Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe
Resource
win7-20240508-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe
- Size 54KB
- Sample240613-xrn64ayare
- SHA256 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90
- MD5 e11974f767c35f983f133190d781d11e
- SHA1 2541edb5a0c5816fe120d5f949102626bfe6d6cb
- SHA512 0ccbcd936f24c3f39532bbb9f50f7fb40e7a3129e3f14ce8169a61511b3b4ff62f26c9b4358de151ff678c19555992cdf7025d62372d8fba9395e0102f80bff2
- SSDEEP 1536:K7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:K7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\SysWOW64\drivers\system32.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe - Executes dropped EXE 30 IoCs
pid Process 2360 smss.exe 4540 smss.exe 2136 Gaara.exe 4068 smss.exe 2072 Gaara.exe 4556 csrss.exe 5072 smss.exe 3992 Gaara.exe 4436 csrss.exe 436 Kazekage.exe 2068 smss.exe 1684 Gaara.exe 3180 csrss.exe 428 Kazekage.exe 2752 system32.exe 2632 smss.exe 2196 Gaara.exe 4044 csrss.exe 3204 Kazekage.exe 3836 system32.exe 624 system32.exe 4884 Kazekage.exe 2652 system32.exe 3168 csrss.exe 724 Kazekage.exe 3412 system32.exe 3104 Gaara.exe 4636 csrss.exe 1068 Kazekage.exe 804 system32.exe - Loads dropped DLL 18 IoCs
pid Process 2360 smss.exe 4540 smss.exe 2136 Gaara.exe 4068 smss.exe 2072 Gaara.exe 4556 csrss.exe 5072 smss.exe 3992 Gaara.exe 4436 csrss.exe 2068 smss.exe 1684 Gaara.exe 3180 csrss.exe 2632 smss.exe 2196 Gaara.exe 4044 csrss.exe 3168 csrss.exe 3104 Gaara.exe 4636 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 13 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "13-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 13 - 6 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\W:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\O:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification D:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini system32.exe File opened for modification C:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini system32.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\R:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\S:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini Kazekage.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\Z:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\N:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\X:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\A:\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: system32.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\J: Gaara.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\R: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\H: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\V: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\A: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\A: system32.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\Y: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\P: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\G: system32.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\W: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\I: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\N: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\Z: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\X: 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\K: csrss.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\U:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created D:\Autorun.inf Gaara.exe File created \??\S:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\W:\Autorun.inf smss.exe File created \??\W:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf csrss.exe File opened for modification D:\Autorun.inf Kazekage.exe File created \??\J:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created \??\P:\Autorun.inf smss.exe File opened for modification F:\Autorun.inf system32.exe File created \??\U:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification D:\Autorun.inf smss.exe File opened for modification \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf system32.exe File created \??\N:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\O:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File opened for modification \??\O:\Autorun.inf csrss.exe File opened for modification \??\S:\Autorun.inf csrss.exe File created \??\Y:\Autorun.inf csrss.exe File created \??\G:\Autorun.inf Kazekage.exe File created \??\R:\Autorun.inf Gaara.exe File opened for modification \??\K:\Autorun.inf csrss.exe File opened for modification \??\B:\Autorun.inf system32.exe File opened for modification D:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\G:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created \??\I:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Autorun.inf smss.exe File created \??\G:\Autorun.inf smss.exe File created \??\Z:\Autorun.inf system32.exe File opened for modification F:\Autorun.inf Kazekage.exe File created \??\S:\Autorun.inf system32.exe File created \??\E:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\O:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification F:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf Gaara.exe File created \??\Z:\Autorun.inf csrss.exe File opened for modification \??\J:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf Gaara.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\L:\Autorun.inf smss.exe File created \??\L:\Autorun.inf smss.exe File opened for modification \??\S:\Autorun.inf smss.exe File opened for modification \??\Z:\Autorun.inf smss.exe File created \??\K:\Autorun.inf Gaara.exe File opened for modification \??\M:\Autorun.inf Gaara.exe File opened for modification \??\S:\Autorun.inf system32.exe File created \??\U:\Autorun.inf system32.exe File created \??\W:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf system32.exe File opened for modification \??\G:\Autorun.inf Kazekage.exe File created \??\K:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created D:\Autorun.inf smss.exe File created \??\O:\Autorun.inf smss.exe File created \??\K:\Autorun.inf csrss.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File opened for modification \??\M:\Autorun.inf 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\Y:\Autorun.inf system32.exe File opened for modification \??\A:\Autorun.inf csrss.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\ 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\SysWOW64\Desktop.ini 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\13-6-2024.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe system32.exe File created C:\Windows\SysWOW64\mscomctl.ocx 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\13-6-2024.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\SysWOW64\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe csrss.exe File created C:\Windows\mscomctl.ocx 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\The Kazekage.jpg 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\ Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File created C:\Windows\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\system\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\system\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\WBEM\msvbvm60.dll 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File opened for modification C:\Windows\ system32.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe Kazekage.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop Gaara.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Size = "72" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop smss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe - Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe - Runs ping.exe 1 TTPs 36 IoCs
pid Process 824 ping.exe 2140 ping.exe 5032 ping.exe 1532 ping.exe 3464 ping.exe 4672 ping.exe 4912 ping.exe 3140 ping.exe 3220 ping.exe 3736 ping.exe 4448 ping.exe 3696 ping.exe 3472 ping.exe 4436 ping.exe 4720 ping.exe 224 ping.exe 2732 ping.exe 4832 ping.exe 4896 ping.exe 2316 ping.exe 4260 ping.exe 1892 ping.exe 2652 ping.exe 3384 ping.exe 2248 ping.exe 1740 ping.exe 1420 ping.exe 4648 ping.exe 4372 ping.exe 3528 ping.exe 4384 ping.exe 1472 ping.exe 3904 ping.exe 3992 ping.exe 1368 ping.exe 2756 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2360 smss.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 2136 Gaara.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe 4556 csrss.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2488 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe 2360 smss.exe 4540 smss.exe 2136 Gaara.exe 4068 smss.exe 2072 Gaara.exe 4556 csrss.exe 5072 smss.exe 3992 Gaara.exe 4436 csrss.exe 436 Kazekage.exe 2068 smss.exe 1684 Gaara.exe 3180 csrss.exe 428 Kazekage.exe 2752 system32.exe 2632 smss.exe 2196 Gaara.exe 4044 csrss.exe 3204 Kazekage.exe 3836 system32.exe 624 system32.exe 4884 Kazekage.exe 2652 system32.exe 3168 csrss.exe 724 Kazekage.exe 3412 system32.exe 3104 Gaara.exe 4636 csrss.exe 1068 Kazekage.exe 804 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2360 2488 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe 81 PID 2488 wrote to memory of 2360 2488 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe 81 PID 2488 wrote to memory of 2360 2488 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe 81 PID 2360 wrote to memory of 4540 2360 smss.exe 83 PID 2360 wrote to memory of 4540 2360 smss.exe 83 PID 2360 wrote to memory of 4540 2360 smss.exe 83 PID 2360 wrote to memory of 2136 2360 smss.exe 85 PID 2360 wrote to memory of 2136 2360 smss.exe 85 PID 2360 wrote to memory of 2136 2360 smss.exe 85 PID 2136 wrote to memory of 4068 2136 Gaara.exe 87 PID 2136 wrote to memory of 4068 2136 Gaara.exe 87 PID 2136 wrote to memory of 4068 2136 Gaara.exe 87 PID 2136 wrote to memory of 2072 2136 Gaara.exe 88 PID 2136 wrote to memory of 2072 2136 Gaara.exe 88 PID 2136 wrote to memory of 2072 2136 Gaara.exe 88 PID 2136 wrote to memory of 4556 2136 Gaara.exe 89 PID 2136 wrote to memory of 4556 2136 Gaara.exe 89 PID 2136 wrote to memory of 4556 2136 Gaara.exe 89 PID 4556 wrote to memory of 5072 4556 csrss.exe 90 PID 4556 wrote to memory of 5072 4556 csrss.exe 90 PID 4556 wrote to memory of 5072 4556 csrss.exe 90 PID 4556 wrote to memory of 3992 4556 csrss.exe 91 PID 4556 wrote to memory of 3992 4556 csrss.exe 91 PID 4556 wrote to memory of 3992 4556 csrss.exe 91 PID 4556 wrote to memory of 4436 4556 csrss.exe 92 PID 4556 wrote to memory of 4436 4556 csrss.exe 92 PID 4556 wrote to memory of 4436 4556 csrss.exe 92 PID 4556 wrote to memory of 436 4556 csrss.exe 93 PID 4556 wrote to memory of 436 4556 csrss.exe 93 PID 4556 wrote to memory of 436 4556 csrss.exe 93 PID 436 wrote to memory of 2068 436 Kazekage.exe 94 PID 436 wrote to memory of 2068 436 Kazekage.exe 94 PID 436 wrote to memory of 2068 436 Kazekage.exe 94 PID 436 wrote to memory of 1684 436 Kazekage.exe 95 PID 436 wrote to memory of 1684 436 Kazekage.exe 95 PID 436 wrote to memory of 1684 436 Kazekage.exe 95 PID 436 wrote to memory of 3180 436 Kazekage.exe 96 PID 436 wrote to memory of 3180 436 Kazekage.exe 96 PID 436 wrote to memory of 3180 436 Kazekage.exe 96 PID 436 wrote to memory of 428 436 Kazekage.exe 97 PID 436 wrote to memory of 428 436 Kazekage.exe 97 PID 436 wrote to memory of 428 436 Kazekage.exe 97 PID 436 wrote to memory of 2752 436 Kazekage.exe 98 PID 436 wrote to memory of 2752 436 Kazekage.exe 98 PID 436 wrote to memory of 2752 436 Kazekage.exe 98 PID 2752 wrote to memory of 2632 2752 system32.exe 99 PID 2752 wrote to memory of 2632 2752 system32.exe 99 PID 2752 wrote to memory of 2632 2752 system32.exe 99 PID 2752 wrote to memory of 2196 2752 system32.exe 100 PID 2752 wrote to memory of 2196 2752 system32.exe 100 PID 2752 wrote to memory of 2196 2752 system32.exe 100 PID 2752 wrote to memory of 4044 2752 system32.exe 101 PID 2752 wrote to memory of 4044 2752 system32.exe 101 PID 2752 wrote to memory of 4044 2752 system32.exe 101 PID 2752 wrote to memory of 3204 2752 system32.exe 102 PID 2752 wrote to memory of 3204 2752 system32.exe 102 PID 2752 wrote to memory of 3204 2752 system32.exe 102 PID 2752 wrote to memory of 3836 2752 system32.exe 103 PID 2752 wrote to memory of 3836 2752 system32.exe 103 PID 2752 wrote to memory of 3836 2752 system32.exe 103 PID 4556 wrote to memory of 624 4556 csrss.exe 104 PID 4556 wrote to memory of 624 4556 csrss.exe 104 PID 4556 wrote to memory of 624 4556 csrss.exe 104 PID 2136 wrote to memory of 4884 2136 Gaara.exe 105 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe"C:\Users\Admin\AppData\Local\Temp\0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2360 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4540
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2136 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4068
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4556 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3992
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4436
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:436 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3180
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:428
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2752 -
C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4044
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3204
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3836
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1420
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:3992
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4448
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2140
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3464
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4260
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3220
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:5032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3528
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:4372
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:1532
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:3904
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2732
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1740
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3384
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:4648
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:4912
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1472
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4884
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:224
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:3140
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4896
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:2756
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:3472
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4436
-
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3168
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:724
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3412
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1892
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:824
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3736
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4832
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3696
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:2248
-
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3104
-
-
C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4636
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:804
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4720
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:4672
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1368
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2652
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4384
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Gaara go to Kazekage.exe
- Size 54KB
- SHA256 57c08de154c7c0fb41730e9dcf22b361e3234523bdf3b4b474392572360f3b1c
- MD5 6d5e6a18bd231c0bdac6aeeba7d0f38f
- SHA1 6baab5dfdd7970bd969dc1fa42216cb115f23c73
- SHA512 276798bdc9b38b645407b38178b2ad84a685a58afe0b8976e408383e1bd1b9d9f0789cc6c286ca5cca002b29e5400ae437d1f1bda4b595bd1f6712f2526de943
- SSDEEP 1536:q7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:q7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Gaara.exe
- Size 54KB
- SHA256 0b93bb0bcab782397b629ab4eac9824b041e049412f99a4aed7a505ea92cdc90
- MD5 e11974f767c35f983f133190d781d11e
- SHA1 2541edb5a0c5816fe120d5f949102626bfe6d6cb
- SHA512 0ccbcd936f24c3f39532bbb9f50f7fb40e7a3129e3f14ce8169a61511b3b4ff62f26c9b4358de151ff678c19555992cdf7025d62372d8fba9395e0102f80bff2
- SSDEEP 1536:K7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:K7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 6 - 2024\Gaara.exe
- Size 54KB
- SHA256 0219e8f51b661ca5ffa70cc2e5de8b4f3abbd76e900614f8eef57c1e18421fa1
- MD5 810485c835ef72a0ef4bef0256255f27
- SHA1 87bb0154c9f6e52f4556ded18a2cb72a933ba6ca
- SHA512 0142e4cb169beb3a2992bc01ebee0937969a619cd580267e6a729d20b7858ebf3e31898007bf6e5443b5a15d4a7a160ca1776b1826a3f058883b5ba6c327cfd9
- SSDEEP 1536:n7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:n7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe
- Size 54KB
- SHA256 ee557ee236af9899a1145d30202ded216b86ade327a969be37957fd778f44440
- MD5 99aeeec7bc09102b596ec0fc32002435
- SHA1 d44b510708fa905463d79531f4a2a417e6efe38c
- SHA512 bfbcbc27eeb17c3eef2372399273ea8fa101d56b8d806df66954e38c91aedde4dc07562981f36e40b90e11fb0a3db8118d1b0ba16b56c8ade1969187900285db
- SSDEEP 1536:E7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:E7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 6 - 2024\csrss.exe
- Size 54KB
- SHA256 b6d04074eeff10c7c10b8c71e44c1059c5d93cc7bc6d3f9b5c420438c9714dfc
- MD5 851e787d77db61747c1a5e1bc0f094d2
- SHA1 c649ea3742f2c1597a6bc589a0c21dda8cf74ca5
- SHA512 e947dcfdb3a47d39388874b4d047ca32ef66302980262e67689354639725f046f2238ce6418005162fd63dfca34393e756644bc0426badbbaad3ead5f74b6ed2
- SSDEEP 1536:F7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:F7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 13 - 6 - 2024\smss.exe
- Size 54KB
- SHA256 5aff844ef6df591a0cf5e9fb340ecfc76e050cc33cb869253bbf7e81a601efec
- MD5 a9c6d81c3ce17ac5c4d2d576c36044ca
- SHA1 20b5cc26721191888045e18c6ef1908c7831b043
- SHA512 d0041fe2cc1a34598b3770c7a113bae89803264f6c55a7ad97f2ac4b2e456215d62c41bf96e4243c5a4d03a48f6497645631b6ef4d68f48a44d457dc92d9c008
- SSDEEP 1536:W7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:W7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-6-2024.exe
- Size 54KB
- SHA256 8590378efa1c18da83b33b0b78d9c37752f9a6019a05ac79d9b6be5331ba6048
- MD5 f349cf5c095493d6346e1edc5a74de9e
- SHA1 efe790303a52bd7a8136485e3f251c6c8557c18f
- SHA512 204c5611e8223add0e00c808fdaf017e770b2a8074f23bc675032bbc539bc0892eac7e0168511dd609846722cd5b362ae4237238b9a370f11f992f5fb7b72482
- SSDEEP 1536:s7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:s7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-6-2024.exe
- Size 54KB
- SHA256 e5dab8edf5130d056da29c81612cd9e23b50e87b1229807c73a166230c76bee7
- MD5 90ee80bf57b45df1893c286adc689616
- SHA1 1d33cf391f7298faad968fa21bda3154f9fe5c81
- SHA512 197d82569a43a0fe1907c5d66b243b8de4c3119c1f0fb80b69d20065fde0a40d121974e71dd356452dd0a311a0c4548b1363f1db383106c50957c4427826099c
- SSDEEP 1536:J7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:J7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-6-2024.exe
- Size 54KB
- SHA256 6008f819f9a1145d83cb3512efbdaeae83b2030496382a5dd7183d4d8135b4b0
- MD5 94105f8b30f616e7c0eb70c901363980
- SHA1 679d1bc1046c884cd0730b017e694fa9214c3987
- SHA512 703a2d552cd3c3fe5ff9c3ac81032e0a93256341bdbd2d031884cb6311603301c2bba3f74d520b7b2131c2b9d06242ce6ad08e28e4a5cc969d023a9e375f3e5f
- SSDEEP 1536:a7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:a7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-6-2024.exe
- Size 54KB
- SHA256 9755f5060d0222b26cd557021e45fef83f63450c87f8c7448bc0dcd5a9bb8973
- MD5 8f2f54989d8d0861210efa3d79e05044
- SHA1 24bfa4de0fdce547941ba99138758f5f0e0667ee
- SHA512 a7a4b52a80a82e1c77532c15bde4cd4230cbe86b3bbc3e610d2dc9e240f06593d1aa335ea1572300ef4b81c6acd9bb08ddb8efe16408e8ee0f01cd817080e5fa
- SSDEEP 1536:Y7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:Y7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\13-6-2024.exe
- Size 54KB
- SHA256 ca2de797327bd181afda050d7a3a4892bfa78520bd95fc53bb57113149140b62
- MD5 9b6be2ef7aa1b2ccf95c5edb59643369
- SHA1 e60fe2b7c5ff632aaae078a5a4f4a77fc4fccb73
- SHA512 d4b70e8ed3f411a4fb7b65869e289484f5c9bc7bb12fdd1fcaa6b49206d46e6a68f1bb51b1b23fa43a863a26c85de5e4f915474e600648e4a829653231503e7b
- SSDEEP 1536:f7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:f7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 54KB
- SHA256 06d2cc8ce97262ccf4190cd7e1df4555d758e6ee59f0a10ef967bc48f15d7764
- MD5 9a7248a4d03dab7e32da238af1ddb1b2
- SHA1 a1b233a5a1f322f9aadd0cffdb5bc70ec9037386
- SHA512 1ab4b156a44ee45e394cbd464ff3b0395658a08c437f04d528d861b289306e088bd2fd16190c7da250e2da130ce1f9e60688bd8d90c230f271985ac49501b3b2
- SSDEEP 1536:77TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:77TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 54KB
- SHA256 d445ee1659ac2fb05fe72a4e531f95885df1905523c5303453ff28f760c85f1b
- MD5 276f095f1842b43e82f52d0088d986b4
- SHA1 69d7fc67772659a18affa6652ab8aec5a3276939
- SHA512 5e87e9f5e8c2153e4cc47c883192b394bc98ebef2995d796d8a8e0e595e05527cc26519065cfab31a50c6fe9270a0d88ca16fa4d6fac47ebf5de7c17c0031cc6
- SSDEEP 1536:+7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:+7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 54KB
- SHA256 46cdbeb27dda892e9d3582126a69c9608d9891275e72ca74e1fbb8d34ba46edd
- MD5 5a96dbd244c0c78ed8e6d647b5807563
- SHA1 b622c9b9cfb75f37a1d9eed062d5bfe3efba806b
- SHA512 7c7f3ebb2c53fe7c00dfd3ed4de894267e55e52d97790238f61d2cdb329e6c22062526d8e98dcca9ee9deb555390cfbbc76a24126215313d3fe8d970548716fc
- SSDEEP 1536:X7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:X7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 54KB
- SHA256 8a737a9882a6a8ca271cce762de80c433a537422e00ffd2aa4cc2f6f3ef42631
- MD5 a7b6ba8a5e9fa46e8f4f35b9e4ceb2ae
- SHA1 d63bd8ea358b48ba9eddf6bb16a5485637a9b47e
- SHA512 be5e74b1c6a01d3174901b60100098ff51b342294e7322227fe7ace456e6cdcead7583d753134d2bd0b8ac0db461be9e25881e34a3f4fda2a7addfd62fb03bdf
- SSDEEP 1536:L7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:L7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 54KB
- SHA256 8c3f9febe6a0f292c01437aa7c6c596293cbb36d628d55fe2dc845eadaaaa013
- MD5 03406905043bacdd78310275a96b2320
- SHA1 2518f522fc756fc0690aafb55719e503ec1676e9
- SHA512 694a98fd0f34f292eace8368523df25b76bcc92c33a572c191e0df46518844e273c8d5b4e55f190e73250e8afe5bf9ce2c774235c1772c7c6f317a4db248cb40
- SSDEEP 1536:s7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:s7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 54KB
- SHA256 fdc24fc9dcb1420f6869c134e07696128f9f2b23542a447376620aef4fdf3493
- MD5 4016a173cc4296e845f27fdf4290e648
- SHA1 ac09d664d289665027bbcbe5ac252d2b6be04398
- SHA512 c2cf3c3c4ac07f1725792772a5a1ab3ed6561b68fdf02b10cf9fcae108c801e1e6f86b9a2cfc95b9df12606b82caea080866be19256677b7115cc9ebea19b7b7
- SSDEEP 1536:y7TJopblB4dqyyUiZ06pX3I6/qxiSEGNJFV:y7TQlatyYePxiFV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP