Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe
Resource
win7-20240508-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe
- Size 148KB
- Sample240616-ek8m2ssfmk
- SHA256 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22
- MD5 fab7116a5f3d14f7416f5e649676ceed
- SHA1 d8193a5d5fdd3ce9f5774fef50129b2ea38d2848
- SHA512 755ce04291a0a4c8656e5971c4ad9df728feab9580e26ab34b038a84abb66f8d477e5e4e246c9e59914ac514ed5f44d48c74c38765944126490f203db09c29eb
- SSDEEP 1536:/Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Rx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe system32.exe - Executes dropped EXE 30 IoCs
pid Process 3932 smss.exe 1964 smss.exe 2700 Gaara.exe 1480 smss.exe 2488 Gaara.exe 3128 csrss.exe 4808 smss.exe 2844 Gaara.exe 4164 csrss.exe 2812 Kazekage.exe 4288 smss.exe 4012 Gaara.exe 3236 csrss.exe 4632 Kazekage.exe 844 system32.exe 4360 smss.exe 3788 Gaara.exe 2912 csrss.exe 3232 Kazekage.exe 4512 system32.exe 3244 system32.exe 940 Kazekage.exe 1276 system32.exe 2568 csrss.exe 1868 Kazekage.exe 1464 system32.exe 2544 Gaara.exe 4052 csrss.exe 1188 Kazekage.exe 1316 system32.exe - Loads dropped DLL 18 IoCs
pid Process 3932 smss.exe 1964 smss.exe 2700 Gaara.exe 1480 smss.exe 2488 Gaara.exe 3128 csrss.exe 4808 smss.exe 2844 Gaara.exe 4164 csrss.exe 4288 smss.exe 4012 Gaara.exe 3236 csrss.exe 4360 smss.exe 3788 Gaara.exe 2912 csrss.exe 2568 csrss.exe 2544 Gaara.exe 4052 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 16 - 6 - 2024\\smss.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 16 - 6 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "16-6-2024.exe" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini smss.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini smss.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\X:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\Z:\Desktop.ini system32.exe File opened for modification \??\X:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\U:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification C:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini Gaara.exe File opened for modification \??\W:\Desktop.ini Gaara.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\L:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini system32.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\N:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\T:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\K:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification C:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini Kazekage.exe File opened for modification \??\B:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\Y:\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\V:\Desktop.ini smss.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: system32.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\B: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\K: smss.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\J: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\L: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\U: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\Y: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\S: Gaara.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\N: Kazekage.exe File opened (read-only) \??\P: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\X: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\R: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\I: smss.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\Y: Kazekage.exe File opened (read-only) \??\H: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\J: Gaara.exe File opened (read-only) \??\O: Gaara.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\O: smss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\L: Gaara.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\S: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\R: smss.exe File opened (read-only) \??\I: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\A: eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\R: csrss.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\O:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf system32.exe File opened for modification \??\M:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created D:\Autorun.inf smss.exe File created D:\Autorun.inf csrss.exe File opened for modification \??\K:\Autorun.inf Kazekage.exe File created D:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\Z:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\L:\Autorun.inf smss.exe File created \??\K:\Autorun.inf system32.exe File created \??\Q:\Autorun.inf csrss.exe File created \??\M:\Autorun.inf Kazekage.exe File created \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File created \??\P:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\S:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\W:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\X:\Autorun.inf smss.exe File opened for modification \??\J:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf system32.exe File created \??\M:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\Z:\Autorun.inf csrss.exe File opened for modification \??\P:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\L:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\P:\Autorun.inf smss.exe File created \??\K:\Autorun.inf csrss.exe File created \??\U:\Autorun.inf Kazekage.exe File created \??\Z:\Autorun.inf Kazekage.exe File opened for modification D:\Autorun.inf Gaara.exe File created \??\X:\Autorun.inf Gaara.exe File opened for modification \??\Y:\Autorun.inf Gaara.exe File opened for modification \??\T:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification D:\Autorun.inf smss.exe File created \??\X:\Autorun.inf csrss.exe File opened for modification \??\W:\Autorun.inf Kazekage.exe File opened for modification \??\B:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\K:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\U:\Autorun.inf csrss.exe File created D:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf system32.exe File created \??\G:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File opened for modification \??\V:\Autorun.inf Kazekage.exe File opened for modification \??\M:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\N:\Autorun.inf smss.exe File created \??\J:\Autorun.inf csrss.exe File opened for modification \??\T:\Autorun.inf system32.exe File opened for modification \??\A:\Autorun.inf system32.exe File created \??\B:\Autorun.inf system32.exe File created \??\M:\Autorun.inf smss.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File opened for modification \??\J:\Autorun.inf Kazekage.exe File created \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\J:\Autorun.inf Gaara.exe File created \??\E:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\H:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created \??\Y:\Autorun.inf eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification \??\W:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File created \??\A:\Autorun.inf Kazekage.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\16-6-2024.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\SysWOW64\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\16-6-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\16-6-2024.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\ eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\SysWOW64\16-6-2024.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\16-6-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\16-6-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\16-6-2024.exe system32.exe File created C:\Windows\SysWOW64\Desktop.ini eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File created C:\Windows\SysWOW64\mscomctl.ocx eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\The Kazekage.jpg eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\system\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe smss.exe File opened for modification C:\Windows\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\WBEM\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File created C:\Windows\mscomctl.ocx eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe File created C:\Windows\Fonts\Admin 16 - 6 - 2024\msvbvm60.dll eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop smss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Speed = "4" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\WallpaperStyle = "2" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\Screen Saver.Marquee\Size = "72" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe - Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe - Runs ping.exe 1 TTPs 32 IoCs
pid Process 1864 ping.exe 1256 ping.exe 4460 ping.exe 2960 ping.exe 3528 ping.exe 4288 ping.exe 3040 ping.exe 4824 ping.exe 4520 ping.exe 4168 ping.exe 940 ping.exe 4512 ping.exe 2892 ping.exe 3480 ping.exe 2712 ping.exe 5016 ping.exe 4984 ping.exe 4132 ping.exe 4288 ping.exe 1972 ping.exe 2900 ping.exe 3528 ping.exe 3316 ping.exe 1276 ping.exe 4492 ping.exe 4048 ping.exe 4840 ping.exe 4360 ping.exe 440 ping.exe 1860 ping.exe 3192 ping.exe 3492 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 2700 Gaara.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 3128 csrss.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe 2812 Kazekage.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2184 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe 3932 smss.exe 1964 smss.exe 2700 Gaara.exe 1480 smss.exe 2488 Gaara.exe 3128 csrss.exe 4808 smss.exe 2844 Gaara.exe 4164 csrss.exe 2812 Kazekage.exe 4288 smss.exe 4012 Gaara.exe 3236 csrss.exe 4632 Kazekage.exe 844 system32.exe 4360 smss.exe 3788 Gaara.exe 2912 csrss.exe 3232 Kazekage.exe 4512 system32.exe 3244 system32.exe 940 Kazekage.exe 1276 system32.exe 2568 csrss.exe 1868 Kazekage.exe 1464 system32.exe 2544 Gaara.exe 4052 csrss.exe 1188 Kazekage.exe 1316 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 3932 2184 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe 81 PID 2184 wrote to memory of 3932 2184 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe 81 PID 2184 wrote to memory of 3932 2184 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe 81 PID 3932 wrote to memory of 1964 3932 smss.exe 82 PID 3932 wrote to memory of 1964 3932 smss.exe 82 PID 3932 wrote to memory of 1964 3932 smss.exe 82 PID 3932 wrote to memory of 2700 3932 smss.exe 84 PID 3932 wrote to memory of 2700 3932 smss.exe 84 PID 3932 wrote to memory of 2700 3932 smss.exe 84 PID 2700 wrote to memory of 1480 2700 Gaara.exe 86 PID 2700 wrote to memory of 1480 2700 Gaara.exe 86 PID 2700 wrote to memory of 1480 2700 Gaara.exe 86 PID 2700 wrote to memory of 2488 2700 Gaara.exe 88 PID 2700 wrote to memory of 2488 2700 Gaara.exe 88 PID 2700 wrote to memory of 2488 2700 Gaara.exe 88 PID 2700 wrote to memory of 3128 2700 Gaara.exe 89 PID 2700 wrote to memory of 3128 2700 Gaara.exe 89 PID 2700 wrote to memory of 3128 2700 Gaara.exe 89 PID 3128 wrote to memory of 4808 3128 csrss.exe 91 PID 3128 wrote to memory of 4808 3128 csrss.exe 91 PID 3128 wrote to memory of 4808 3128 csrss.exe 91 PID 3128 wrote to memory of 2844 3128 csrss.exe 92 PID 3128 wrote to memory of 2844 3128 csrss.exe 92 PID 3128 wrote to memory of 2844 3128 csrss.exe 92 PID 3128 wrote to memory of 4164 3128 csrss.exe 93 PID 3128 wrote to memory of 4164 3128 csrss.exe 93 PID 3128 wrote to memory of 4164 3128 csrss.exe 93 PID 3128 wrote to memory of 2812 3128 csrss.exe 94 PID 3128 wrote to memory of 2812 3128 csrss.exe 94 PID 3128 wrote to memory of 2812 3128 csrss.exe 94 PID 2812 wrote to memory of 4288 2812 Kazekage.exe 95 PID 2812 wrote to memory of 4288 2812 Kazekage.exe 95 PID 2812 wrote to memory of 4288 2812 Kazekage.exe 95 PID 2812 wrote to memory of 4012 2812 Kazekage.exe 96 PID 2812 wrote to memory of 4012 2812 Kazekage.exe 96 PID 2812 wrote to memory of 4012 2812 Kazekage.exe 96 PID 2812 wrote to memory of 3236 2812 Kazekage.exe 97 PID 2812 wrote to memory of 3236 2812 Kazekage.exe 97 PID 2812 wrote to memory of 3236 2812 Kazekage.exe 97 PID 2812 wrote to memory of 4632 2812 Kazekage.exe 98 PID 2812 wrote to memory of 4632 2812 Kazekage.exe 98 PID 2812 wrote to memory of 4632 2812 Kazekage.exe 98 PID 2812 wrote to memory of 844 2812 Kazekage.exe 99 PID 2812 wrote to memory of 844 2812 Kazekage.exe 99 PID 2812 wrote to memory of 844 2812 Kazekage.exe 99 PID 844 wrote to memory of 4360 844 system32.exe 100 PID 844 wrote to memory of 4360 844 system32.exe 100 PID 844 wrote to memory of 4360 844 system32.exe 100 PID 844 wrote to memory of 3788 844 system32.exe 101 PID 844 wrote to memory of 3788 844 system32.exe 101 PID 844 wrote to memory of 3788 844 system32.exe 101 PID 844 wrote to memory of 2912 844 system32.exe 102 PID 844 wrote to memory of 2912 844 system32.exe 102 PID 844 wrote to memory of 2912 844 system32.exe 102 PID 844 wrote to memory of 3232 844 system32.exe 103 PID 844 wrote to memory of 3232 844 system32.exe 103 PID 844 wrote to memory of 3232 844 system32.exe 103 PID 844 wrote to memory of 4512 844 system32.exe 104 PID 844 wrote to memory of 4512 844 system32.exe 104 PID 844 wrote to memory of 4512 844 system32.exe 104 PID 3128 wrote to memory of 3244 3128 csrss.exe 105 PID 3128 wrote to memory of 3244 3128 csrss.exe 105 PID 3128 wrote to memory of 3244 3128 csrss.exe 105 PID 2700 wrote to memory of 940 2700 Gaara.exe 106 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe"C:\Users\Admin\AppData\Local\Temp\eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2184 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3932 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2700 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3128 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4808
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4164
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2812 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4012
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3236
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844 -
C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4360
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3788
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3232
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:4132
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:2892
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:1276
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4492
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- Runs ping.exe
PID:3316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- Runs ping.exe
PID:4840
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:440
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:3528
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:3492
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:4460
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- Runs ping.exe
PID:940
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- Runs ping.exe
PID:2900
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3244
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:4512
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:4984
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:3192
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:1256
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- Runs ping.exe
PID:4168
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- Runs ping.exe
PID:3528
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4824
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4360
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:2712
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:4520
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- Runs ping.exe
PID:4048
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- Runs ping.exe
PID:5016
-
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2568
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1464
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:1864
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:4288
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:3480
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- Runs ping.exe
PID:2960
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- Runs ping.exe
PID:1972
-
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4052
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- Runs ping.exe
PID:4288
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- Runs ping.exe
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 16 - 6 - 2024\Gaara.exe
- Size 148KB
- SHA256 db88c4d0c9d0bef6e4b5496733ebf4223c233bef56be07a1d17c5a16e52a5720
- MD5 3dcdbebefa3f3c1bbdc8655badd15c00
- SHA1 762e61f86746552575e5717e42b7baa4e2d0e04b
- SHA512 249734439365031091eecb3ba18d38c1a0fe2d36acc5c21a4c49f3da0345d26a3d201864ab804890d3f336d62cab76645c33926c49013331cfe6f6d1bfb5fd50
- SSDEEP 1536:jJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Nx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 b4d30c4a099f0daab160d87919df4cd1a82aec62312cdd8b574b809ab7771801
- MD5 884d29513ee522edb252311276a662a4
- SHA1 2d8e25a494f548f69d03282a3a457869eecee9ea
- SHA512 44e0f5681592858e939fc72e668342a106f1d95ad549d4aad93fe57578d5801558cc0ab6eaca4cd797d15fe52af58c569139082d54d1529d6c4bfbd356c06bd4
- SSDEEP 1536:2Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Wx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 16 - 6 - 2024\csrss.exe
- Size 148KB
- SHA256 e0476793c081955643cfedc523ad0be5509dff801f82fdf358244438d8c70dde
- MD5 1faf4a4f9aed79edeff9427f065aad7c
- SHA1 ee6a492bd810d6592eb06c969658f5ce400702ce
- SHA512 4178886b4ba7efb2ce7a77bfd927ac2ff196c94427afe4a9aecab2a07dc0695ddf3ddd94fd14ea2f717a755222d3c401a125f46420d2c8244d7af7befd175f30
- SSDEEP 1536:/Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Rx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 16 - 6 - 2024\smss.exe
- Size 148KB
- SHA256 5b4c93cfade9937fb3594d0f78c52ff7c7bedd768332e8e82105aa3e560fdc9e
- MD5 c813d32649b134fef8ec8e7c7908317f
- SHA1 28bb106d506cb6f3bf99dd0a11d6779cb7366ba9
- SHA512 c276caecdc58c2a80fc25e9df447740b9dfd6072b8ae15902085dadae36ab7c01008953e6dfa6f7415fb3cfbc2bc36487f76b1f15fd121b5dadf5a2da6ce697a
- SSDEEP 1536:xJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:3x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\16-6-2024.exe
- Size 148KB
- SHA256 209d5b53b22a768e1fb2bdd40541c19a705f39a6c9f11e8a998e70f08f8a2914
- MD5 f4c77bcadae5b419f5f383a834c7e3d5
- SHA1 8587961ac1836c26891532664681438dfc24e858
- SHA512 b977687932d57108cefa1181b0a5eb8573f4ab101006acac126af11b0bed926f81f8bb9c7d8271767a175f1e33eb3000863b8d64f3fbc8dbc543592cfdcabcda
- SSDEEP 1536:lJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:jx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\16-6-2024.exe
- Size 148KB
- SHA256 92ec6098d53632fb019379474316ad15ebd1bd77c3e603a56d456b06b91b27d9
- MD5 c1a89335f9425c8c30622722537053a9
- SHA1 2da2880d6850860e83c1c1991151e93ba5d451c3
- SHA512 0aa9c140667c353be625352170025d7b22d04de6b130c57e99c7991baaa522866024dadd5a8efcff9b6c17eb47ccd3b20e225578cabc695027e9c2e559e79b26
- SSDEEP 1536:8Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Yx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\16-6-2024.exe
- Size 148KB
- SHA256 8f1800a0f32cf42244efb8144845b8f1791bdc4bc515fc5699a9da51395fd554
- MD5 6761e41f774faa5fa02e0a1cd6740f0b
- SHA1 4eca2a7422e65e208cf7c2dcebd5f71905de5195
- SHA512 d46cbb7a7768dc3227f0a8c6dd1eee510b03742b8f3ee58ccc60d0f4f07738a5fcb86d09d6bd272598bc914ebd99afa5132fd7aeac682ecddc1bf170f329c98f
- SSDEEP 1536:QJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:kx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\16-6-2024.exe
- Size 148KB
- SHA256 855999396dcf7e6178926cb1619c66447524cef5d10e2b2654af7096393769f0
- MD5 1b394df82645b4b52e58d7ce428adaf9
- SHA1 6c61d649f820dc2d9b636f2708e1d0fb0f596cd2
- SHA512 e6c9d5152314ba9eff96f4c72570e9690346cc9dcb902b5514b8adbee57273e0aad2f86c4d4e62412b3a2b56c71cb48775e56b61c542cb3680c0a4b05396039f
- SSDEEP 1536:yJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:qx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\16-6-2024.exe
- Size 148KB
- SHA256 feef422b347cb55b2f9522fc87ecb0725c779764cd29ab740f1a4b3a30bc65cb
- MD5 c740a4b8e9ea0789470bdcbe837837c4
- SHA1 330a8594af290ca1ad731a0ee783f30b9d12feba
- SHA512 42652ab0c4fe0897a6a2edaa02a113ec9670f6706dfa5e352ecb145bfa5ed8834c16fb9cc13e7f928259f1e81cc8f6b61b96223df2d96ddcdbf0914ca923fd3c
- SSDEEP 1536:NJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:7x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 18bc880e6e7d28e31844bab3c8e2e357aae3aa7545d6511337ccb610954d37d5
- MD5 41b1b8bcf64e2f32aa90b688df67a60f
- SHA1 0ea50ec2f4be5240f16ff8c7fc22417207f5632e
- SHA512 bf3835d73ecee42e262e15cb02f3e5ce1109cc5ec999edee9ba94c13e0497b57e2ef9593ae6588cc26f4daac6661cfb6bf74dae5573d1a43039fdbe1a047161f
- SSDEEP 1536:tJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:bx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 1ec68c920e287011bdda4da8f0e909cf478f373032b46f60a3c4cdc1b863143a
- MD5 00d0ca5239c687ed7461dab1b352964b
- SHA1 d0589f85338890b019f762562dc61cc8dd7d679e
- SHA512 445bbadd679a1aa26ec97c6e700e5ec1e99b8cab36eca8d46d587f11bc01634a04769b7f812c55cf279a813a1172dc57fddbab36d77458ff77fd1a192533751c
- SSDEEP 1536:YJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:8x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 148KB
- SHA256 d63009a1ae1a19a73c0079a37d82768cb94b2b113b2933d911f5e633fcf13340
- MD5 cfe806a9b1f57eabfc02ce6e62b252e9
- SHA1 3393880f174b11178d0a57369d355acfe71200b6
- SHA512 fde367a0d0583596f4739b870bbe87f62a036cc3bc9fe3dde80436729a0af5f8fd3ec100e19dee9dd2300a2fbf22c29dc04bb2771b659fcddd3b3aa9db439d8a
- SSDEEP 1536:1Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:zx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 698cf475c290346cea50c85775dbaa56a09eb224b0e4fa220217e0bdf0aac1cf
- MD5 01f4581097f8aa29ccb6577b3ebf737d
- SHA1 52580113973ff3e58b13edab528d147938ee0151
- SHA512 1748976a46348548f988ffb5628373823790dca0eb20bc2dc854b5fa7985a49884f5a1e832e3ec1418bb3bd0a1cec59c68c5ec4bbcfa05142cbd1fe9a89d9544
- SSDEEP 1536:xJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:3x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 2e18a6ab65d74ec5c19fc8734b771ae5d39dc2ecc14053d82e88e367f73ebc46
- MD5 0e4a7e86eceff523b2dd1b9bc083bfde
- SHA1 709650a7494f53a003fac3c68c021696784833be
- SHA512 0363170e81ae0869aa793fe56fc3b4b7c61c17c67fcff014df514a65c03d5a35998c96f699d169509a67266f8bc8e9d552f9c000e03a6cefe1f9b2cde58b31e8
- SSDEEP 1536:GJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:mx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 f94e6c578abf94a643a760c46047ccfdc5820f972ea51710c7e98d0211cc15bc
- MD5 b9be7ffeff74f3d9f81602283eee1922
- SHA1 9e242a496e030bfa591bafc058b2d8bde20f48d8
- SHA512 6aed1a3895ac2753256f29ff74e572bae80c96745e76fef2388bcebc46e9ea043b7b716c98baa93b51f0d93d7ff623d926593f674bdd02224b39c385925bee58
- SSDEEP 1536:8Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Yx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 148KB
- SHA256 9586b27b7a196594fbd696685e42f3bfe96118f5a6835172392deaead227a786
- MD5 dad39086b0721371423c7c323b6a4746
- SHA1 fcc67f46f98b4cd3e1c9364edec78a0682925e37
- SHA512 8afbb05b8be4d6d50abb243d054c7f1d8f060f448eca9b1d1eb4e7468a0dcaca6c03f7d116b915d728a522571863dbe3ff4254e0a678b66d1235703210bbc3e2
- SSDEEP 1536:JJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:/x6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Admin Games\Hokage-Sampit (Nothing).exe
- Size 148KB
- SHA256 eaa228f97b6af94b44ddb7904003b1d1c429d9dca50db979efb9f5e58fb2fa22
- MD5 fab7116a5f3d14f7416f5e649676ceed
- SHA1 d8193a5d5fdd3ce9f5774fef50129b2ea38d2848
- SHA512 755ce04291a0a4c8656e5971c4ad9df728feab9580e26ab34b038a84abb66f8d477e5e4e246c9e59914ac514ed5f44d48c74c38765944126490f203db09c29eb
- SSDEEP 1536:/Jo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:Rx6AHjYzaFXg+w17jsgS/jHagQg19V
- MD5 SHA1 SHA512 SSDEEP