Analysis
- max time kernel
149s - max time network
131s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
11/06/2024, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
Resource
win7-20240508-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
- Size 148KB
- Sample240611-enppcatdqa
- SHA256 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836
- MD5 5d634c6bfa5ab137cfbff4e3ba5efe8c
- SHA1 7a4f4f67babcd29079c8439d7c8f022891a492e7
- SHA512 ca99d3c954fa57e37112b0484635de99853000cdd9d48d56a36f1699d30faaf7617cf88ec40cf1a4a5168e4e123efc0825a2c673352e583198ddef4dafde74fa
- SSDEEP 1536:UJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:gx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe - Executes dropped EXE 30 IoCs
pid Process 2692 smss.exe 2200 smss.exe 2536 Gaara.exe 2944 smss.exe 2204 Gaara.exe 1700 csrss.exe 1856 smss.exe 1200 Gaara.exe 844 csrss.exe 2276 Kazekage.exe 2884 smss.exe 1948 Gaara.exe 564 csrss.exe 1604 Kazekage.exe 1900 system32.exe 1136 smss.exe 1676 Gaara.exe 2472 csrss.exe 1412 Kazekage.exe 348 system32.exe 1000 system32.exe 808 Kazekage.exe 548 system32.exe 340 csrss.exe 2120 Kazekage.exe 3004 system32.exe 2836 Gaara.exe 2364 csrss.exe 984 Kazekage.exe 876 system32.exe - Loads dropped DLL 64 IoCs
pid Process 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 2692 smss.exe 2692 smss.exe 2200 smss.exe 2692 smss.exe 2692 smss.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2944 smss.exe 2536 Gaara.exe 2204 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1856 smss.exe 1700 csrss.exe 1700 csrss.exe 1200 Gaara.exe 844 csrss.exe 1700 csrss.exe 1700 csrss.exe 2276 Kazekage.exe 2884 smss.exe 2276 Kazekage.exe 1948 Gaara.exe 2276 Kazekage.exe 564 csrss.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 1900 system32.exe 1136 smss.exe 1900 system32.exe 1676 Gaara.exe 1900 system32.exe 2472 csrss.exe 1900 system32.exe 1900 system32.exe 1900 system32.exe 1900 system32.exe 1700 csrss.exe 1700 csrss.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2692 smss.exe 340 csrss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 2836 Gaara.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 2364 csrss.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification \??\P:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\W:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification \??\W:\Desktop.ini smss.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\W:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\X:\Desktop.ini smss.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\G:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\T:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini Gaara.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: smss.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\S: system32.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\S: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\B: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\I: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\U: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\Y: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\A: system32.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\T: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\Z: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\J: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\M: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\L: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\P: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\U: system32.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\T:\Autorun.inf Gaara.exe File created \??\A:\Autorun.inf system32.exe File opened for modification \??\Y:\Autorun.inf system32.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File created \??\V:\Autorun.inf system32.exe File created \??\Y:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\H:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf system32.exe File opened for modification \??\N:\Autorun.inf system32.exe File opened for modification \??\K:\Autorun.inf csrss.exe File created F:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\U:\Autorun.inf Gaara.exe File created \??\G:\Autorun.inf Kazekage.exe File created \??\Z:\Autorun.inf Kazekage.exe File opened for modification F:\Autorun.inf csrss.exe File opened for modification \??\B:\Autorun.inf csrss.exe File created \??