Overview

overview

10

Static

static

3

9469e78f40...0N.exe

windows7-x64

10

9469e78f40...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 22:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9469e78f405795ec4c02ce5d9b479bf0N.exe

  • Size

    148KB

  • MD5

    9469e78f405795ec4c02ce5d9b479bf0

  • SHA1

    fda420f07893db4e065b7249fb7e9d16a72e53ea

  • SHA256

    22bbdb6b0fe902df3383ccf29d6047c5f104036316e67d5fd6adc82b68a99a0f

  • SHA512

    4774c113756f0a7ff363a0b0bfdf865e5b627a404844907a6ea147878506a6d27237e221139ed240089191a3896baa717ba79b9c8d33e18f787d08a254884416

  • SSDEEP

    1536:IJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:sx6AHjYzaFXg+w17jsgS/jHagQg19V

Score
10/10
discoveryevasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Drops file in Drivers directory 24 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 64 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 6 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Runs ping.exe 1 TTPs 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9469e78f405795ec4c02ce5d9b479bf0N.exe
    "C:\Users\Admin\AppData\Local\Temp\9469e78f405795ec4c02ce5d9b479bf0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2308
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2428
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2876
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2724
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:916
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2620
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Sets desktop wallpaper using registry
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1640
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:544
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:776
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2976
          • C:\Windows\SysWOW64\drivers\Kazekage.exe
            C:\Windows\system32\drivers\Kazekage.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in System32 directory
            • Sets desktop wallpaper using registry
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2168
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:408
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2016
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:348
            • C:\Windows\SysWOW64\drivers\Kazekage.exe
              C:\Windows\system32\drivers\Kazekage.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1248
            • C:\Windows\SysWOW64\drivers\system32.exe
              C:\Windows\system32\drivers\system32.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Drops file in Drivers directory
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops desktop.ini file(s)
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Sets desktop wallpaper using registry
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1732
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1944
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1508
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:908
              • C:\Windows\SysWOW64\drivers\Kazekage.exe
                C:\Windows\system32\drivers\Kazekage.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:660
              • C:\Windows\SysWOW64\drivers\system32.exe
                C:\Windows\system32\drivers\system32.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2076
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2028
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2484
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3056
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2228
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.rasasayang.com.my 65500
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2100
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.duniasex.com 65500
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2268
          • C:\Windows\SysWOW64\drivers\system32.exe
            C:\Windows\system32\drivers\system32.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2268
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.rasasayang.com.my 65500
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:884
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.duniasex.com 65500
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2500
        • C:\Windows\SysWOW64\drivers\Kazekage.exe
          C:\Windows\system32\drivers\Kazekage.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1532
        • C:\Windows\SysWOW64\drivers\system32.exe
          C:\Windows\system32\drivers\system32.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:340
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1088
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:680
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2484
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1756
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Windows\SysWOW64\drivers\Kazekage.exe
        C:\Windows\system32\drivers\Kazekage.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Windows\SysWOW64\drivers\system32.exe
        C:\Windows\system32\drivers\system32.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2468
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2552
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1936
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:324
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2580
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2476
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1872
    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:888
    • C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1880
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2860
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2120
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2604
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2680

Network

  • flag-us
    DNS
    220.255.0.0.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    220.255.0.0.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    220.255.0.0.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    220.255.0.0.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    220.255.0.0.in-addr.arpa
    dns
    70 B
     138 B
     1
    1

    DNS Request

    220.255.0.0.in-addr.arpa

  • 8.8.8.8:53
    220.255.0.0.in-addr.arpa
    dns
    70 B
     138 B
     1
    1

    DNS Request

    220.255.0.0.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

8
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Admin Games\Gaara go to Kazekage.exe
    Filesize

    148KB

    MD5

    7a845c96057299dcecc6cb42ac6fc8d8

    SHA1

    81c14bb5604926ed4200d5b219f0cdb5a8095067

    SHA256

    c5cdd0db88bcc798b1e6d35f652e0a0357c300edf9967f64a5cdecc62d09f3fe

    SHA512

    aed2d6a67b630ccb5fa75772eb6969dada8b4c6e6fa019d9836dc891615da8977edb2f1a8dd215cca7d045259dfe7c4935487fe1294daeb8dde5b2913cc5ebde

    Download Submit

  • C:\Admin Games\Readme.txt
    Filesize

    736B

    MD5

    bb5d6abdf8d0948ac6895ce7fdfbc151

    SHA1

    9266b7a247a4685892197194d2b9b86c8f6dddbd

    SHA256

    5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

    SHA512

    878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

    Download Submit

  • C:\Autorun.inf
    Filesize

    196B

    MD5

    1564dfe69ffed40950e5cb644e0894d1

    SHA1

    201b6f7a01cc49bb698bea6d4945a082ed454ce4

    SHA256

    be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

    SHA512

    72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

    Download Submit

  • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
    Filesize

    148KB

    MD5

    9469e78f405795ec4c02ce5d9b479bf0

    SHA1

    fda420f07893db4e065b7249fb7e9d16a72e53ea

    SHA256

    22bbdb6b0fe902df3383ccf29d6047c5f104036316e67d5fd6adc82b68a99a0f

    SHA512

    4774c113756f0a7ff363a0b0bfdf865e5b627a404844907a6ea147878506a6d27237e221139ed240089191a3896baa717ba79b9c8d33e18f787d08a254884416

    Download Submit

  • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
    Filesize

    148KB

    MD5

    7520da5a2eecbb8d768b887a4f1ff2b2

    SHA1

    3227b03598645f3c09e68f6c121ce888d22b6bb7

    SHA256

    c72489fde86040dacf5b4604bd9f9c546f79696fa34b6ed168e3b87bab5e8914

    SHA512

    60bbda0d83fc83505752544baa4970cd2297d043f7b665a31e790a81d95921e3048a4fc2a2ec1b402cff79785de4b6898ec4b3fbf1e2137e676045b44f53917f

    Download Submit

  • C:\Windows\Fonts\The Kazekage.jpg
    Filesize

    1.4MB

    MD5

    d6b05020d4a0ec2a3a8b687099e335df

    SHA1

    df239d830ebcd1cde5c68c46a7b76dad49d415f4

    SHA256

    9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

    SHA512

    78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

    Download Submit

  • C:\Windows\SysWOW64\22-8-2024.exe
    Filesize

    148KB

    MD5

    62bc1b819fd20154545ecebe8af4ebcd

    SHA1

    83741131b28f6bfe406097845ba39e01a16c2920

    SHA256

    75884ed4e51cbda0fe63a93e458bd7f3b0244c975c304fca1dcfa7f52747ff9e

    SHA512

    5b0de39b6f2efb1d5d414b8278bc81375a70cf06612f4aebb89ea44eaab988590c0cfd14d9abf68030462aaddece1196ad7064b21e36ee14b144b13d58150c75

    Download Submit

  • C:\Windows\SysWOW64\22-8-2024.exe
    Filesize

    148KB

    MD5

    d4f514da35c945f62a257d73b1d5b8a4

    SHA1

    2c9732cbead72e0b51b616f6e500b04448d7fda4

    SHA256

    3329569e1f0f1ec4c5f514144ddef130c4fd2cb89d389a28e3f3d92f0b937416

    SHA512

    82600dceaacdc1ee85a0dcbd2ed6fb6178eadf82a163fca710238fbcd8a28b318cba9874d6273f8cfbaf4a6a5cc1294155b5540dae3430e8e370ba24b91f9c5e

    Download Submit

  • C:\Windows\SysWOW64\Desktop.ini
    Filesize

    65B

    MD5

    64acfa7e03b01f48294cf30d201a0026

    SHA1

    10facd995b38a095f30b4a800fa454c0bcbf8438

    SHA256

    ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

    SHA512

    65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

    Download Submit

  • C:\Windows\SysWOW64\MSCOMCTL.OCX
    Filesize

    148KB

    MD5

    85d07860f180f57b512bf0e29825c385

    SHA1

    d461d66789706c31848bb1f6d819645cc63f070a

    SHA256

    22058d2065eb58853d9d56e45dc4939f50b66b0bc25ff23f3a38a5f419696eb5

    SHA512

    dd3e1dcc309f1965d52c90d9b71e595aad15b87ee680187a9e38d375c999bf118823d51138aa91ece71667ad63ab2e780a7adfa1ed2b99764a3d48a6af11ddc9

    Download Submit

  • C:\Windows\SysWOW64\drivers\Kazekage.exe
    Filesize

    148KB

    MD5

    78fc08e192f644cc5763d006a9e3468b

    SHA1

    5be432c78a30cf2a30e4a5b7a57e194d891cf45a

    SHA256

    6c45ccb3261e4a513df2864246ab0130991c6086c4c863a57081e703947ffbcc

    SHA512

    9e6dcc2d708ef576508b39072b61130eb249581dd1532c1dcd4903e6513f09e09d91bfe750deee0f060bcfa840200d324761aa0f9b9ec30621bd0835c5e7dea5

    Download Submit

  • C:\Windows\SysWOW64\drivers\Kazekage.exe
    Filesize

    148KB

    MD5

    6fff853edfd603002c98005145fc9267

    SHA1

    ee6dc66660f1f195fa9100367aebedd6fe5c637f

    SHA256

    20f930b9d384608b6cccf953cdc4147fc2db2a699a720770c90652b136825917

    SHA512

    bcb1b1eac044f0600386e9b97544249c2d0ebc65f52a3e4b298609e0fc41b18ba10b841e64d6f478c32ca390de900096cfe807794352ba071270ff06100493d4

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    5adade984d44caed1dc21f3b4ca399e2

    SHA1

    753f75a6457b0006041ed9d6ab096261600ea2c7

    SHA256

    695926f0ab6ae659078b076be548f6583fc1d6f6430276705a97bb5fd6fe4f7f

    SHA512

    ef64b1dc6278a455bc3757b0ee07b9b7717d22f01bae70bc88539ee8bb36e6882d40fc1a217d970168f240c8a17e7ce4ae0d86a9621689d1ed83617a047e9355

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    91eef4b351ccad1722002bdaf4aa8501

    SHA1

    c874ad07a9ded195c1e596abb2b9b85b8d982d76

    SHA256

    63219ac218c3d7c0d3e14aade1ae875078434c41a446304f9eff31e061e3991f

    SHA512

    be971c97462640568f9651bea98d1ae8276733c0cd29aa87a484fb517c78833ef6b3c41dee2160b12c044ab4efbfc248f6fb0de5db0d5c7a1f2c1c47732a0cd2

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    4f75d47fb897056c0894583aca3220f2

    SHA1

    837aff5654c9f9a2907d318da75b7bf66e12d890

    SHA256

    6e2bc378a7db27f833e636e6b477970862217d7904d05e1cc6d94bf67fc1dafa

    SHA512

    f66770751a0d974baab163f30f54562f817d2a3e0cc990f7da8e456b277dea21889f0c3b1f3f21ec72eafce9f2a0831bb4d605cc93ee695596f6deccba91d319

    Download Submit

  • C:\Windows\mscomctl.ocx
    Filesize

    148KB

    MD5

    b4545fb59248a16e09a32ae2bad393bd

    SHA1

    ac872f7cecf7e0523e4e69dd98d96d9c904598cd

    SHA256

    3f5c3dc8f160a4ca242717fba196030f75c7bae1c9227eb46b88bdbf5c8231ad

    SHA512

    0f8fc3793748d0a2bc07e43eef841f6706de5b319c55d214f906d275bfb48caaa083e8320c523e1749cd742093f022b6c72caf9611745755ac93a95f15120f54

    Download Submit

  • C:\Windows\system\msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
    Filesize

    148KB

    MD5

    54b572e3864338b55fd00a2b8d75fe06

    SHA1

    00dbef5d52cec6883fec47e36697f405453089c9

    SHA256

    cdb1b0d979e90247ee55a62633b4c0c5358df5d13ec52b23e22a84508e580788

    SHA512

    d519123583be7bf431f9922c1083f6946e2257cd74759ae543efdfc6869d684b5a085a5ccbcce144ef32e2c22767403e5a9aa3814e979190889def95988b5739

    Download Submit

  • \Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
    Filesize

    148KB

    MD5

    4ca4d391cd91788045516a09bcf5b5de

    SHA1

    75829041764a84bff14b9feef6ad9e8af0f9018e

    SHA256

    ff720ec4eadbcb78c62d531eeaeda25a17149f9be2a85b7e7ced37ad8b04483c

    SHA512

    4db7033d887ca5371cb6573258c5e32894f99c771e3fc73d0c8308fc9db4795f7f0b7c0e5a6764201d158d2c9dba5cf4fb557b1194ce884c3fe97ddac140168f

    Download Submit

  • memory/340-267-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/348-223-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/408-217-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/544-177-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/660-255-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/776-182-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/828-273-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/888-282-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/908-252-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/916-127-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1248-226-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1508-249-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1532-264-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-191-0x00000000003C0000-0x00000000003E5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-297-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-141-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1732-504-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1872-281-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1944-246-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2016-220-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2076-258-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2168-228-0x0000000000510000-0x0000000000535000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2168-298-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2268-261-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-291-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-31-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-625-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-285-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-505-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-292-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-293-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-74-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-86-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2476-278-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2620-133-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-88-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-294-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-295-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-296-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-129-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-121-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2876-79-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2964-270-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2976-188-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2976-185-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.