaFXg+w17jsgS/jHagQg1dxiEVO:txzYzaFXi17jWO

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Kazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.execsrss.exeGaara.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Gaara.execsrss.exeKazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

system32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.execsrss.exesystem32.exesmss.exeGaara.exeKazekage.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Kazekage.exesmss.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exeGaara.execsrss.exesystem32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Gaara.exe

Executes dropped EXE 30 IoCs

Processes:

smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exe

pid	process
2972	smss.exe
2116	smss.exe
4896	Gaara.exe
4376	smss.exe
2756	Gaara.exe
2812	csrss.exe
1632	smss.exe
4120	Gaara.exe
3308	csrss.exe
2452	Kazekage.exe
4380	smss.exe
4036	Gaara.exe
4928	csrss.exe
1596	Kazekage.exe
3000	system32.exe
3336	smss.exe
1776	Gaara.exe
3376	csrss.exe
1280	Kazekage.exe
3004	system32.exe
228	system32.exe
3120	Kazekage.exe
2704	system32.exe
1424	csrss.exe
4960	Kazekage.exe
4872	system32.exe
3068	Gaara.exe
1184	csrss.exe
3048	Kazekage.exe
3720	system32.exe

Loads dropped DLL 18 IoCs

Processes:

smss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.execsrss.exeGaara.execsrss.exe

pid	process
2972	smss.exe
2116	smss.exe
4896	Gaara.exe
4376	smss.exe
2756	Gaara.exe
2812	csrss.exe
1632	smss.exe
4120	Gaara.exe
3308	csrss.exe
4380	smss.exe
4036	Gaara.exe
4928	csrss.exe
3336	smss.exe
1776	Gaara.exe
3376	csrss.exe
1424	csrss.exe
3068	Gaara.exe
1184	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exeKazekage.exesystem32.exesmss.exeGaara.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 25 - 5 - 2024\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "25-5-2024.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 25 - 5 - 2024\\Gaara.exe"	smss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Kazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

Kazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.execsrss.exeGaara.exesmss.exe

description	ioc	process
File opened for modification	\??\M:\Desktop.ini	Kazekage.exe
File opened for modification	\??\P:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	\??\N:\Desktop.ini	system32.exe
File opened for modification	\??\O:\Desktop.ini	system32.exe
File opened for modification	\??\G:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	\??\E:\Desktop.ini	csrss.exe
File opened for modification	\??\Y:\Desktop.ini	Gaara.exe
File opened for modification	\??\L:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\E:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	csrss.exe
File opened for modification	\??\L:\Desktop.ini	Kazekage.exe
File opened for modification	\??\N:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\K:\Desktop.ini	Gaara.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	Kazekage.exe
File opened for modification	\??\P:\Desktop.ini	system32.exe
File opened for modification	\??\J:\Desktop.ini	csrss.exe
File opened for modification	\??\U:\Desktop.ini	Kazekage.exe
File opened for modification	\??\G:\Desktop.ini	smss.exe
File opened for modification	\??\S:\Desktop.ini	smss.exe
File opened for modification	\??\E:\Desktop.ini	Gaara.exe
File opened for modification	\??\R:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Desktop.ini	smss.exe
File opened for modification	\??\O:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\M:\Desktop.ini	smss.exe
File opened for modification	\??\P:\Desktop.ini	Gaara.exe
File opened for modification	\??\U:\Desktop.ini	csrss.exe
File opened for modification	\??\A:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\I:\Desktop.ini	smss.exe
File opened for modification	\??\L:\Desktop.ini	smss.exe
File opened for modification	\??\B:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	system32.exe
File opened for modification	\??\S:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	D:\Desktop.ini	smss.exe
File opened for modification	\??\H:\Desktop.ini	Gaara.exe
File opened for modification	\??\Z:\Desktop.ini	Gaara.exe
File opened for modification	\??\K:\Desktop.ini	csrss.exe
File opened for modification	\??\A:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	system32.exe
File opened for modification	\??\V:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	Gaara.exe
File opened for modification	\??\H:\Desktop.ini	csrss.exe
File opened for modification	\??\A:\Desktop.ini	Kazekage.exe
File opened for modification	\??\N:\Desktop.ini	Kazekage.exe
File opened for modification	\??\M:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	system32.exe
File opened for modification	\??\T:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	csrss.exe
File opened for modification	\??\E:\Desktop.ini	Kazekage.exe
File opened for modification	\??\T:\Desktop.ini	system32.exe
File opened for modification	\??\M:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\O:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Z:\Desktop.ini	smss.exe
File opened for modification	\??\B:\Desktop.ini	Kazekage.exe
File opened for modification	\??\X:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\P:\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\P:\Desktop.ini	csrss.exe
File opened for modification	\??\S:\Desktop.ini	csrss.exe
File opened for modification	\??\K:\Desktop.ini	Kazekage.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Kazekage.exesystem32.exeGaara.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.execsrss.exe

description	ioc	process
File opened (read-only)	\??\G:	Kazekage.exe
File opened (read-only)	\??\I:	system32.exe
File opened (read-only)	\??\V:	Gaara.exe
File opened (read-only)	\??\Q:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\V:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\X:	Gaara.exe
File opened (read-only)	\??\U:	csrss.exe
File opened (read-only)	\??\J:	system32.exe
File opened (read-only)	\??\K:	system32.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\E:	Kazekage.exe
File opened (read-only)	\??\G:	system32.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\J:	Kazekage.exe
File opened (read-only)	\??\N:	Kazekage.exe
File opened (read-only)	\??\H:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\K:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\I:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\Z:	Gaara.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\A:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\O:	Gaara.exe
File opened (read-only)	\??\L:	Gaara.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\P:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\E:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\W:	Kazekage.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\B:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	system32.exe
File opened (read-only)	\??\R:	system32.exe
File opened (read-only)	\??\L:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	Gaara.exe
File opened (read-only)	\??\J:	Gaara.exe
File opened (read-only)	\??\M:	Kazekage.exe
File opened (read-only)	\??\O:	Kazekage.exe
File opened (read-only)	\??\O:	system32.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\Y:	Gaara.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\W:	Gaara.exe
File opened (read-only)	\??\U:	Kazekage.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

smss.execsrss.exesystem32.exeGaara.exeKazekage.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe

description	ioc	process
File created	\??\G:\Autorun.inf	smss.exe
File created	\??\H:\Autorun.inf	csrss.exe
File opened for modification	\??\J:\Autorun.inf	csrss.exe
File opened for modification	\??\H:\Autorun.inf	system32.exe
File opened for modification	\??\O:\Autorun.inf	system32.exe
File opened for modification	\??\S:\Autorun.inf	system32.exe
File created	\??\B:\Autorun.inf	smss.exe
File opened for modification	\??\P:\Autorun.inf	Gaara.exe
File opened for modification	\??\B:\Autorun.inf	Kazekage.exe
File opened for modification	\??\Q:\Autorun.inf	Kazekage.exe
File opened for modification	\??\R:\Autorun.inf	system32.exe
File opened for modification	\??\T:\Autorun.inf	system32.exe
File opened for modification	C:\Autorun.inf	smss.exe
File opened for modification	\??\T:\Autorun.inf	smss.exe
File opened for modification	\??\Q:\Autorun.inf	Gaara.exe
File opened for modification	\??\E:\Autorun.inf	csrss.exe
File created	\??\I:\Autorun.inf	Kazekage.exe
File opened for modification	\??\L:\Autorun.inf	system32.exe
File opened for modification	F:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	\??\W:\Autorun.inf	Kazekage.exe
File created	\??\A:\Autorun.inf	system32.exe
File created	\??\E:\Autorun.inf	smss.exe
File opened for modification	\??\K:\Autorun.inf	csrss.exe
File opened for modification	\??\A:\Autorun.inf	smss.exe
File created	\??\H:\Autorun.inf	smss.exe
File opened for modification	\??\Y:\Autorun.inf	Gaara.exe
File created	\??\X:\Autorun.inf	Kazekage.exe
File opened for modification	\??\X:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\M:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\W:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	D:\Autorun.inf	smss.exe
File created	\??\A:\Autorun.inf	Gaara.exe
File opened for modification	\??\I:\Autorun.inf	csrss.exe
File created	\??\J:\Autorun.inf	Kazekage.exe
File created	\??\U:\Autorun.inf	system32.exe
File created	C:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\W:\Autorun.inf	system32.exe
File created	\??\I:\Autorun.inf	Gaara.exe
File created	\??\G:\Autorun.inf	Kazekage.exe
File opened for modification	\??\Z:\Autorun.inf	smss.exe
File created	\??\S:\Autorun.inf	Gaara.exe
File created	\??\W:\Autorun.inf	csrss.exe
File opened for modification	\??\K:\Autorun.inf	Gaara.exe
File created	\??\O:\Autorun.inf	smss.exe
File opened for modification	\??\B:\Autorun.inf	Gaara.exe
File opened for modification	\??\A:\Autorun.inf	Kazekage.exe
File opened for modification	\??\J:\Autorun.inf	smss.exe
File created	\??\H:\Autorun.inf	Gaara.exe
File opened for modification	\??\W:\Autorun.inf	csrss.exe
File opened for modification	\??\X:\Autorun.inf	system32.exe
File created	\??\T:\Autorun.inf	smss.exe
File created	\??\B:\Autorun.inf	csrss.exe
File opened for modification	\??\O:\Autorun.inf	csrss.exe
File opened for modification	\??\X:\Autorun.inf	Kazekage.exe
File opened for modification	\??\G:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	\??\K:\Autorun.inf	smss.exe
File opened for modification	\??\Y:\Autorun.inf	smss.exe
File created	\??\N:\Autorun.inf	Gaara.exe
File created	\??\O:\Autorun.inf	Gaara.exe
File opened for modification	\??\R:\Autorun.inf	Gaara.exe
File created	\??\X:\Autorun.inf	Gaara.exe
File opened for modification	\??\U:\Autorun.inf	csrss.exe
File opened for modification	\??\J:\Autorun.inf	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	\??\U:\Autorun.inf	Kazekage.exe

Drops file in System32 directory 39 IoCs

Processes:

csrss.exeKazekage.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exesystem32.exeGaara.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File created	C:\Windows\SysWOW64\25-5-2024.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\25-5-2024.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe

Drops file in Windows directory 64 IoCs

Processes:

system32.exesmss.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.execsrss.exeKazekage.exeGaara.exe

description	ioc	process
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	system32.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	Kazekage.exe
File opened for modification	C:\Windows\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\system\mscoree.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	smss.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	smss.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Gaara.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\system\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	smss.exe
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	system32.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	system32.exe
File created	C:\Windows\mscomctl.ocx	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	system32.exe
File opened for modification	C:\Windows\	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File created	C:\Windows\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	csrss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\	system32.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Gaara.exe
File created	C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe	system32.exe

Modifies Control Panel 64 IoCs

evasion

Processes:

csrss.exeKazekage.exesmss.exeGaara.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\WallpaperStyle = "2"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Size = "72"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Size = "72"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\WallpaperStyle = "2"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exesystem32.exeKazekage.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe

Modifies registry class 51 IoCs

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.exeKazekage.execsrss.exesystem32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	csrss.exe

Runs ping.exe 1 TTPs 28 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
3096	ping.exe
4772	ping.exe
1196	ping.exe
4500	ping.exe
1736	ping.exe
1836	ping.exe
4372	ping.exe
3940	ping.exe
1084	ping.exe
4812	ping.exe
4244	ping.exe
1012	ping.exe
1624	ping.exe
1776	ping.exe
1236	ping.exe
1112	ping.exe
440	ping.exe
1996	ping.exe
4980	ping.exe
3336	ping.exe
4644	ping.exe
4284	ping.exe
3200	ping.exe
380	ping.exe
3068	ping.exe
2888	ping.exe
3568	ping.exe
2264	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exeKazekage.exesystem32.exe

pid	process
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2812	csrss.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
2452	Kazekage.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe
3000	system32.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exesmss.exeGaara.exesmss.exeGaara.execsrss.exesmss.exeGaara.execsrss.exeKazekage.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exesystem32.exeKazekage.exesystem32.execsrss.exeKazekage.exesystem32.exeGaara.execsrss.exeKazekage.exesystem32.exe

pid	process
2368	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
2972	smss.exe
2116	smss.exe
4896	Gaara.exe
4376	smss.exe
2756	Gaara.exe
2812	csrss.exe
1632	smss.exe
4120	Gaara.exe
3308	csrss.exe
2452	Kazekage.exe
4380	smss.exe
4036	Gaara.exe
4928	csrss.exe
1596	Kazekage.exe
3000	system32.exe
3336	smss.exe
1776	Gaara.exe
3376	csrss.exe
1280	Kazekage.exe
3004	system32.exe
228	system32.exe
3120	Kazekage.exe
2704	system32.exe
1424	csrss.exe
4960	Kazekage.exe
4872	system32.exe
3068	Gaara.exe
1184	csrss.exe
3048	Kazekage.exe
3720	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.execsrss.exeKazekage.exesystem32.exe

description	pid	process	target process
PID 2368 wrote to memory of 2972	2368	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe	smss.exe
PID 2368 wrote to memory of 2972	2368	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe	smss.exe
PID 2368 wrote to memory of 2972	2368	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe	smss.exe
PID 2972 wrote to memory of 2116	2972	smss.exe	smss.exe
PID 2972 wrote to memory of 2116	2972	smss.exe	smss.exe
PID 2972 wrote to memory of 2116	2972	smss.exe	smss.exe
PID 2972 wrote to memory of 4896	2972	smss.exe	Gaara.exe
PID 2972 wrote to memory of 4896	2972	smss.exe	Gaara.exe
PID 2972 wrote to memory of 4896	2972	smss.exe	Gaara.exe
PID 4896 wrote to memory of 4376	4896	Gaara.exe	smss.exe
PID 4896 wrote to memory of 4376	4896	Gaara.exe	smss.exe
PID 4896 wrote to memory of 4376	4896	Gaara.exe	smss.exe
PID 4896 wrote to memory of 2756	4896	Gaara.exe	Gaara.exe
PID 4896 wrote to memory of 2756	4896	Gaara.exe	Gaara.exe
PID 4896 wrote to memory of 2756	4896	Gaara.exe	Gaara.exe
PID 4896 wrote to memory of 2812	4896	Gaara.exe	csrss.exe
PID 4896 wrote to memory of 2812	4896	Gaara.exe	csrss.exe
PID 4896 wrote to memory of 2812	4896	Gaara.exe	csrss.exe
PID 2812 wrote to memory of 1632	2812	csrss.exe	smss.exe
PID 2812 wrote to memory of 1632	2812	csrss.exe	smss.exe
PID 2812 wrote to memory of 1632	2812	csrss.exe	smss.exe
PID 2812 wrote to memory of 4120	2812	csrss.exe	Gaara.exe
PID 2812 wrote to memory of 4120	2812	csrss.exe	Gaara.exe
PID 2812 wrote to memory of 4120	2812	csrss.exe	Gaara.exe
PID 2812 wrote to memory of 3308	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 3308	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 3308	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2452	2812	csrss.exe	Kazekage.exe
PID 2812 wrote to memory of 2452	2812	csrss.exe	Kazekage.exe
PID 2812 wrote to memory of 2452	2812	csrss.exe	Kazekage.exe
PID 2452 wrote to memory of 4380	2452	Kazekage.exe	smss.exe
PID 2452 wrote to memory of 4380	2452	Kazekage.exe	smss.exe
PID 2452 wrote to memory of 4380	2452	Kazekage.exe	smss.exe
PID 2452 wrote to memory of 4036	2452	Kazekage.exe	Gaara.exe
PID 2452 wrote to memory of 4036	2452	Kazekage.exe	Gaara.exe
PID 2452 wrote to memory of 4036	2452	Kazekage.exe	Gaara.exe
PID 2452 wrote to memory of 4928	2452	Kazekage.exe	csrss.exe
PID 2452 wrote to memory of 4928	2452	Kazekage.exe	csrss.exe
PID 2452 wrote to memory of 4928	2452	Kazekage.exe	csrss.exe
PID 2452 wrote to memory of 1596	2452	Kazekage.exe	Kazekage.exe
PID 2452 wrote to memory of 1596	2452	Kazekage.exe	Kazekage.exe
PID 2452 wrote to memory of 1596	2452	Kazekage.exe	Kazekage.exe
PID 2452 wrote to memory of 3000	2452	Kazekage.exe	system32.exe
PID 2452 wrote to memory of 3000	2452	Kazekage.exe	system32.exe
PID 2452 wrote to memory of 3000	2452	Kazekage.exe	system32.exe
PID 3000 wrote to memory of 3336	3000	system32.exe	smss.exe
PID 3000 wrote to memory of 3336	3000	system32.exe	smss.exe
PID 3000 wrote to memory of 3336	3000	system32.exe	smss.exe
PID 3000 wrote to memory of 1776	3000	system32.exe	Gaara.exe
PID 3000 wrote to memory of 1776	3000	system32.exe	Gaara.exe
PID 3000 wrote to memory of 1776	3000	system32.exe	Gaara.exe
PID 3000 wrote to memory of 3376	3000	system32.exe	csrss.exe
PID 3000 wrote to memory of 3376	3000	system32.exe	csrss.exe
PID 3000 wrote to memory of 3376	3000	system32.exe	csrss.exe
PID 3000 wrote to memory of 1280	3000	system32.exe	Kazekage.exe
PID 3000 wrote to memory of 1280	3000	system32.exe	Kazekage.exe
PID 3000 wrote to memory of 1280	3000	system32.exe	Kazekage.exe
PID 3000 wrote to memory of 3004	3000	system32.exe	system32.exe
PID 3000 wrote to memory of 3004	3000	system32.exe	system32.exe
PID 3000 wrote to memory of 3004	3000	system32.exe	system32.exe
PID 2812 wrote to memory of 228	2812	csrss.exe	system32.exe
PID 2812 wrote to memory of 228	2812	csrss.exe	system32.exe
PID 2812 wrote to memory of 228	2812	csrss.exe	system32.exe
PID 4896 wrote to memory of 3120	4896	Gaara.exe	Kazekage.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.exeKazekage.exesystem32.exe320867c337db174c60200b23d21a16a0_NeikiAnalytics.exesmss.exeGaara.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe

C:\Users\Admin\AppData\Local\Temp\320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\320867c337db174c60200b23d21a16a0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2116

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4896

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4376

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2756

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2812

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4120

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3308

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2452

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4036

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3000

C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3336

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
7⤵
- Runs ping.exe
PID:4644

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
7⤵
- Runs ping.exe
PID:1012

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
7⤵
- Runs ping.exe
PID:440

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
7⤵
- Runs ping.exe
PID:1836

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
6⤵
- Runs ping.exe
PID:2888

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
6⤵
- Runs ping.exe
PID:4244

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
6⤵
- Runs ping.exe
PID:3336

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
6⤵
- Runs ping.exe
PID:380

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:1736

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:4812

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:1084

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:4284

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
5⤵
- Runs ping.exe
PID:4980

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
5⤵
- Runs ping.exe
PID:3200

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
4⤵
- Runs ping.exe
PID:4372

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
4⤵
- Runs ping.exe
PID:1236

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
4⤵
- Runs ping.exe
PID:1996

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
4⤵
- Runs ping.exe
PID:4772

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
3⤵
- Runs ping.exe
PID:3068

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
3⤵
- Runs ping.exe
PID:4500

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
3⤵
- Runs ping.exe
PID:2264

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
3⤵
- Runs ping.exe
PID:1624

C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
"C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Windows\SysWOW64\drivers\Kazekage.exe
C:\Windows\system32\drivers\Kazekage.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3048

C:\Windows\SysWOW64\drivers\system32.exe
C:\Windows\system32\drivers\system32.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:1196

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:1776

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:3568

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:3940

C:\Windows\SysWOW64\ping.exe
ping -a -l www.rasasayang.com.my 65500
2⤵
- Runs ping.exe
PID:3096

C:\Windows\SysWOW64\ping.exe
ping -a -l www.duniasex.com 65500
2⤵
- Runs ping.exe
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Admin Games\Readme.txt
Filesize
736B

MD5
bb5d6abdf8d0948ac6895ce7fdfbc151

SHA1
9266b7a247a4685892197194d2b9b86c8f6dddbd

SHA256
5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

SHA512
878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

Download Submit
C:\Autorun.inf
Filesize
196B

MD5
1564dfe69ffed40950e5cb644e0894d1

SHA1
201b6f7a01cc49bb698bea6d4945a082ed454ce4

SHA256
be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

SHA512
72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

Download Submit
C:\Windows\Fonts\Admin 25 - 5 - 2024\Gaara.exe
Filesize
146KB

MD5
b48e58204fb72879b996a6c2082230a2

SHA1
879babdeeb0bc1f45ddaff84b14d9ac854b6e51a

SHA256
2d2fcbed0debf7799cf2930a5e71fc1ce4666e1fc1eacbc65605ddd47815ea2e

SHA512
b810d00dfbc1173b688d57d635e1575d265ee0bdc799eb923ef2be055d605f830911544a108e23c66a89b0f6594e1ae4304bbc58b942c5417dafb9bb0c8dfc5a

Download Submit
C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
Filesize
63KB

MD5
38dfa4524ef8533192855eb5506f6c6f

SHA1
6a101ddb5b15e3928dd867c3c2ae39c8fb137c25

SHA256
76a436f331a8422ea8de61a302f747ea6b9c018254ea5f125da28b47f8f0724d

SHA512
8230c351507f2fd01f7776420b0447a2c68c1b3fae88da21cc52ec1cf004539b13f90b2dcedaa020cd68ac50a3449bc75cd63d58791d9bc4648ad75a726656e3

Download Submit
C:\Windows\Fonts\Admin 25 - 5 - 2024\csrss.exe
Filesize
146KB

MD5
340faecfd184cd5d215218bbf94d58ba

SHA1
f8d44b21b286815b2b438060f9c5906c4206a2fe

SHA256
5d9d89730c34b67cd9b0033be626dfaca958061ced29eb586b89387a9c9f508e

SHA512
622efcdc1c1b375c08415ed6b083676107a04131b408ea27488f09b8fee101bd5c5319f192c5559fd2d54e2a46b2dabfc956a9792698355b3bc1f9d621c39d5b

Download Submit
C:\Windows\Fonts\Admin 25 - 5 - 2024\smss.exe
Filesize
146KB

MD5
6ce7fffaba3c7528b3f3dedf94f4fbeb

SHA1
415303091f5554cd783facfeff232668949a56d0

SHA256
187d17eb8f3235e1af867cc8224262ead67905823e9b88fc32dd342e2110ac5f

SHA512
2aeedc712ab119a5dc0053cf2ced64d6a3edbc514cefc5f99bf94fb9975d778ee2e921d72d55a42b80e789fff15a65e510c304ad8792a0310f71028d019165e3

Download Submit
C:\Windows\Fonts\The Kazekage.jpg
Filesize
1.4MB

MD5
d6b05020d4a0ec2a3a8b687099e335df

SHA1
df239d830ebcd1cde5c68c46a7b76dad49d415f4

SHA256
9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

SHA512
78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
7393ce10796d2d7939efdc7f9f16f3b8

SHA1
ad2fe9c0052d91e91c153f6c593d36ea88ca8b8d

SHA256
4b4fb25e173a7a632bdfe585689b58308a0d52acf5c0b62183c8f49dd159bc03

SHA512
899b754e2decc00fcf2ffaebac1ce20a566c9aee9d8c3318c2ac1c203e106125aa1584f5c417709733d299349ba096ddbf94640d9fb4feb6aee9331bd0a2587f

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
b0e017fc13b339a77ae588467619b9d1

SHA1
ccce376f9f39c87851ee4ccc2fabeb37da753932

SHA256
8a5bc71a62e2a0bfdf7ba6da92db7780cb660429665dc6c86886804ed6a07282

SHA512
5f9281dd7cab5f1963291c04edda3f159d205a008eae1dd740f265567620ba5c460f0c2f8bc5d80ecb6a85009787ad050d21cb58aab097853782d03cc4e009a5

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
77e23291966b3311ead94a853cf0d53e

SHA1
76bbb8d5c569be84ec57fc78779d01deda747272

SHA256
7adeff6f3c8f161a6873cbc8dc5080a9ed02a851bdc77828968508d72bdaece4

SHA512
119e71f6fdeb87e15778eaf371fa50829bddb95642f02b31365f307faff6df8ddc21487a26ceaa1e77edde96625babf61d3dc038fc5a78107c720f47ad574e79

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
efa4e67ad12e3051f67d97df34b4933f

SHA1
01162874c84f1244f0a393991fc18066578dcb32

SHA256
6e07063f7764173f34ce7ff4b6c824a9d6a961f3e4d79ce3da5c948cb5940e37

SHA512
e8762e70e1ac2d9eaf49965362dc7d9d98a5761ad26f91094846648e2c67a2906fc99c5621c32c0440748e27e56e6facc4491fc4489fdbab4ca2002cae2293da

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
2e85e5297ed1ef878353287962810903

SHA1
b7c6f1b860e9822e66961bc2f3e2163bbeeb7852

SHA256
c50d22855abba7bccc24417dd224c0a95995501dcf1d73687074aa45ebf24b6b

SHA512
fcad1d051747868b0adab09c7f65bede7feedd538eabeed982c389fba8a79a8d46d1b7d5a8bae568ce2ae2581397d2b6bbb7c2b5e42b36b376c53f01119c15a4

Download Submit
C:\Windows\SysWOW64\25-5-2024.exe
Filesize
146KB

MD5
04a826a7b2ca62f7e8e4a8a249dc8d2d

SHA1
b3feb01b73fbdabf9735da99c5b45ff26f6f0576

SHA256
0e6bc16150c08d2381956547d071944f6932ead580935d1b60878e85e6f36f47

SHA512
f43f443a9299a9fceb068efae9f097744f121c47639f38bd42da86560972c6302e9cfd06254f79e3fcac1ca241bb5c07db45092f0693e57a24f1f2062b8c4ffb

Download Submit
C:\Windows\SysWOW64\Desktop.ini
Filesize
65B

MD5
64acfa7e03b01f48294cf30d201a0026

SHA1
10facd995b38a095f30b4a800fa454c0bcbf8438

SHA256
ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

SHA512
65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
146KB

MD5
de0fdf4fa305ca5216c6d4aa2c6f8620

SHA1
0efcc47ee2ef57147eae3c534b708506745b6505

SHA256
120a05a9618aede8cfea1a19a425a35dd2e50cef712b02988978fae52abc4b79

SHA512
8288ce237676e908acafcedf1dddeeb974ba15db348f15542b5cf66bdff4a43f89ec8419b72bb2e18474b2675ff43ad3fddbd7580ce11b784103bda81ff685b7

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
146KB

MD5
bd1f698bcd9cb2ef0c8a8d0e1234e610

SHA1
d5fba2b26253b47bbacc19b6774974ceab1f53b7

SHA256
33f2ebe4b5982352796b95744b8f52f14891112c45e85f94d921662f004eca89

SHA512
2b711f30aecc0135ad2fd9500b16293ddaf0fc6eaec865f764a1488c8efee3846b20a6d12e5a30cee2807fc2586d3bc3dc021e1c286715ae6d423badcc31a0c3

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe
Filesize
146KB

MD5
e4fa46e366037aafbe14c01b80cf5652

SHA1
07ebef0dcbdc70f53893f7475a16445dce2499bc

SHA256
224678a9ab324dd80e89a386a9b806973cce178a27fe4a679e215b7c6647487f

SHA512
bd67c9ee014d187d7e9b961b3b22c9450e3996c53b1402a37f7aea52bd25ad48f4871d671d22a17e7232658531ae300554ba8f2223ffe2b889353a1f94494b2b

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
146KB

MD5
ceada86c6f20fbcfdeb3316548763217

SHA1
a6591ac3fb47f4ee0e45b107aee926b14f6fc60d

SHA256
7b3fbcb4770f3e72557e330515b392685da68835bb1c7983acea5aac11092d7a

SHA512
e13abb3a462b6d154e4664ba7ff973df009aeb53f1a1b4e5bc898e38479ac2829e701e9fb6ec4be0fa6183db503f791373b2bc0703d549a883df7054d7ec35e6

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
146KB

MD5
8008f77574e1a294e1b1e9e13133b014

SHA1
f571c128afe65715894c0f58f13257b22f533d68

SHA256
c1d5b555320f147de025138c1791a688565884a3eff26e60b437bafc6ab0eb5d

SHA512
73108315442d657714108f63c28aaee3ce85d1fb46b33ad2e42d115648d2b9d5c13bda7e4d6c56190431a83be2368cb05f149af42dffcfc67b4d217482df25c2

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
146KB

MD5
8efb185c16e9f6b378ae7e6100e3a745

SHA1
4c60908e8b86bd885484dd5ea1dcb5e4828329de

SHA256
eb49abbba56fd4a245819e312f433c283d7ed217f7d7af602ba29f6c17095364

SHA512
032a063d131b7a61bd143ecc034097a316257b20f23885e830409f87a41b928169788c856a255aa55a9136b56167ef7fefc271148fd4c084b7d4e35ea0a6b93f

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe
Filesize
146KB

MD5
aa0d80396a4bdcb103b7dbb70f5bf1ca

SHA1
5a5074a739345d14de2f0cb095971f08c38754d5

SHA256
27328bd9d49ef69ff86e4a68937d21bd42b7ef4f496fbdc81a3fc033128c063a

SHA512
79c8f4d27474f3cb3dcebe268b60de868ff2281fa7f1f849ab0255639a0f7b4b789ca1b01f9373ed84ab1eca668bcc7556616fcc1146db1926827076910c129c

Download Submit
C:\Windows\System\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
F:\Admin Games\Anbu Team Sampit (Nothing).exe
Filesize
146KB

MD5
c3d4a51eeaf200fb80ad55a90f5b0d1a

SHA1
9a0f1251b556c0af48ab83ec19328d42421f10ce

SHA256
4470e3090968fab63879ee33765046ddd280aa443455360da5127104cda3f29d

SHA512
95e6b9ff54c8dea8c523fae1d0cd72d7ac02c3cb253206f894d5f14e40b36124f1bc7271d1aeaa6fb68b45ba5066bae97bae40f2e7c9499da71f1985651430b3

Download Submit
F:\Gaara.exe
Filesize
146KB

MD5
320867c337db174c60200b23d21a16a0

SHA1
49032d1539d5cb93d4bd0dbf28f40cf983c5e004

SHA256
1cf92536c3efe3af302b54ecd48cea8a301ce1a0b68a6c6231c7783aa4866a95

SHA512
8d171fc12e6c0d11babab2b0b3badfa677c269b41ba5087fb96c234ded97a4ee33a398b87745233fbd994d8d49d14e0a34faa16f8ad82c0574c6b91e72b9b7ba

Download Submit
memory/228-243-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1184-267-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1280-236-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1424-255-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1596-201-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1596-205-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1776-230-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2116-75-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2368-979-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2368-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-164-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-983-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2704-252-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2756-117-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2756-114-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2812-119-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2812-982-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2972-35-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2972-980-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3000-207-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3004-237-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3004-240-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3048-270-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3068-264-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3120-249-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3308-157-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3308-163-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3376-233-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3720-273-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4036-196-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4120-156-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4376-111-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4380-191-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4872-261-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4896-981-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4896-74-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4928-199-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4960-258-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download