\E:\Autorun.inf csrss.exe File created \??\W:\Autorun.inf csrss.exe File opened for modification \??\Z:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\W:\Autorun.inf smss.exe File created \??\V:\Autorun.inf Gaara.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf Kazekage.exe File opened for modification \??\H:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\K:\Autorun.inf smss.exe File opened for modification \??\Q:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf Kazekage.exe File created \??\Y:\Autorun.inf Kazekage.exe File created \??\A:\Autorun.inf smss.exe File created \??\K:\Autorun.inf Kazekage.exe File opened for modification \??\H:\Autorun.inf system32.exe File opened for modification \??\M:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\T:\Autorun.inf smss.exe File created \??\B:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File created \??\O:\Autorun.inf system32.exe File opened for modification \??\R:\Autorun.inf csrss.exe File opened for modification \??\V:\Autorun.inf csrss.exe File opened for modification \??\P:\Autorun.inf Gaara.exe File opened for modification F:\Autorun.inf Kazekage.exe File created \??\R:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\H:\Autorun.inf smss.exe File created \??\S:\Autorun.inf smss.exe File opened for modification \??\B:\Autorun.inf Gaara.exe File created \??\N:\Autorun.inf Gaara.exe File created \??\K:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\U:\Autorun.inf smss.exe File created \??\V:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf csrss.exe File opened for modification \??\E:\Autorun.inf csrss.exe File created \??\H:\Autorun.inf csrss.exe File created \??\A:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\Z:\Autorun.inf smss.exe File opened for modification \??\M:\Autorun.inf Gaara.exe File created \??\G:\Autorun.inf system32.exe File opened for modification \??\K:\Autorun.inf system32.exe File created D:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\H:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\B:\Autorun.inf Kazekage.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File created C:\Windows\SysWOW64\11-6-2024.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\SysWOW64\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\ de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\system\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File created C:\Windows\Fonts\The Kazekage.jpg de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\ de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\system\mscoree.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\system\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\WBEM\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\WallpaperStyle = "2" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop smss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop csrss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop system32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Speed = "4" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe - Runs ping.exe 1 TTPs 30 IoCs
pid Process 2748 ping.exe 2488 ping.exe 1512 ping.exe 1664 ping.exe 480 ping.exe 344 ping.exe 532 ping.exe 872 ping.exe 2112 ping.exe 2768 ping.exe 2520 ping.exe 3068 ping.exe 1736 ping.exe 1880 ping.exe 284 ping.exe 2856 ping.exe 2632 ping.exe 2544 ping.exe 2648 ping.exe 1984 ping.exe 2504 ping.exe 856 ping.exe 572 ping.exe 1588 ping.exe 1308 ping.exe 1536 ping.exe 1912 ping.exe 2472 ping.exe 2624 ping.exe 3008 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2692 smss.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 2536 Gaara.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 1700 csrss.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 2276 Kazekage.exe 1900 system32.exe 1900 system32.exe 1900 system32.exe 1900 system32.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 2692 smss.exe 2200 smss.exe 2536 Gaara.exe 2944 smss.exe 2204 Gaara.exe 1700 csrss.exe 1856 smss.exe 1200 Gaara.exe 844 csrss.exe 2276 Kazekage.exe 2884 smss.exe 1948 Gaara.exe 564 csrss.exe 1604 Kazekage.exe 1900 system32.exe 1136 smss.exe 1676 Gaara.exe 2472 csrss.exe 1412 Kazekage.exe 348 system32.exe 1000 system32.exe 808 Kazekage.exe 548 system32.exe 340 csrss.exe 2120 Kazekage.exe 3004 system32.exe 2836 Gaara.exe 2364 csrss.exe 984 Kazekage.exe 876 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2692 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 28 PID 1644 wrote to memory of 2692 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 28 PID 1644 wrote to memory of 2692 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 28 PID 1644 wrote to memory of 2692 1644 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 28 PID 2692 wrote to memory of 2200 2692 smss.exe 29 PID 2692 wrote to memory of 2200 2692 smss.exe 29 PID 2692 wrote to memory of 2200 2692 smss.exe 29 PID 2692 wrote to memory of 2200 2692 smss.exe 29 PID 2692 wrote to memory of 2536 2692 smss.exe 30 PID 2692 wrote to memory of 2536 2692 smss.exe 30 PID 2692 wrote to memory of 2536 2692 smss.exe 30 PID 2692 wrote to memory of 2536 2692 smss.exe 30 PID 2536 wrote to memory of 2944 2536 Gaara.exe 31 PID 2536 wrote to memory of 2944 2536 Gaara.exe 31 PID 2536 wrote to memory of 2944 2536 Gaara.exe 31 PID 2536 wrote to memory of 2944 2536 Gaara.exe 31 PID 2536 wrote to memory of 2204 2536 Gaara.exe 32 PID 2536 wrote to memory of 2204 2536 Gaara.exe 32 PID 2536 wrote to memory of 2204 2536 Gaara.exe 32 PID 2536 wrote to memory of 2204 2536 Gaara.exe 32 PID 2536 wrote to memory of 1700 2536 Gaara.exe 33 PID 2536 wrote to memory of 1700 2536 Gaara.exe 33 PID 2536 wrote to memory of 1700 2536 Gaara.exe 33 PID 2536 wrote to memory of 1700 2536 Gaara.exe 33 PID 1700 wrote to memory of 1856 1700 csrss.exe 34 PID 1700 wrote to memory of 1856 1700 csrss.exe 34 PID 1700 wrote to memory of 1856 1700 csrss.exe 34 PID 1700 wrote to memory of 1856 1700 csrss.exe 34 PID 1700 wrote to memory of 1200 1700 csrss.exe 35 PID 1700 wrote to memory of 1200 1700 csrss.exe 35 PID 1700 wrote to memory of 1200 1700 csrss.exe 35 PID 1700 wrote to memory of 1200 1700 csrss.exe 35 PID 1700 wrote to memory of 844 1700 csrss.exe 36 PID 1700 wrote to memory of 844 1700 csrss.exe 36 PID 1700 wrote to memory of 844 1700 csrss.exe 36 PID 1700 wrote to memory of 844 1700 csrss.exe 36 PID 1700 wrote to memory of 2276 1700 csrss.exe 37 PID 1700 wrote to memory of 2276 1700 csrss.exe 37 PID 1700 wrote to memory of 2276 1700 csrss.exe 37 PID 1700 wrote to memory of 2276 1700 csrss.exe 37 PID 2276 wrote to memory of 2884 2276 Kazekage.exe 38 PID 2276 wrote to memory of 2884 2276 Kazekage.exe 38 PID 2276 wrote to memory of 2884 2276 Kazekage.exe 38 PID 2276 wrote to memory of 2884 2276 Kazekage.exe 38 PID 2276 wrote to memory of 1948 2276 Kazekage.exe 39 PID 2276 wrote to memory of 1948 2276 Kazekage.exe 39 PID 2276 wrote to memory of 1948 2276 Kazekage.exe 39 PID 2276 wrote to memory of 1948 2276 Kazekage.exe 39 PID 2276 wrote to memory of 564 2276 Kazekage.exe 40 PID 2276 wrote to memory of 564 2276 Kazekage.exe 40 PID 2276 wrote to memory of 564 2276 Kazekage.exe 40 PID 2276 wrote to memory of 564 2276 Kazekage.exe 40 PID 2276 wrote to memory of 1604 2276 Kazekage.exe 41 PID 2276 wrote to memory of 1604 2276 Kazekage.exe 41 PID 2276 wrote to memory of 1604 2276 Kazekage.exe 41 PID 2276 wrote to memory of 1604 2276 Kazekage.exe 41 PID 2276 wrote to memory of 1900 2276 Kazekage.exe 42 PID 2276 wrote to memory of 1900 2276 Kazekage.exe 42 PID 2276 wrote to memory of 1900 2276 Kazekage.exe 42 PID 2276 wrote to memory of 1900 2276 Kazekage.exe 42 PID 1900 wrote to memory of 1136 1900 system32.exe 43 PID 1900 wrote to memory of 1136 1900 system32.exe 43 PID 1900 wrote to memory of 1136 1900 system32.exe 43 PID 1900 wrote to memory of 1136 1900 system32.exe 43 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe"C:\Users\Admin\AppData\Local\Temp\de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1644 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2692 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2536 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2944
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1700 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1200
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2276 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:564
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1676
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:348
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:2472
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1536
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3068
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1984
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:344
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2504
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1512
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1912
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:872
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1736
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:284
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2768
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:1880
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:480
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:808
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1588
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1308
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:532
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:856
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:340
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2520
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2488
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2544
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2624
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:572
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1664
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2364
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:876
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2856
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2748
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2632
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2648
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:3008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe
- Size 148KB
- SHA256 767112a4fcea1a67bc7ab03efaad0634951b4e40d4564c9f6c5a5709bf6549db
- MD5 eb19d65750d72f17aa6cf583149c408e
- SHA1 67ce8b7f5c78b1e96db7ba96a37b8f5a540fa5f2
- SHA512 8db61c87835f54c34eaf1a78dedc581a170a2f89af2c1c7b603fa48887531d7382391b4d999d3f904da60686b87bd51d2001d482509c88a6a6a34e30c18a8c96
- SSDEEP 1536:QJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:kx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836
- MD5 5d634c6bfa5ab137cfbff4e3ba5efe8c
- SHA1 7a4f4f67babcd29079c8439d7c8f022891a492e7
- SHA512 ca99d3c954fa57e37112b0484635de99853000cdd9d48d56a36f1699d30faaf7617cf88ec40cf1a4a5168e4e123efc0825a2c673352e583198ddef4dafde74fa
- SSDEEP 1536:UJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:gx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 245afbb08c2ca645c861ff5a6fa9de905404f4549dce32fe6e03acaeae26b0c9
- MD5 d9ddc8895d8b170c724df26664b8c5e8
- SHA1 1d2ac4df2b2263f4edef98a8775265b7e3d70c85
- SHA512 c8237768b0467041a47aabc5003967ac899e67cab928eddec28abb10abd6dce42b16dc149e1702bf6cf7b9d367a89214d20a50516191cff993c25e17d00de08b
- SSDEEP 1536:nJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Jx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 6768e7950efe9e368f22cdcc218c69402cb4dc293348d10b6de24e95159208ba
- MD5 67c7e2c52b5c1bf1734a5a79fa3a2ad8
- SHA1 bde39e1363e87bc8b1fbe4ed723d54e049d0f8e8
- SHA512 13814cac9f9359c9a4809e95f4cf1dae31f535adecbc8fd330cb5c131e0aae25562f9f3be3a37bb47c7ee02e6349783f33258f509f07010d0d8a7dc225aa23c1
- SSDEEP 1536:JJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:/x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 129734b019fa91419e25aeada96f31e50687b7461bd8bf7e7f593fe34ac6f925
- MD5 48f5aeb9d67d6b9dbb59620b6cfe9dce
- SHA1 eb2944384aefa5a95c522b1ae4f39c8b04c78f47
- SHA512 9f7aefdedb74327f1326226f53ff0f1ff615e64fc2f2b8cc6e6eb2b7a18bd55dde277b5970ab95455592eef643cd850f75b5bb1fae5019bd15060e0f8d41e5cc
- SSDEEP 1536:rJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 18009981e661424d86ae3291a94ecb6692aefa03ec3a493a9e142230d6e80b4f
- MD5 51618b39194375ad8144a658a94e4a16
- SHA1 49fc70a27d4fbe4b6badfe51451f98279597a0ec
- SHA512 cb57e84ba380dbd6b8525b311e3dc1e643a9c4813320984038268969065021f002e1efa90998297e314013b80484c88666b7a9aaf3c0496ac2ce676f2e33f25b
- SSDEEP 1536:zJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:dx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 dc572589a155d679b97ad270288b5b8451a00e6d66fa25947eef8dee90ac062f
- MD5 35f928dc24ec8a18cbf4dafec8fa210d
- SHA1 4bc576df8e2bd1525a01b70fe59145c075309890
- SHA512 6ee49ab1cb5fb7d2c033e0553931fa208458efb61c9f631a0ead938f19dbd21ac14e40c2b09cfb81cb01018d4e92f5ab01000d6b7463484512a23f60d7acc86e
- SSDEEP 1536:dJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Lx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 ed65c6576bf67323d1f713b691a4451bf95c7a69c4c7aa99b2c8c81009b621e0
- MD5 8a5116f7435b61054a476994fdd29816
- SHA1 03f09ec30658cb4e220e549fc5df64c63f89fa99
- SHA512 4f023f66d9c92134aa3d392b1fbbdc177f543db3cb1fb57dbd78e668a46221329684bd0c0e50f58e26aefd4e58546c55d629043b28ad821cff894db118631cad
- SSDEEP 1536:sJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Ix6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\MSCOMCTL.OCX
- Size 148KB
- SHA256 00881a19f390cfa85ba2d4c9b23479f3785babf326eb9d17ae5825a97a0f2e0c
- MD5 9d753e97a8fd2f20efe13d48edcd43e7
- SHA1 9d377c9f8357137a950c8a305fa025c90c5a8ce8
- SHA512 24fbe1b7177ff7a70cbc96f34920e8241247d7ccd3ea51a1fdd3c85e790040b4251004a3f8bd29545c60a0ad64548e13cba0b423b65b0addf2f16e23df4e24c2
- SSDEEP 1536:PJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:hx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 499e035b76b1f01c6334f5d3ab7bcaf7036657dfa53fb0ee9cfa0f72c52a47d1
- MD5 5502c8a8b76d7bb8d93fe0cfffd1a174
- SHA1 8d276455fe50389be1e52a348622edc67eee6c28
- SHA512 7a0e560207df9985a1ca4a67c53b0ebbf5a5929c55d70a3aa2dfc338d646bfd93361069a16821bbe6efa847fcd07133e159d5f4aab9bda1ce295a02d0b38482d
- SSDEEP 1536:vJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 2dbe21e1ac62e6bbc990abd55ae07ef278fb699f46d25cce2ba72be6e8178019
- MD5 5f357cdfbf96dd2d6317b379262490a6
- SHA1 139cb364d0980310f09c4d399d4d3ada9ae9bd5c
- SHA512 a23a40e92ef59a631b5f79ec66d33e9be37bfecb5a4b60b4093a91107d1270fbd8ac0984dc994e440473ab418bfa080d9c3775211717d0d3c247d93415b563bb
- SSDEEP 1536:vJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 c8b42f4e6e198e0782637141d71de7dc46666dcc1743b56a4e685e823d686d6b
- MD5 8c2a255b86e213bc1c3af5e3349b7c5b
- SHA1 2f1807d103711f245f194bb60c5f9e43b916769d
- SHA512 baf8310694717cd13f494c8864bea9d955192ca7ed2a710656c470fbe164c039cb6add6525424bb760b567265a209ab8f4818d60224a6cc702b4893285666afd
- SSDEEP 1536:1Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:zx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 07359f16d241f0ac856949348eed5b325c21d0e68d6de891f06fc8f04f9cf8f8
- MD5 d3903cb72a180cf11530818b4131be91
- SHA1 2a21d96de6a0a0082ef2cb9e1203659a9d487328
- SHA512 1f84ebde2b833dab9144cf3f1a6f0b6998daef5d7e48ce5f4e24ea1e934a18283762dba0c26b05f4acaff25812ef02b155b29b927387d5b2a27f167e05f51dc1
- SSDEEP 1536:jJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Nx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 7a0d0d3d574f47badcb0f5d4b36ef69b5cea68b1f18f66266744b7d2f4398a7f
- MD5 47b40f9b76ba1ad9f60b7c8fc4cf7ecc
- SHA1 bd8d57dbc94d25aa18f95f4927e3b2ae9948c98b
- SHA512 2634bba5b1b28bf979fa22c9398458fb24cee5d30dd0574d3ebd76a5baa689a30c36e9910cff36775db8ff56417ee7a7bfd6c0b2eaf67868b57926c56137e4b0
- SSDEEP 1536:jJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Nx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 c063cee175b0ca4a67fd1207cbbe33cc5683786275d746d6286970b4f03131f2
- MD5 dc6a2e51cd3b47110db057cc0c64a4e5
- SHA1 1733b9fed8db3bca841a57cf06c3d7ded7eaf735
- SHA512 40de07a1f89411cba0512fcfa87b17c821219dd8883101535f2deca2a8b9fc9e8fc229791b73a0ce60bc5b52b0ce4a299027bd66a2e0ce547a665b406d083c89
- SSDEEP 1536:rJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 c860fde9d7cae8ecfa8fe942f4172959090b41838aa595bd19a5a53d3a2d9834
- MD5 3103758624fadfcaba79c5ea32d69af4
- SHA1 145cdfa2c010db3ddf71ac9d82cc59e1e394dd0b
- SHA512 3bc482cbd0abf068adfcdba89340f04d7185dad1fe5bfa11c21609187dad8a6649fa5cd622ba40771b317a9ac5121a4fd082c85f92f097deff4e1322ab517883
- SSDEEP 1536:pJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\msvbvm60.dll
- Size 1.3MB
- SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
- MD5 5343a19c618bc515ceb1695586c6c137
- SHA1 4dedae8cbde066f31c8e6b52c0baa3f8b1117742
- SHA512 708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
- SSDEEP 24576:LlDYRayxYMsEVcQtFyBw2fO+wgw7HsltDngDG+QryQF63xxWPByACxlQ6kMX1Kse:BOayxtXyrgs3DngDyyQFwxxWPcxlQ3cf
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Fonts\Admin 11 - 6 - 2024\smss.exe
- Size 148KB
- SHA256 7698fc2bdac42d97c0728dc63ba9ef9db2958a0aedc692bb5872b62d124d59f4
- MD5 2027ba66ab3ae588e7f1faeb5e676a00
- SHA1 c73037b0e4d6de05fb9516bd2f62417149410f2d
- SHA512 c5cabb05fe19bfb22bb9f8d070ecc365d68f40af38c2a0334157ea4aa3ad44f923c4bec91ebe84ee8743febd9349024672d79e259c5e3d612e17f1a5c0845fd7
- SSDEEP 1536:IJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:sx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP