Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 07:50
Behavioral task
behavioral1
Sample
ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe
- Size 236KB
- Sample240614-jpb7vs1cle
- SHA256 a6e9a6566102b4a9713e9c1143f8bb042eab0ebbea87858fd83f852c656954d5
- MD5 ae6ba67611ecc2c2a6dcf6aea1e6be40
- SHA1 6753a6536c654adbee923308f76dd40fae73c65a
- SHA512 3196a1a4d3e51624e729a4bd31b31a5781fd9b7d143d6522cd5fb5018a937bf05861919b96c4db18888cffb6702f1763b0719c5afc2d70738e29f469fade4f1d
- SSDEEP 1536:xDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:8ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe - Executes dropped EXE 30 IoCs
pid Process 3176 smss.exe 1652 smss.exe 2024 Gaara.exe 2900 smss.exe 4432 Gaara.exe 4876 csrss.exe 372 smss.exe 720 Gaara.exe 4972 csrss.exe 3096 Kazekage.exe 1760 smss.exe 3684 Gaara.exe 4764 csrss.exe 2740 Kazekage.exe 4520 system32.exe 3836 smss.exe 364 Gaara.exe 704 csrss.exe 2652 Kazekage.exe 4248 system32.exe 3320 system32.exe 4392 Kazekage.exe 2272 system32.exe 2092 csrss.exe 3996 Kazekage.exe 3632 system32.exe 4416 Gaara.exe 4792 csrss.exe 3496 Kazekage.exe 1856 system32.exe - Loads dropped DLL 18 IoCs
pid Process 3176 smss.exe 1652 smss.exe 2024 Gaara.exe 2900 smss.exe 4432 Gaara.exe 4876 csrss.exe 372 smss.exe 720 Gaara.exe 4972 csrss.exe 1760 smss.exe 3684 Gaara.exe 4764 csrss.exe 3836 smss.exe 364 Gaara.exe 704 csrss.exe 2092 csrss.exe 4416 Gaara.exe 4792 csrss.exe -
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x000700000002343d-31.dat upx behavioral2/memory/3176-34-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x000700000002343e-41.dat upx behavioral2/files/0x000700000002343f-45.dat upx behavioral2/files/0x0007000000023442-57.dat upx behavioral2/files/0x0007000000023441-53.dat upx behavioral2/files/0x0007000000023440-49.dat upx behavioral2/memory/1652-70-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1652-77-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2024-75-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023442-96.dat upx behavioral2/files/0x0007000000023441-92.dat upx behavioral2/files/0x0007000000023440-88.dat upx behavioral2/files/0x000700000002343f-84.dat upx behavioral2/memory/2900-114-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4432-113-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4432-118-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4876-121-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/372-153-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4972-159-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/720-158-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4972-162-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023441-164.dat upx behavioral2/memory/3096-166-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/992-165-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3176-189-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023442-177.dat upx behavioral2/memory/1760-195-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2024-199-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3684-200-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4764-205-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2740-206-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2740-212-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4520-213-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4876-231-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3836-234-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/364-237-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/704-240-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3096-243-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4248-244-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2652-245-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4248-248-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3320-251-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4392-257-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2272-260-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2092-263-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4520-264-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3996-267-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3632-270-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4416-273-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4792-276-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3496-279-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1856-282-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x000100000000002c-297.dat upx behavioral2/files/0x000700000002345e-515.dat upx behavioral2/files/0x000700000002345f-600.dat upx - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "14-6-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 14 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 14 - 6 - 2024\\smss.exe" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification D:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\K:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\M:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\X:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\P:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\V:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\Y:\Desktop.ini smss.exe File opened for modification \??\L:\Desktop.ini Kazekage.exe File opened for modification \??\G:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\W:\Desktop.ini Gaara.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\W:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\A:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\Y:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\U:\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\R:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\R: Kazekage.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\S: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\Y: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\O: Gaara.exe File opened (read-only) \??\B: Gaara.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\X: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\B: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\P: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\R: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\J: system32.exe File opened (read-only) \??\V: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\M: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\X: Kazekage.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\K: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\G: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\I: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\Q: ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\E: Gaara.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\J:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf Gaara.exe File created \??\K:\Autorun.inf Gaara.exe File created D:\Autorun.inf csrss.exe File created \??\I:\Autorun.inf csrss.exe File opened for modification \??\M:\Autorun.inf csrss.exe File created \??\T:\Autorun.inf Kazekage.exe File created \??\W:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf system32.exe File opened for modification \??\S:\Autorun.inf system32.exe File created \??\G:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\H:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\J:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\Y:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf system32.exe File created \??\M:\Autorun.inf system32.exe File created \??\T:\Autorun.inf system32.exe File opened for modification \??\G:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\R:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\S:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\T:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\V:\Autorun.inf Kazekage.exe File opened for modification D:\Autorun.inf smss.exe File created \??\O:\Autorun.inf smss.exe File created \??\I:\Autorun.inf Gaara.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\I:\Autorun.inf smss.exe File created \??\W:\Autorun.inf smss.exe File opened for modification \??\A:\Autorun.inf Gaara.exe File opened for modification \??\O:\Autorun.inf csrss.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File created \??\A:\Autorun.inf Kazekage.exe File created \??\S:\Autorun.inf Kazekage.exe File created D:\Autorun.inf system32.exe File created \??\I:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\N:\Autorun.inf smss.exe File opened for modification \??\R:\Autorun.inf system32.exe File created \??\V:\Autorun.inf system32.exe File opened for modification \??\E:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\H:\Autorun.inf smss.exe File created \??\T:\Autorun.inf Gaara.exe File opened for modification \??\U:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf csrss.exe File opened for modification \??\W:\Autorun.inf Kazekage.exe File created \??\G:\Autorun.inf system32.exe File opened for modification \??\T:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\U:\Autorun.inf csrss.exe File opened for modification C:\Autorun.inf Kazekage.exe File created \??\J:\Autorun.inf Kazekage.exe File created \??\K:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\N:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf Gaara.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File created \??\U:\Autorun.inf system32.exe File opened for modification \??\S:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File created \??\B:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification \??\K:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Autorun.inf ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created \??\I:\Autorun.inf Kazekage.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\14-6-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\mscomctl.ocx ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File created C:\Windows\SysWOW64\14-6-2024.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\SysWOW64\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\14-6-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\14-6-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\14-6-2024.exe system32.exe File created C:\Windows\SysWOW64\Desktop.ini ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\14-6-2024.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\14-6-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\mscoree.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe system32.exe File opened for modification C:\Windows\ Gaara.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\ ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ smss.exe File created C:\Windows\WBEM\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File created C:\Windows\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\msvbvm60.dll ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\mscomctl.ocx ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe csrss.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File created C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\WallpaperStyle = "2" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop smss.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe - Runs ping.exe 1 TTPs 34 IoCs
pid Process 4792 ping.exe 700 ping.exe 4416 ping.exe 3972 ping.exe 380 ping.exe 4300 ping.exe 4256 ping.exe 3108 ping.exe 1780 ping.exe 3376 ping.exe 3932 ping.exe 3608 ping.exe 4008 ping.exe 3408 ping.exe 5008 ping.exe 2904 ping.exe 4012 ping.exe 364 ping.exe 1740 ping.exe 4704 ping.exe 1880 ping.exe 704 ping.exe 1852 ping.exe 2488 ping.exe 3320 ping.exe 740 ping.exe 4928 ping.exe 2396 ping.exe 1796 ping.exe 4236 ping.exe 1760 ping.exe 4828 ping.exe 3316 ping.exe 3204 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 3176 smss.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 2024 Gaara.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe 4876 csrss.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 992 ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe 3176 smss.exe 1652 smss.exe 2024 Gaara.exe 2900 smss.exe 4432 Gaara.exe 4876 csrss.exe 372 smss.exe 720 Gaara.exe 4972 csrss.exe 3096 Kazekage.exe 1760 smss.exe 3684 Gaara.exe 4764 csrss.exe 2740 Kazekage.exe 4520 system32.exe 3836 smss.exe 364 Gaara.exe 704 csrss.exe 2652 Kazekage.exe 4248 system32.exe 3320 system32.exe 4392 Kazekage.exe 2272 system32.exe 2092 csrss.exe 3996 Kazekage.exe 3632 system32.exe 4416 Gaara.exe 4792 csrss.exe 3496 Kazekage.exe 1856 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 992 wrote to memory of 3176 992 ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe 83 PID 992 wrote to memory of 3176 992 ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe 83 PID 992 wrote to memory of 3176 992 ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe 83 PID 3176 wrote to memory of 1652 3176 smss.exe 86 PID 3176 wrote to memory of 1652 3176 smss.exe 86 PID 3176 wrote to memory of 1652 3176 smss.exe 86 PID 3176 wrote to memory of 2024 3176 smss.exe 87 PID 3176 wrote to memory of 2024 3176 smss.exe 87 PID 3176 wrote to memory of 2024 3176 smss.exe 87 PID 2024 wrote to memory of 2900 2024 Gaara.exe 88 PID 2024 wrote to memory of 2900 2024 Gaara.exe 88 PID 2024 wrote to memory of 2900 2024 Gaara.exe 88 PID 2024 wrote to memory of 4432 2024 Gaara.exe 89 PID 2024 wrote to memory of 4432 2024 Gaara.exe 89 PID 2024 wrote to memory of 4432 2024 Gaara.exe 89 PID 2024 wrote to memory of 4876 2024 Gaara.exe 90 PID 2024 wrote to memory of 4876 2024 Gaara.exe 90 PID 2024 wrote to memory of 4876 2024 Gaara.exe 90 PID 4876 wrote to memory of 372 4876 csrss.exe 91 PID 4876 wrote to memory of 372 4876 csrss.exe 91 PID 4876 wrote to memory of 372 4876 csrss.exe 91 PID 4876 wrote to memory of 720 4876 csrss.exe 92 PID 4876 wrote to memory of 720 4876 csrss.exe 92 PID 4876 wrote to memory of 720 4876 csrss.exe 92 PID 4876 wrote to memory of 4972 4876 csrss.exe 93 PID 4876 wrote to memory of 4972 4876 csrss.exe 93 PID 4876 wrote to memory of 4972 4876 csrss.exe 93 PID 4876 wrote to memory of 3096 4876 csrss.exe 94 PID 4876 wrote to memory of 3096 4876 csrss.exe 94 PID 4876 wrote to memory of 3096 4876 csrss.exe 94 PID 3096 wrote to memory of 1760 3096 Kazekage.exe 95 PID 3096 wrote to memory of 1760 3096 Kazekage.exe 95 PID 3096 wrote to memory of 1760 3096 Kazekage.exe 95 PID 3096 wrote to memory of 3684 3096 Kazekage.exe 96 PID 3096 wrote to memory of 3684 3096 Kazekage.exe 96 PID 3096 wrote to memory of 3684 3096 Kazekage.exe 96 PID 3096 wrote to memory of 4764 3096 Kazekage.exe 97 PID 3096 wrote to memory of 4764 3096 Kazekage.exe 97 PID 3096 wrote to memory of 4764 3096 Kazekage.exe 97 PID 3096 wrote to memory of 2740 3096 Kazekage.exe 98 PID 3096 wrote to memory of 2740 3096 Kazekage.exe 98 PID 3096 wrote to memory of 2740 3096 Kazekage.exe 98 PID 3096 wrote to memory of 4520 3096 Kazekage.exe 99 PID 3096 wrote to memory of 4520 3096 Kazekage.exe 99 PID 3096 wrote to memory of 4520 3096 Kazekage.exe 99 PID 4520 wrote to memory of 3836 4520 system32.exe 100 PID 4520 wrote to memory of 3836 4520 system32.exe 100 PID 4520 wrote to memory of 3836 4520 system32.exe 100 PID 4520 wrote to memory of 364 4520 system32.exe 101 PID 4520 wrote to memory of 364 4520 system32.exe 101 PID 4520 wrote to memory of 364 4520 system32.exe 101 PID 4520 wrote to memory of 704 4520 system32.exe 102 PID 4520 wrote to memory of 704 4520 system32.exe 102 PID 4520 wrote to memory of 704 4520 system32.exe 102 PID 4520 wrote to memory of 2652 4520 system32.exe 103 PID 4520 wrote to memory of 2652 4520 system32.exe 103 PID 4520 wrote to memory of 2652 4520 system32.exe 103 PID 4520 wrote to memory of 4248 4520 system32.exe 104 PID 4520 wrote to memory of 4248 4520 system32.exe 104 PID 4520 wrote to memory of 4248 4520 system32.exe 104 PID 4876 wrote to memory of 3320 4876 csrss.exe 105 PID 4876 wrote to memory of 3320 4876 csrss.exe 105 PID 4876 wrote to memory of 3320 4876 csrss.exe 105 PID 2024 wrote to memory of 4392 2024 Gaara.exe 106 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae6ba67611ecc2c2a6dcf6aea1e6be40_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:992 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3176 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2024 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4876 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:372
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:720
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3096 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3684
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4764
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4520 -
C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3836
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:364
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:704
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4248
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4828
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:740
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:364
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3376
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:1740
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3932
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1852
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:5008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:3316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:4236
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:1880
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3320
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:4300
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:4792
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:2396
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:3408
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3108
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:3972
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2904
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:704
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:3608
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:1796
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4704
-
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3996
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:380
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1760
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4928
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:3320
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:4256
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4416
-
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4416
-
-
C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3496
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:700
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:2488
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:1780
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:3204
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 14 - 6 - 2024\Gaara.exe
- Size 236KB
- SHA256 9960fe42d5e1fc5fa54116916ba70125f27b075c2a8f0098fb28e974f6fe7001
- MD5 439f4214c09348dcfd8b29c252f7d305
- SHA1 546c185fc76fc896fc1b40b70ed1164d6965abf2
- SHA512 88781a3aa15ea86e500ac9538a13283ce4dfe2f2e3841e479cf69abd6f64e4ef97479e63f9b22d37b6113a144acc213fa9243ba95be00ab5779265386af70d1a
- SSDEEP 1536:Y2DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:qox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe
- Size 236KB
- SHA256 ca4a960da52520bd2d915c1c72f6fc3767344f7a429f139ad02653bb0a420fd5
- MD5 e675a696d7550b1c5b52cee56f397f90
- SHA1 fc836c86167851212e0f0e3178c0b23bf57b2880
- SHA512 ce26a845815d94bc0a565578b1f91ad86dc318ded0fb8cdaeeaf68fdbffa9f8155a272b711c48b5a05f8ab4ae17390a2f492f83195cafe3eacd215bc36f8e009
- SSDEEP 1536:YlDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:zox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 14 - 6 - 2024\csrss.exe
- Size 236KB
- SHA256 43b06a21d2ab1890d00daf978f7b69c71048a07d7d4b9cc066d67ab225e5d3ba
- MD5 74f5861bd2ca2b760e21e74167366213
- SHA1 69aa5466b026c49853b482f14f9ed5c2e50ac537
- SHA512 00c77f1ed9d7a960b9866e44847e33a0a2f85e15118a486552a78be2c0253cfec647ebbb611e0356c330ef7b4db1a132bd3518db2a184727ad683744d0ac9233
- SSDEEP 1536:nDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:qox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 14 - 6 - 2024\smss.exe
- Size 236KB
- SHA256 27ba6506fa533fce53fae18b40cf69d03d5c8adb0615142fe46dd972fe3526e0
- MD5 f58fe44baf751cfec6dd6545f0ec1e21
- SHA1 7c955358fdde90349ec18c52801055597d84f815
- SHA512 35fae327607b49a42f34405c1e8334be74ebb78e19b2fae467ae54c4a32efb5b4522ae4f82535cdc1a23fcb945a318fc69b91e028015a7b598ac03efc700fc30
- SSDEEP 1536:YFDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:zox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\14-6-2024.exe
- Size 236KB
- SHA256 455769c8c8388e4ca61bb67cd39b1ebe93f6b589e8cca82c6e564f2030fbf9b0
- MD5 b7c0c04078b62670ce0a284aff05f6c2
- SHA1 5872aba210c6e60efcfc4d2c057b98e623f2acc0
- SHA512 1ebe8980d35d9ea586bcefe10830ffb9988fa6990182ddb831d01e8fdcac42815976ce92d39358505373bf61e8b9809b77af9de854521ee82d36eb396671d13c
- SSDEEP 1536:YbDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:Jox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\14-6-2024.exe
- Size 236KB
- SHA256 fd5324d55623a9a244e80525cab0e4e97a2d189ddf1f6f186ce17e1a440c5b49
- MD5 fcd47e454454586ca50d97117ad8c526
- SHA1 2802767bb203c72be84793cb6272a384d6d52007
- SHA512 87de36864f8ea71596c1bcb9b269edd77d10144a2995c78c43b13f09199f88cb49c0b15fc07e34af5119b6ae7f0c1a3804d4eb26282637b735a2f4007672a2c6
- SSDEEP 1536:5DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:kox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 c3f8ee23bc234b10746037e07ad905e8e9ddbe2466a769155a0b6fd7399a3e1d
- MD5 bf1ab5829133256322ac822db177f346
- SHA1 e87d0aef52fc0c3dd3e3a7fbbfa03ad71346e319
- SHA512 8d6bd991216941f10a88791973a60dea1886e22e74699f469294e27b7d4a6bf786618ff9d9e907f900180a7a0559b65c8ebe01a902700bca4df44fcf6f57f8ca
- SSDEEP 1536:aDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:pox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 1a47183a979b9af6ecd4c861ea3cd9eb2fdd5819e95aa14f7fe55737e68d6321
- MD5 c6aea5659d54b99fff13ed149605d52b
- SHA1 13c4961210381761ed7150c4a7bd2b41bce0a6b4
- SHA512 edc5f8d6c962a3d85514ec79875c3341763183e11c0b65535647725dd2af604c3e86e8478c123104dbb4a8ca7b3c7226761f2135fe7cdc55f3e099c9965a21cf
- SSDEEP 1536:YDDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:Vox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 1d998cfcc4e23a4e5f93e819cd594e35ec159598c303506584fe8e0773d5a52d
- MD5 5a4c4c287a1590bf9caa445faf1d8c36
- SHA1 aa73c07f46757560626c0f5fb3f0286888a48863
- SHA512 5370b2e4edd1b5f426f4bb95de3f4d39b57259a5425b44b1fcb397cfd9a1e7ee7252f272a726197dbc72cc25a1a6b3d520239b545020cee4dea19106cfd8dc61
- SSDEEP 1536:hDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:sox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 cc27dbdb1647b29984206ce7e6b8ee759c4ac2e0a03fee1553e68c61e88499ca
- MD5 b379ed735d0551bf11d479610efafb17
- SHA1 0dd1c8126866ff1f1471805d08726395b27b3032
- SHA512 2226e0aafd6fe3e73d14633ff5b090ccf845dea81be5c437cf89918b8ca7b5f25607e3798e8ad3c0af5da46c2c761402b28471791051c83b7ed087b492415eb8
- SSDEEP 1536:zDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:Gox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 48dbfe8375fb0bd08e55e85f80529fd448db97be135f6dd7f75b2fc6f64259e1
- MD5 b7a08f00c17b61294f756c622e4152cc
- SHA1 8c87dc49630693b1316813ed9dde1e89f10ebdb6
- SHA512 5096724a94eaeb154923c643999a79944f9e64fcd0e8415e60cef2ea84961ccacd0cf0622d9f0d09734ee1b34169572ab601202b6f46c10c7580b5a85792309f
- SSDEEP 1536:Y/DusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2Ol:hox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 fa032b4c2f5a62f45b82ffe129e45ac621b4ac92301a881ed65f52af7bd715b1
- MD5 2a6d4ed70b27fc333ee14dc73ecfeb46
- SHA1 670a97187e164a8775e54fe22ac85f86eacc2d6a
- SHA512 2e937d2805125766d6483100cb70481679dc9b49eba89e6b670522aca1d7a731517c127f426cf25516746459ae9e44ddd4055ba79711488033ee5e55c449a3eb
- SSDEEP 1536:dDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:4ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mscomctl.ocx
- Size 236KB
- SHA256 d3540e7351d1afb33df50fddb26791c1850e3dc2a51be3b07289a98f35f1c703
- MD5 5c1c4bbc5fdb2e395cb04b65261c8433
- SHA1 20b1ff7fee7899d8fe1d715fb86706daf0d6a1a9
- SHA512 b0bebcca8041a204ebe31207d4404adef34695f7b2a82b969b592dfa2d4cc5a4820c8b1fdb46fb60c1f3176140f0ff951b31e5d12d3a66eb32e947f24a96fdc8
- SSDEEP 1536:kDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:rox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mscomctl.ocx
- Size 236KB
- SHA256 a2f084d31c3cc8e5d0034b65ae385ffdf4e965d5b381c6155b06924fe4105cb3
- MD5 8b10de32c4fe1bf1b401396aa509acf8
- SHA1 da27904083fea4ecc7aa4ebbdce400d3989a225a
- SHA512 f1d9782dcccc89dd7aa13a7c619a165b76712cab83692e8ecae246518aed640e0b3463ea64cb4db3ca5625b54172e2cf9ce99769ecdb501ed1c951485d94139d
- SSDEEP 1536:jDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:2ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Admin Games\Anbu Team Sampit (Nothing).exe
- Size 236KB
- SHA256 a6e9a6566102b4a9713e9c1143f8bb042eab0ebbea87858fd83f852c656954d5
- MD5 ae6ba67611ecc2c2a6dcf6aea1e6be40
- SHA1 6753a6536c654adbee923308f76dd40fae73c65a
- SHA512 3196a1a4d3e51624e729a4bd31b31a5781fd9b7d143d6522cd5fb5018a937bf05861919b96c4db18888cffb6702f1763b0719c5afc2d70738e29f469fade4f1d
- SSDEEP 1536:xDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:8ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP