Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe
Resource
win7-20231129-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe
- Size 148KB
- Sample240611-bht54axhqa
- SHA256 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226
- MD5 63ea11c2736083017e033b0b1229224e
- SHA1 13406b8147a1ecf8e533d44bd4a69e11dea914bd
- SHA512 b637097253e65eda6b00c74f2d08b0d3652add954597300d89c3860f126eeb6c574eac7c0e9fa4ba8a8991e418bb66b519f249bea0660859806f2c07ddd66d32
- SSDEEP 1536:FJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Dx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe system32.exe - Executes dropped EXE 30 IoCs
pid Process 700 smss.exe 2336 smss.exe 4524 Gaara.exe 3184 smss.exe 2400 Gaara.exe 5060 csrss.exe 2364 smss.exe 4908 Gaara.exe 8 csrss.exe 4768 Kazekage.exe 452 smss.exe 3484 Gaara.exe 5044 csrss.exe 3512 Kazekage.exe 628 system32.exe 2868 smss.exe 1644 Gaara.exe 4060 csrss.exe 948 Kazekage.exe 3212 system32.exe 5100 system32.exe 3168 Kazekage.exe 4208 system32.exe 3424 csrss.exe 3720 Kazekage.exe 2292 system32.exe 5004 Gaara.exe 4596 csrss.exe 400 Kazekage.exe 1408 system32.exe - Loads dropped DLL 18 IoCs
pid Process 700 smss.exe 2336 smss.exe 4524 Gaara.exe 3184 smss.exe 2400 Gaara.exe 5060 csrss.exe 2364 smss.exe 4908 Gaara.exe 8 csrss.exe 452 smss.exe 3484 Gaara.exe 5044 csrss.exe 2868 smss.exe 1644 Gaara.exe 4060 csrss.exe 3424 csrss.exe 5004 Gaara.exe 4596 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini smss.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\P:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\V:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\A:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification \??\E:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\K:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\X:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\E:\Desktop.ini Kazekage.exe File opened for modification \??\Z:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini system32.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\M: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\I: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\S: system32.exe File opened (read-only) \??\H: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\V: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\U: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\G: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\Q: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\I: smss.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\Y: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\P: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\N: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\B: Kazekage.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\J: 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\E: system32.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\V:\Autorun.inf Gaara.exe File created \??\N:\Autorun.inf Kazekage.exe File created \??\X:\Autorun.inf system32.exe File created \??\I:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\X:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification F:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\A:\Autorun.inf csrss.exe File opened for modification \??\Q:\Autorun.inf smss.exe File created \??\X:\Autorun.inf smss.exe File opened for modification \??\N:\Autorun.inf system32.exe File opened for modification \??\T:\Autorun.inf system32.exe File created \??\U:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\N:\Autorun.inf smss.exe File created D:\Autorun.inf smss.exe File opened for modification \??\Z:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf csrss.exe File opened for modification \??\R:\Autorun.inf system32.exe File created \??\J:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\Q:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\G:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf Kazekage.exe File opened for modification \??\P:\Autorun.inf Kazekage.exe File created \??\M:\Autorun.inf system32.exe File created \??\A:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\G:\Autorun.inf Gaara.exe File opened for modification \??\I:\Autorun.inf Gaara.exe File opened for modification \??\X:\Autorun.inf Gaara.exe File created \??\A:\Autorun.inf csrss.exe File created D:\Autorun.inf csrss.exe File opened for modification \??\G:\Autorun.inf csrss.exe File opened for modification \??\W:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File created \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\P:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File opened for modification \??\P:\Autorun.inf csrss.exe File opened for modification \??\Y:\Autorun.inf system32.exe File opened for modification \??\N:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\S:\Autorun.inf Gaara.exe File opened for modification \??\T:\Autorun.inf smss.exe File created \??\K:\Autorun.inf csrss.exe File created \??\S:\Autorun.inf csrss.exe File opened for modification \??\G:\Autorun.inf system32.exe File created \??\G:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\O:\Autorun.inf smss.exe File created \??\V:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\T:\Autorun.inf smss.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File created \??\A:\Autorun.inf system32.exe File created \??\S:\Autorun.inf system32.exe File created \??\T:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\V:\Autorun.inf csrss.exe File opened for modification \??\G:\Autorun.inf smss.exe File opened for modification \??\O:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf csrss.exe File opened for modification \??\V:\Autorun.inf Kazekage.exe File created \??\L:\Autorun.inf system32.exe File opened for modification \??\Q:\Autorun.inf system32.exe File opened for modification D:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created \??\L:\Autorun.inf 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification \??\O:\Autorun.inf Gaara.exe - Drops file in System32 directory 39 IoCs
description ioc Process File created C:\Windows\SysWOW64\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\ 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\11-6-2024.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\SysWOW64\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\SysWOW64\mscomctl.ocx 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\ 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\ Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\mscomctl.ocx 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\Fonts\The Kazekage.jpg 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File created C:\Windows\system\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File created C:\Windows\WBEM\msvbvm60.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\system\mscoree.dll 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Size = "72" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop system32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe - Runs ping.exe 1 TTPs 32 IoCs
pid Process 4248 ping.exe 3784 ping.exe 2952 ping.exe 3504 ping.exe 1148 ping.exe 4840 ping.exe 3128 ping.exe 2104 ping.exe 3364 ping.exe 1552 ping.exe 4980 ping.exe 1832 ping.exe 2040 ping.exe 1304 ping.exe 3076 ping.exe 3816 ping.exe 2568 ping.exe 2348 ping.exe 376 ping.exe 4556 ping.exe 4412 ping.exe 1708 ping.exe 3836 ping.exe 1052 ping.exe 3860 ping.exe 728 ping.exe 2444 ping.exe 3516 ping.exe 4592 ping.exe 2004 ping.exe 3052 ping.exe 1524 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 700 smss.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 4524 Gaara.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe 5060 csrss.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 1032 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe 700 smss.exe 2336 smss.exe 4524 Gaara.exe 3184 smss.exe 2400 Gaara.exe 5060 csrss.exe 2364 smss.exe 4908 Gaara.exe 8 csrss.exe 4768 Kazekage.exe 452 smss.exe 3484 Gaara.exe 5044 csrss.exe 3512 Kazekage.exe 628 system32.exe 2868 smss.exe 1644 Gaara.exe 4060 csrss.exe 948 Kazekage.exe 3212 system32.exe 5100 system32.exe 3168 Kazekage.exe 4208 system32.exe 3424 csrss.exe 3720 Kazekage.exe 2292 system32.exe 5004 Gaara.exe 4596 csrss.exe 400 Kazekage.exe 1408 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 700 1032 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe 81 PID 1032 wrote to memory of 700 1032 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe 81 PID 1032 wrote to memory of 700 1032 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe 81 PID 700 wrote to memory of 2336 700 smss.exe 82 PID 700 wrote to memory of 2336 700 smss.exe 82 PID 700 wrote to memory of 2336 700 smss.exe 82 PID 700 wrote to memory of 4524 700 smss.exe 83 PID 700 wrote to memory of 4524 700 smss.exe 83 PID 700 wrote to memory of 4524 700 smss.exe 83 PID 4524 wrote to memory of 3184 4524 Gaara.exe 84 PID 4524 wrote to memory of 3184 4524 Gaara.exe 84 PID 4524 wrote to memory of 3184 4524 Gaara.exe 84 PID 4524 wrote to memory of 2400 4524 Gaara.exe 85 PID 4524 wrote to memory of 2400 4524 Gaara.exe 85 PID 4524 wrote to memory of 2400 4524 Gaara.exe 85 PID 4524 wrote to memory of 5060 4524 Gaara.exe 86 PID 4524 wrote to memory of 5060 4524 Gaara.exe 86 PID 4524 wrote to memory of 5060 4524 Gaara.exe 86 PID 5060 wrote to memory of 2364 5060 csrss.exe 87 PID 5060 wrote to memory of 2364 5060 csrss.exe 87 PID 5060 wrote to memory of 2364 5060 csrss.exe 87 PID 5060 wrote to memory of 4908 5060 csrss.exe 88 PID 5060 wrote to memory of 4908 5060 csrss.exe 88 PID 5060 wrote to memory of 4908 5060 csrss.exe 88 PID 5060 wrote to memory of 8 5060 csrss.exe 89 PID 5060 wrote to memory of 8 5060 csrss.exe 89 PID 5060 wrote to memory of 8 5060 csrss.exe 89 PID 5060 wrote to memory of 4768 5060 csrss.exe 90 PID 5060 wrote to memory of 4768 5060 csrss.exe 90 PID 5060 wrote to memory of 4768 5060 csrss.exe 90 PID 4768 wrote to memory of 452 4768 Kazekage.exe 91 PID 4768 wrote to memory of 452 4768 Kazekage.exe 91 PID 4768 wrote to memory of 452 4768 Kazekage.exe 91 PID 4768 wrote to memory of 3484 4768 Kazekage.exe 92 PID 4768 wrote to memory of 3484 4768 Kazekage.exe 92 PID 4768 wrote to memory of 3484 4768 Kazekage.exe 92 PID 4768 wrote to memory of 5044 4768 Kazekage.exe 93 PID 4768 wrote to memory of 5044 4768 Kazekage.exe 93 PID 4768 wrote to memory of 5044 4768 Kazekage.exe 93 PID 4768 wrote to memory of 3512 4768 Kazekage.exe 94 PID 4768 wrote to memory of 3512 4768 Kazekage.exe 94 PID 4768 wrote to memory of 3512 4768 Kazekage.exe 94 PID 4768 wrote to memory of 628 4768 Kazekage.exe 95 PID 4768 wrote to memory of 628 4768 Kazekage.exe 95 PID 4768 wrote to memory of 628 4768 Kazekage.exe 95 PID 628 wrote to memory of 2868 628 system32.exe 96 PID 628 wrote to memory of 2868 628 system32.exe 96 PID 628 wrote to memory of 2868 628 system32.exe 96 PID 628 wrote to memory of 1644 628 system32.exe 97 PID 628 wrote to memory of 1644 628 system32.exe 97 PID 628 wrote to memory of 1644 628 system32.exe 97 PID 628 wrote to memory of 4060 628 system32.exe 98 PID 628 wrote to memory of 4060 628 system32.exe 98 PID 628 wrote to memory of 4060 628 system32.exe 98 PID 628 wrote to memory of 948 628 system32.exe 99 PID 628 wrote to memory of 948 628 system32.exe 99 PID 628 wrote to memory of 948 628 system32.exe 99 PID 628 wrote to memory of 3212 628 system32.exe 100 PID 628 wrote to memory of 3212 628 system32.exe 100 PID 628 wrote to memory of 3212 628 system32.exe 100 PID 5060 wrote to memory of 5100 5060 csrss.exe 101 PID 5060 wrote to memory of 5100 5060 csrss.exe 101 PID 5060 wrote to memory of 5100 5060 csrss.exe 101 PID 4524 wrote to memory of 3168 4524 Gaara.exe 102 - System policy modification 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe"C:\Users\Admin\AppData\Local\Temp\9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1032 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:700 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4524 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3184
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2400
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5060 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2364
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4908
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4768 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:452
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3512
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3212
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3516
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1552
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:376
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:728
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2568
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1148
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2952
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:3076
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5100
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3052
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:2444
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1052
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1304
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3168
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4208
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:3364
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3504
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2348
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3836
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:3128
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2104
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3424
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4412
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4248
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1708
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4592
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4840
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1832
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5004
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4596
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:400
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:3816
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:4556
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2040
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:4980
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:3860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Gaara.exe
- Size 148KB
- SHA256 9d50365c02d24971487ff41de60c2f82af174b9767b47f5a82d297752c127226
- MD5 63ea11c2736083017e033b0b1229224e
- SHA1 13406b8147a1ecf8e533d44bd4a69e11dea914bd
- SHA512 b637097253e65eda6b00c74f2d08b0d3652add954597300d89c3860f126eeb6c574eac7c0e9fa4ba8a8991e418bb66b519f249bea0660859806f2c07ddd66d32
- SSDEEP 1536:FJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Dx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe
- Size 148KB
- SHA256 30492ebd06833118356f707567f6b925f50a7be1cf7038685d49e64dc1697b6e
- MD5 fe9923766219965aa093fcc9a8fe2ff8
- SHA1 ea0064dd79936fa4466a483772e092a90a1cdc0c
- SHA512 ebbe64714dd5a86f55d0d42e5a0c25a5cbff05a71a8b5b74eae93f52cb8d690efd6dfcda98571d4cbe575a6daac5e5a36495f75ff1a711f80400771b7ee8d39f
- SSDEEP 1536:yJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:qx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 da71a1a11b3d533b735e0254a06e97a83627ac526370a2646e544c7ee52593ed
- MD5 bc0f24d355b1e5a54eface2fad60000a
- SHA1 d7f1d1af9b0df2f9ef63402e2ee6b0fd94d5b88e
- SHA512 a3ec5907f0d8d8c39cabc982c8b91c293eef7711fee8d1064d4a93ec77e7b9d031705406f958480cc92f5a6deb1be27f65b24254ecd4b28ecbaca59b8af13543
- SSDEEP 1536:pJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 23f40dc57e109243d0bd9e42f337e288fc557a175db28c22017cf7a14eac1e8a
- MD5 384077f800c243c3f2b8d77013ce22f7
- SHA1 341a12c8f1c30fad50064c4809a2192c0d1c3a2b
- SHA512 5faebdcce284edc3e8b42c8d8a57136d4ff9badd2f39823719c212923430170034529aff7a8ce2be8ac223fcb465a4e33b8723c785a2e8a1470942e865f5d3d8
- SSDEEP 1536:tJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe
- Size 148KB
- SHA256 b4beb1018317f651577cd736cfb3edeb102ad25fbc1faaf90745adde9731442c
- MD5 3cc3345d0e0fa624b567848bd0c4bda6
- SHA1 9bf63f880feb91f87d59a60f153f346878dbe8f5
- SHA512 25d9e378925b60140d9284f6a3ea4a50120f50d97c0a64607c4565d956e7b5610d5d0e6e3bb2bef809d326120c3be7ceb9f65a32798fa314a09bc5f7b8c2e037
- SSDEEP 1536:zJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:dx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 64KB
- SHA256 2f1e8342eb4b9a7a44c95bb730fafd4edafb36eeb8b81a2201ef509ab5d0ee2b
- MD5 39f79bb9bde0ce5a8e10f200d947be82
- SHA1 ca9c386f064ca1ed15b1dd68c51f0ecfd6342e6d
- SHA512 d69b3f8a4f11ad9c5ddcb5633195cccc5c9f303531e0ec97ca7c78b47bf2413e00b2f4e72f49b9265e828d4d5d3582573b169876148b5af72f6cfd6783e3e7f8
- SSDEEP 6:BSlSf4UUUUUUUUUUUUUUUUUUUUUUUUUUN:wcO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 203bf9dbba89a24b45dd5b0b5a5e9dc0a171c2c6e730c51abeca7adeec781ef7
- MD5 d4b922a407773c1357002481649cb0a8
- SHA1 66392e09eeb61c7d25ecfce205bab3e37f71314c
- SHA512 91dfad3ed35c8fc182beb8e815cf6b2b447c82e8ba711b15418d77a148ed58ce4455baea625a450bf259fe65d9d893ff8edb76823d99d3058a95d12dca1cf778
- SSDEEP 1536:oJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Mx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 35e979922ea1582798089dbdc6a5bab9fc132246bfd6bf69e790e9db820504b7
- MD5 d158978eaeb032193222aec8b583cf51
- SHA1 3edf94f423157d4a1621afe04d06485472b17992
- SHA512 615741009c83f3d3a434b233f2f1f1b222b39fd9295e97db481cbd4ddd69684974538a5a4f661e861ba8ac1fc7153d9cde5e84d9693604e6ede1c7bdb600cd8b
- SSDEEP 1536:ZJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Px6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 80e31d61778091afe36c492920df5c4d122fa38146dc7f5df3223567d8aaf0cd
- MD5 437406e37e4640a999768dd1f1bbdf5b
- SHA1 befbc6822fe1760b5311cf00e4afe7669b2d004f
- SHA512 3942fb80a6344737f8128ec13b4a08cc22ddf29ddc2ab1c680d574da41d2557ec3ae5f3a1a9b50f492e65523cb8de69444a0fe2e9d1b0dc9a3c6a696c03ec14d
- SSDEEP 1536:XJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:5x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 a8908e99215d5ff0afe9b88cccaba943cc5e4e3b887352bc7468da9e3e446a06
- MD5 07d01bac4ffa26776f38d99c6f85753a
- SHA1 609d694054d1f69121f04a9b1aa45708d98e98b0
- SHA512 3a86f932f869a4d2baa80376c9adb661cc41340f6b901ef44652338041e721b6c2616fb79dc836103930c925096aa325f9b70450126625fb4466476a51877c46
- SSDEEP 1536:XJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:5x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 3f3fcadacc281f70fdc06f0dfe0de35359d6bbd0ca2576350f446d5c4d97c703
- MD5 1819498a25f6209cef9b9ddb3918ccae
- SHA1 b77e29496f46f0298fd04d10920441b0b2192412
- SHA512 4a5ca27975435cf88a6d36d318466712b4d7f3c9098c9459ee0ffd620dbc20cfaa14822e7dcef09ffc11870039a7ee58274f1a3c5b971bfec04ac8b19d9edcbc
- SSDEEP 1536:gJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:0x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 bdbaf1c70b305fcba455f5b230ba71f20fc04494c6ae2afee0de9b4face728b3
- MD5 c414685f0e36b618b8b4205a4a2af7c8
- SHA1 c827c2d17802b3c72375dfda8c4f292f31a6d0b9
- SHA512 6e90455c96d1adfb8507e7921862a36a1ef402af8249ca8e588bdb40503971712e9e13be3ae81a48b2ae0a095926e4b51bf94503466d4a4f54b2653e24f310de
- SSDEEP 1536:PJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:hx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 a6321ba729fb2a206116f4d181e052f166da2c4fcd4dc65d7124cadbc1ee7d39
- MD5 5e331cbcfa3b477785222605dc8bd95c
- SHA1 6115e7172c1a11802b2397a96e6734527f092773
- SHA512 9a757d28223a5b54bfddde93497bb19e92e50cdcf92237667f2ae90eefb097878d8570e9655dad483ef6367714f7678f08bf9e420ab59791bb3215160d090712
- SSDEEP 1536:vJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 25ae377be5d51dd18721faeefe06ee5b4bff4e49e16b3305dc1dbe691c15b440
- MD5 c8c5d51758c10f02ce883871d3633044
- SHA1 f38ff5d76548593dd360d3ac74841c017aabb1d1
- SHA512 2d0bf447512c0b1901e345c61a843d6bbf74a9bdcef0c40952f030cf31a2934ecec88b0e2848460e3a204fdcadbe2d0cfcd25bdda2e548274531b3b9658e596f
- SSDEEP 1536:kJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:wx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 caf31f8d29e87e9880b14e984f5a58c70c537d5f43a407a48af325f5f2bcc174
- MD5 fb6a0d8e9265180db1b9b4900c65d019
- SHA1 d559fbd2139af7cf29d249592fc4f10f3bfecc93
- SHA512 d6a7bc5523c423167f9ebddd10bfa764e954a221898b509287a6e590b965b26326ff22e75d4f524aa5fd6e691c588ec2f92e08889f4bab2bd4fa0bba9fa7c9b6
- SSDEEP 1536:xJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:3x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 9c5efd54724554ee5d61cc05f9f7ad99cdb19c5f93659d97d4dd6a206ebafc1e
- MD5 147ff40775e23ed38733f01eb8c4db8a
- SHA1 76ddfb339f4922242d6cafd7964fa7407ccc192b
- SHA512 906a60e5ab8707911e19e331c742ddbd89f2cb6798522537ad1e6c30aa8a6521421023660808dbc9174c4101f539456190aec42b8bc470d8292960dbe36d59c4
- SSDEEP 1536:TJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:9x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 b15edf3bbb81ff0d382d5db01185d315204cf3c16ab491cb09bf030a468fe1c9
- MD5 5b6a3270c6d25fc541d4e43ee004fd0f
- SHA1 c370022b61b51bbfbc3943fe4d691f609c6353c3
- SHA512 ed070620d77c4eb51e65764fce72f098bf89e4cc309e02473bff6cda29f17bd221dd2c095f26a9387cd61479fb5b91e9afcd254f0548d9d968ae7d4052c97588
- SSDEEP 1536:DJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:tx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mscomctl.ocx
- Size 148KB
- SHA256 09b32472497649321a0535557e6c0e32b506834c0a5ffe7d533e8e651f70f816
- MD5 0e4b7f3c1e4f6a3dd82496e573f4a522
- SHA1 c230efcdc7bffa9c2ca9dda7919dee6fc4443266
- SHA512 ed38ffe50bd62f6b6b21ba46b9db1f723f0546fb64e5ec87e13e7edf36fd710f2499483d6a37a0d90c2aef7504a3637d45314633d0417e77789f52229beff6c0
- SSDEEP 1536:/Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Rx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP