Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
Resource
win7-20240508-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe
- Size 148KB
- Sample240611-enppcatdqa
- SHA256 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836
- MD5 5d634c6bfa5ab137cfbff4e3ba5efe8c
- SHA1 7a4f4f67babcd29079c8439d7c8f022891a492e7
- SHA512 ca99d3c954fa57e37112b0484635de99853000cdd9d48d56a36f1699d30faaf7617cf88ec40cf1a4a5168e4e123efc0825a2c673352e583198ddef4dafde74fa
- SSDEEP 1536:UJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:gx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Gaara.exe - Executes dropped EXE 30 IoCs
pid Process 212 smss.exe 1772 smss.exe 2800 Gaara.exe 4404 smss.exe 2940 Gaara.exe 620 csrss.exe 4872 smss.exe 1584 Gaara.exe 1576 csrss.exe 1444 Kazekage.exe 872 smss.exe 512 Gaara.exe 3564 csrss.exe 4676 Kazekage.exe 4956 system32.exe 1648 smss.exe 1720 Gaara.exe 3000 csrss.exe 4660 Kazekage.exe 1896 system32.exe 4684 system32.exe 3704 Kazekage.exe 3228 system32.exe 1244 csrss.exe 3904 Kazekage.exe 4468 system32.exe 4084 Gaara.exe 1936 csrss.exe 2004 Kazekage.exe 4920 system32.exe - Loads dropped DLL 18 IoCs
pid Process 212 smss.exe 1772 smss.exe 2800 Gaara.exe 4404 smss.exe 2940 Gaara.exe 620 csrss.exe 4872 smss.exe 1584 Gaara.exe 1576 csrss.exe 872 smss.exe 512 Gaara.exe 3564 csrss.exe 1648 smss.exe 1720 Gaara.exe 3000 csrss.exe 1244 csrss.exe 4084 Gaara.exe 1936 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 11 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "11-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 11 - 6 - 2024\\Gaara.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\G:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification D:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini system32.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\Z:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\M:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\Q:\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini Kazekage.exe File opened for modification F:\Desktop.ini system32.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\O: Gaara.exe File opened (read-only) \??\E: system32.exe File opened (read-only) \??\B: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\X: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\Q: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\J: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\A: system32.exe File opened (read-only) \??\V: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\Z: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\K: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\M: Gaara.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\H: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\A: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\U: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\E: de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\O:\Autorun.inf Kazekage.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf system32.exe File created \??\J:\Autorun.inf smss.exe File created \??\O:\Autorun.inf Gaara.exe File created \??\T:\Autorun.inf Gaara.exe File created \??\X:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf csrss.exe File created \??\A:\Autorun.inf smss.exe File created \??\V:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf csrss.exe File created \??\Z:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\K:\Autorun.inf smss.exe File created \??\A:\Autorun.inf Gaara.exe File opened for modification \??\S:\Autorun.inf csrss.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File opened for modification \??\R:\Autorun.inf smss.exe File created \??\E:\Autorun.inf Gaara.exe File opened for modification \??\W:\Autorun.inf Gaara.exe File opened for modification \??\N:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\H:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf Gaara.exe File created \??\W:\Autorun.inf Kazekage.exe File opened for modification \??\H:\Autorun.inf system32.exe File opened for modification D:\Autorun.inf Gaara.exe File opened for modification C:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf system32.exe File created \??\P:\Autorun.inf Kazekage.exe File created \??\V:\Autorun.inf Kazekage.exe File created \??\L:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\O:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\T:\Autorun.inf smss.exe File created \??\P:\Autorun.inf Gaara.exe File created \??\L:\Autorun.inf csrss.exe File opened for modification \??\L:\Autorun.inf smss.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File created \??\R:\Autorun.inf smss.exe File opened for modification \??\M:\Autorun.inf Kazekage.exe File opened for modification \??\X:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\T:\Autorun.inf smss.exe File created \??\U:\Autorun.inf Kazekage.exe File created \??\O:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\S:\Autorun.inf smss.exe File created \??\I:\Autorun.inf Gaara.exe File created \??\G:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\G:\Autorun.inf Gaara.exe File created \??\Q:\Autorun.inf Kazekage.exe File opened for modification F:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\K:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf system32.exe File created \??\L:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File opened for modification \??\K:\Autorun.inf system32.exe File opened for modification C:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created \??\I:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Autorun.inf smss.exe File created \??\I:\Autorun.inf smss.exe File created \??\M:\Autorun.inf smss.exe File created \??\O:\Autorun.inf de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification \??\K:\Autorun.inf smss.exe File opened for modification \??\N:\Autorun.inf smss.exe File created \??\B:\Autorun.inf csrss.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe Gaara.exe File created C:\Windows\SysWOW64\Desktop.ini de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\11-6-2024.exe csrss.exe File created C:\Windows\SysWOW64\mscomctl.ocx de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\11-6-2024.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\ de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\ system32.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\mscoree.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe system32.exe File created C:\Windows\mscomctl.ocx de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\system\mscoree.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll system32.exe File created C:\Windows\system\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe system32.exe File opened for modification C:\Windows\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe system32.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe csrss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\ de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\msvbvm60.dll csrss.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File created C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe system32.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop csrss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "2" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee csrss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe - Runs ping.exe 1 TTPs 32 IoCs
pid Process 4776 ping.exe 908 ping.exe 5108 ping.exe 1720 ping.exe 1388 ping.exe 4036 ping.exe 1728 ping.exe 216 ping.exe 1324 ping.exe 4792 ping.exe 2448 ping.exe 1828 ping.exe 2012 ping.exe 5000 ping.exe 1760 ping.exe 5056 ping.exe 1644 ping.exe 3968 ping.exe 968 ping.exe 1396 ping.exe 4424 ping.exe 3904 ping.exe 2112 ping.exe 5000 ping.exe 3524 ping.exe 3120 ping.exe 2676 ping.exe 2608 ping.exe 2572 ping.exe 1004 ping.exe 2532 ping.exe 552 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 2800 Gaara.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 620 csrss.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe 1444 Kazekage.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2592 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 212 smss.exe 1772 smss.exe 2800 Gaara.exe 4404 smss.exe 2940 Gaara.exe 620 csrss.exe 4872 smss.exe 1584 Gaara.exe 1576 csrss.exe 1444 Kazekage.exe 872 smss.exe 512 Gaara.exe 3564 csrss.exe 4676 Kazekage.exe 4956 system32.exe 1648 smss.exe 1720 Gaara.exe 3000 csrss.exe 4660 Kazekage.exe 1896 system32.exe 4684 system32.exe 3704 Kazekage.exe 3228 system32.exe 1244 csrss.exe 3904 Kazekage.exe 4468 system32.exe 4084 Gaara.exe 1936 csrss.exe 2004 Kazekage.exe 4920 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 212 2592 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 82 PID 2592 wrote to memory of 212 2592 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 82 PID 2592 wrote to memory of 212 2592 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe 82 PID 212 wrote to memory of 1772 212 smss.exe 83 PID 212 wrote to memory of 1772 212 smss.exe 83 PID 212 wrote to memory of 1772 212 smss.exe 83 PID 212 wrote to memory of 2800 212 smss.exe 85 PID 212 wrote to memory of 2800 212 smss.exe 85 PID 212 wrote to memory of 2800 212 smss.exe 85 PID 2800 wrote to memory of 4404 2800 Gaara.exe 87 PID 2800 wrote to memory of 4404 2800 Gaara.exe 87 PID 2800 wrote to memory of 4404 2800 Gaara.exe 87 PID 2800 wrote to memory of 2940 2800 Gaara.exe 89 PID 2800 wrote to memory of 2940 2800 Gaara.exe 89 PID 2800 wrote to memory of 2940 2800 Gaara.exe 89 PID 2800 wrote to memory of 620 2800 Gaara.exe 90 PID 2800 wrote to memory of 620 2800 Gaara.exe 90 PID 2800 wrote to memory of 620 2800 Gaara.exe 90 PID 620 wrote to memory of 4872 620 csrss.exe 91 PID 620 wrote to memory of 4872 620 csrss.exe 91 PID 620 wrote to memory of 4872 620 csrss.exe 91 PID 620 wrote to memory of 1584 620 csrss.exe 92 PID 620 wrote to memory of 1584 620 csrss.exe 92 PID 620 wrote to memory of 1584 620 csrss.exe 92 PID 620 wrote to memory of 1576 620 csrss.exe 93 PID 620 wrote to memory of 1576 620 csrss.exe 93 PID 620 wrote to memory of 1576 620 csrss.exe 93 PID 620 wrote to memory of 1444 620 csrss.exe 94 PID 620 wrote to memory of 1444 620 csrss.exe 94 PID 620 wrote to memory of 1444 620 csrss.exe 94 PID 1444 wrote to memory of 872 1444 Kazekage.exe 95 PID 1444 wrote to memory of 872 1444 Kazekage.exe 95 PID 1444 wrote to memory of 872 1444 Kazekage.exe 95 PID 1444 wrote to memory of 512 1444 Kazekage.exe 96 PID 1444 wrote to memory of 512 1444 Kazekage.exe 96 PID 1444 wrote to memory of 512 1444 Kazekage.exe 96 PID 1444 wrote to memory of 3564 1444 Kazekage.exe 97 PID 1444 wrote to memory of 3564 1444 Kazekage.exe 97 PID 1444 wrote to memory of 3564 1444 Kazekage.exe 97 PID 1444 wrote to memory of 4676 1444 Kazekage.exe 98 PID 1444 wrote to memory of 4676 1444 Kazekage.exe 98 PID 1444 wrote to memory of 4676 1444 Kazekage.exe 98 PID 1444 wrote to memory of 4956 1444 Kazekage.exe 99 PID 1444 wrote to memory of 4956 1444 Kazekage.exe 99 PID 1444 wrote to memory of 4956 1444 Kazekage.exe 99 PID 4956 wrote to memory of 1648 4956 system32.exe 100 PID 4956 wrote to memory of 1648 4956 system32.exe 100 PID 4956 wrote to memory of 1648 4956 system32.exe 100 PID 4956 wrote to memory of 1720 4956 system32.exe 101 PID 4956 wrote to memory of 1720 4956 system32.exe 101 PID 4956 wrote to memory of 1720 4956 system32.exe 101 PID 4956 wrote to memory of 3000 4956 system32.exe 102 PID 4956 wrote to memory of 3000 4956 system32.exe 102 PID 4956 wrote to memory of 3000 4956 system32.exe 102 PID 4956 wrote to memory of 4660 4956 system32.exe 103 PID 4956 wrote to memory of 4660 4956 system32.exe 103 PID 4956 wrote to memory of 4660 4956 system32.exe 103 PID 4956 wrote to memory of 1896 4956 system32.exe 104 PID 4956 wrote to memory of 1896 4956 system32.exe 104 PID 4956 wrote to memory of 1896 4956 system32.exe 104 PID 620 wrote to memory of 4684 620 csrss.exe 105 PID 620 wrote to memory of 4684 620 csrss.exe 105 PID 620 wrote to memory of 4684 620 csrss.exe 105 PID 2800 wrote to memory of 3704 2800 Gaara.exe 106 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe"C:\Users\Admin\AppData\Local\Temp\de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2592 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:212 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2940
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:620 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4872
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1444 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:872
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:512
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3564
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4676
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4956 -
C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4660
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1396
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2676
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:5000
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:3968
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1760
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:5000
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:2112
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:5108
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:4424
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2532
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4684
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1644
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:216
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1324
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3704
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3228
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:968
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2448
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1388
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:1004
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2608
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3524
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1244
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4468
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3120
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4792
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1720
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:5056
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1728
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:3904
-
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4084
-
-
C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4776
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:908
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:2572
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:1828
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4036
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:552
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\Gaara.exe
- Size 148KB
- SHA256 6700f05d922bfbc863a7dc89a729bed886ac54d69d026ec61e33469e79a6f1bd
- MD5 8c5be81635bcac9d129f6b0f8f3efbfd
- SHA1 2d3a7f9bdb5d58dd038b5b20fe672f47a983d58e
- SHA512 87de852585ecc9fcb5ffcb7369db5fe94f2533aafaf50f005bf3027f8999dc8287d012d877a48845d46961aeca7880ce3e5bc5ebb43f13100c964ecd34702284
- SSDEEP 1536:yJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:qx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 2f85834508a8769f19034170793e2ae5c3345f101b4b61833d3a7411faca13bf
- MD5 c9c25a78cea782d3b350c1658fa0298f
- SHA1 64fc2fb6f67f7b7fe2c771091f9125cff7239e25
- SHA512 2d0f4ee4fc760f2a8d05ced26840f994461ba2c57bf42d29cb81a07ca58ad840a3a9c4898949f6b6ec65ad9df47c6429364bfa3947f04170f656a00f252ea5de
- SSDEEP 1536:dJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Lx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 927fc31ecade3d75ce117fcedb020e29d946f01bbd95f57d419cedcf53ed53ce
- MD5 0ebc06666dba9126999e87969907b853
- SHA1 00d4f15051dd2ebf6288836308f2bb040dbbb510
- SHA512 297abd0fd21654916b905ea2f9a12152c22c55eee189ca31cf5e2617ed9c5e4f1018f077331fbcabf51dbea4492974198edc08f61f9c617372e935bb26a8c520
- SSDEEP 1536:pJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 11 - 6 - 2024\smss.exe
- Size 148KB
- SHA256 b9ea0337491dd442a8e4e9a88b6ab06978e1b06350333317b1b2a993fe3fa73b
- MD5 d42d64f8253632508cd44c7538fffef6
- SHA1 c6ead24964892363d148e9ecb06b2251bf502c5a
- SHA512 ba21f6bd94d56c7276630696c6581f54c7981d3e7965430046c91cf10c8c76b8d7821ed3df37bfcb3d67fc0ce80b0559ad31fe9c1ccf43bc4b34bd92c2e6f26a
- SSDEEP 1536:kJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:wx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 98d62384f49e71c3c8d34efeda9c14d8810b2ff9eaac85129caee92144426d99
- MD5 e404e6c4af4b0254aaec376ca9c61efb
- SHA1 fb56c8f92a66329d535afb37f7a0d56db1c9fdcc
- SHA512 6bbe08a78b4236fb66e60f02c4365bc9ce3d9face3923dedcdb6ee33df9f365386376eb7007a5e750ce2cd36841133f89a5d5f78c67569097fb97c04220f4887
- SSDEEP 1536:hJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:nx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 a2c55c203d1325efa6cbd8027fa474f573fc002c4f7ed1124906a5566d67acd0
- MD5 6a0ce367ff8fcfc1c8111ce2ed862876
- SHA1 8200381da57b7749a132a0975963059e43cb455f
- SHA512 5819b3988c4e9889a12b20cd010b7722c922d3b0ee8276699402b6af3244f555771f70c403dd0a5260ef57c925b7ce2d7bf7d9ef668c46b3e54df186ee07d8f5
- SSDEEP 1536:VJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Tx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 740fea54a9bdddbe24108279d1cf9c98ee3c1a461264270687cfc695d85c3596
- MD5 4cee38df05cd859e648b9d36b2ada041
- SHA1 c15a5e26c54f4598e8759219e0407cb7b6647f12
- SHA512 aefecbc9541ca1a2738eb70f4f6d955d68ebce0768331666029dd734b2e9604e3fac361a7b13ed149c2bca821890041e37794dcd9359c49f2e71792f1ae45285
- SSDEEP 1536:7Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Vx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 fe00909433f1ae76058b5a94d00db5ec4f277dd446ddee65743c7562737059b1
- MD5 18ad2b8fd2f885351abe4ea9daf6a862
- SHA1 0221beb9e7c7b62a82633bf5a794bb593d022aa5
- SHA512 37e384e488401f936d208851188045d7ef8934059e86064481c236bd042f919afc8215d3db6d6f2d3fda2728f11bb951577510ee32915f10c3d80d4986c3aa3a
- SSDEEP 1536:rJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Fx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\11-6-2024.exe
- Size 148KB
- SHA256 989680f13154e6c66db7d0b51dcaacbf2cd6cb34749d70315c38b554a9f87235
- MD5 f14dbc981c87059eb36edbb24620c4ac
- SHA1 461eb43a8ce86021149763ba808cd13925e3581c
- SHA512 2773c9d088ec7feea84fc953dea83f40ae5034662ade2d7228ea62980e22e62188b6c9a4330ad01c3f9a3519fef13ff252d3c6dbee6fda946990246a2db5d07d
- SSDEEP 1536:LJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:lx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 df06cbcedbde096108e002786099ee7259963ae10eaa86051e07d8c22912fbc5
- MD5 7ee162f32c14318cba70da2167cf0100
- SHA1 2a5d13980eab135709b3a0391ab348909c6143e9
- SHA512 a2a99797d12bf86b1aadec20d9375393d91a8f16ebbd62a2f5cc5ddb13ac2187eaae6512a52af2820e7916efb05ea1a87b9b7af25698f36f8be21947fe2f4d3a
- SSDEEP 1536:ZJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Px6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 2dbe21e1ac62e6bbc990abd55ae07ef278fb699f46d25cce2ba72be6e8178019
- MD5 5f357cdfbf96dd2d6317b379262490a6
- SHA1 139cb364d0980310f09c4d399d4d3ada9ae9bd5c
- SHA512 a23a40e92ef59a631b5f79ec66d33e9be37bfecb5a4b60b4093a91107d1270fbd8ac0984dc994e440473ab418bfa080d9c3775211717d0d3c247d93415b563bb
- SSDEEP 1536:vJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 7a74ec9b778c8ad1ccadf1cdc97823e5fb8fabb662a7bbb62f2b7b0c8280fa87
- MD5 abeaabd057797a2b13f22ce08d69b63a
- SHA1 771915687e656c22cb26448a272288c8aea06090
- SHA512 881269f493b660e63930d1e0d9a76256dc76d3592d357318eed885dc72ac971e84acb6d35de1b7c6c9583a58a03b111f87a571112328578578c9f311ffbc88a8
- SSDEEP 1536:PJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:hx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 1c9fcc749e6dd3663240d0bd384490ffc75402910ec44653fadcfee82e9f66d6
- MD5 be9988270d92d4cafab8fec97fef5143
- SHA1 49cfe2085880bcd63ad81bdfde08a14ac198f286
- SHA512 87a768468f4ac498690e8a5660b9f6c09a1bfbb6fc5c70ec952fa0a3e968c6bc99f5c84e69831924793f0186ba540ebf5903762483c9e781a155a77407035fa3
- SSDEEP 1536:tJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 8617e6ba6b1015796b96956212fbc488e70d0101fbd4187d3351449b06fb6d03
- MD5 53898ce14d43e7a0451a533a8fb0db7e
- SHA1 d4dd3adc9be51f4f937f2d03f1356b71880dff08
- SHA512 1ddc2aae19def978618b4b852b83c03da57558182dc32244ff8a459a8e814f62fc31dcd9272d095b10ddb40f1b3bb02343fbdf47a68111ace7be519e5da3a7f8
- SSDEEP 1536:xJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:3x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 7a0d0d3d574f47badcb0f5d4b36ef69b5cea68b1f18f66266744b7d2f4398a7f
- MD5 47b40f9b76ba1ad9f60b7c8fc4cf7ecc
- SHA1 bd8d57dbc94d25aa18f95f4927e3b2ae9948c98b
- SHA512 2634bba5b1b28bf979fa22c9398458fb24cee5d30dd0574d3ebd76a5baa689a30c36e9910cff36775db8ff56417ee7a7bfd6c0b2eaf67868b57926c56137e4b0
- SSDEEP 1536:jJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Nx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 2d63ba7243933cdb1f29da4fc629adc495840ce5ab81eeb0d53e4a0c2a42caac
- MD5 a684b012629b2fa8980ceb2da6532c19
- SHA1 3b39019f043a97b0e48134c2e86fe3870d4be06b
- SHA512 fff34c927094923b0c03401167f77c2fd00c375baff10d93179828c994db0f0423146dffe73b3c404ffa1c5d761d7e6ed9f269c6cb62e5d443f5ad7fb2188d72
- SSDEEP 1536:DJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:tx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mscomctl.ocx
- Size 148KB
- SHA256 449e340525c7806dedcccf717257c8f6ea1b8b7bed8238a10b8d653bcf0e7232
- MD5 0d4821591d685ff8a0527934b5c28445
- SHA1 b592bc292b4ec90b229dfd37ad76d7d110d3bcfe
- SHA512 4330f305182ad63970566c5ba4ddc1c6be8fcbcfc64d5b3c17d0f9b3dd150c73b67b0b9159f3052327b95d45ad0adbfde027241bad4f5d53151b3a54eec4a81a
- SSDEEP 1536:sJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Ix6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Gaara.exe
- Size 148KB
- SHA256 de4a971e94d23674b8c7071999c7f7e228e791b5a8ecdb1a367a1d7aa29b6836
- MD5 5d634c6bfa5ab137cfbff4e3ba5efe8c
- SHA1 7a4f4f67babcd29079c8439d7c8f022891a492e7
- SHA512 ca99d3c954fa57e37112b0484635de99853000cdd9d48d56a36f1699d30faaf7617cf88ec40cf1a4a5168e4e123efc0825a2c673352e583198ddef4dafde74fa
- SSDEEP 1536:UJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:gx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP