Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

9469e78f40...0N.exe

windows7-x64

10

9469e78f40...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9469e78f405795ec4c02ce5d9b479bf0N.exe

  • Size

    148KB

  • MD5

    9469e78f405795ec4c02ce5d9b479bf0

  • SHA1

    fda420f07893db4e065b7249fb7e9d16a72e53ea

  • SHA256

    22bbdb6b0fe902df3383ccf29d6047c5f104036316e67d5fd6adc82b68a99a0f

  • SHA512

    4774c113756f0a7ff363a0b0bfdf865e5b627a404844907a6ea147878506a6d27237e221139ed240089191a3896baa717ba79b9c8d33e18f787d08a254884416

  • SSDEEP

    1536:IJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeVTV:sx6AHjYzaFXg+w17jsgS/jHagQg19V

Score
10/10
discoveryevasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Drops file in Drivers directory 24 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 64 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 6 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Runs ping.exe 1 TTPs 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9469e78f405795ec4c02ce5d9b479bf0N.exe
    "C:\Users\Admin\AppData\Local\Temp\9469e78f405795ec4c02ce5d9b479bf0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2308
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2428
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2876
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2724
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:916
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2620
        • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
          "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Sets desktop wallpaper using registry
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1640
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:544
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:776
          • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
            "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2976
          • C:\Windows\SysWOW64\drivers\Kazekage.exe
            C:\Windows\system32\drivers\Kazekage.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in System32 directory
            • Sets desktop wallpaper using registry
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2168
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:408
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2016
            • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
              "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:348
            • C:\Windows\SysWOW64\drivers\Kazekage.exe
              C:\Windows\system32\drivers\Kazekage.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1248
            • C:\Windows\SysWOW64\drivers\system32.exe
              C:\Windows\system32\drivers\system32.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Drops file in Drivers directory
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops desktop.ini file(s)
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Sets desktop wallpaper using registry
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1732
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\smss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1944
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1508
              • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
                "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:908
              • C:\Windows\SysWOW64\drivers\Kazekage.exe
                C:\Windows\system32\drivers\Kazekage.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:660
              • C:\Windows\SysWOW64\drivers\system32.exe
                C:\Windows\system32\drivers\system32.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2076
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2028
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2484
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3056
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2228
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.rasasayang.com.my 65500
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2100
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.duniasex.com 65500
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2268
          • C:\Windows\SysWOW64\drivers\system32.exe
            C:\Windows\system32\drivers\system32.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2268
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.rasasayang.com.my 65500
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:884
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.duniasex.com 65500
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2500
        • C:\Windows\SysWOW64\drivers\Kazekage.exe
          C:\Windows\system32\drivers\Kazekage.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1532
        • C:\Windows\SysWOW64\drivers\system32.exe
          C:\Windows\system32\drivers\system32.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:340
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1088
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:680
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2484
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1756
      • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
        "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Windows\SysWOW64\drivers\Kazekage.exe
        C:\Windows\system32\drivers\Kazekage.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Windows\SysWOW64\drivers\system32.exe
        C:\Windows\system32\drivers\system32.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2468
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2552
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1936
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:324
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2580
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2476
    • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
      "C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1872
    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:888
    • C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1880
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2860
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2120
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2604
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

8
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Admin Games\Gaara go to Kazekage.exe
    Filesize

    148KB

    MD5

    7a845c96057299dcecc6cb42ac6fc8d8

    SHA1

    81c14bb5604926ed4200d5b219f0cdb5a8095067

    SHA256

    c5cdd0db88bcc798b1e6d35f652e0a0357c300edf9967f64a5cdecc62d09f3fe

    SHA512

    aed2d6a67b630ccb5fa75772eb6969dada8b4c6e6fa019d9836dc891615da8977edb2f1a8dd215cca7d045259dfe7c4935487fe1294daeb8dde5b2913cc5ebde

    Download Submit

  • C:\Admin Games\Readme.txt
    Filesize

    736B

    MD5

    bb5d6abdf8d0948ac6895ce7fdfbc151

    SHA1

    9266b7a247a4685892197194d2b9b86c8f6dddbd

    SHA256

    5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

    SHA512

    878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

    Download Submit

  • C:\Autorun.inf
    Filesize

    196B

    MD5

    1564dfe69ffed40950e5cb644e0894d1

    SHA1

    201b6f7a01cc49bb698bea6d4945a082ed454ce4

    SHA256

    be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

    SHA512

    72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

    Download Submit

  • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
    Filesize

    148KB

    MD5

    9469e78f405795ec4c02ce5d9b479bf0

    SHA1

    fda420f07893db4e065b7249fb7e9d16a72e53ea

    SHA256

    22bbdb6b0fe902df3383ccf29d6047c5f104036316e67d5fd6adc82b68a99a0f

    SHA512

    4774c113756f0a7ff363a0b0bfdf865e5b627a404844907a6ea147878506a6d27237e221139ed240089191a3896baa717ba79b9c8d33e18f787d08a254884416

    Download Submit

  • C:\Windows\Fonts\Admin 22 - 8 - 2024\csrss.exe
    Filesize

    148KB

    MD5

    7520da5a2eecbb8d768b887a4f1ff2b2

    SHA1

    3227b03598645f3c09e68f6c121ce888d22b6bb7

    SHA256

    c72489fde86040dacf5b4604bd9f9c546f79696fa34b6ed168e3b87bab5e8914

    SHA512

    60bbda0d83fc83505752544baa4970cd2297d043f7b665a31e790a81d95921e3048a4fc2a2ec1b402cff79785de4b6898ec4b3fbf1e2137e676045b44f53917f

    Download Submit

  • C:\Windows\Fonts\The Kazekage.jpg
    Filesize

    1.4MB

    MD5

    d6b05020d4a0ec2a3a8b687099e335df

    SHA1

    df239d830ebcd1cde5c68c46a7b76dad49d415f4

    SHA256

    9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

    SHA512

    78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

    Download Submit

  • C:\Windows\SysWOW64\22-8-2024.exe
    Filesize

    148KB

    MD5

    62bc1b819fd20154545ecebe8af4ebcd

    SHA1

    83741131b28f6bfe406097845ba39e01a16c2920

    SHA256

    75884ed4e51cbda0fe63a93e458bd7f3b0244c975c304fca1dcfa7f52747ff9e

    SHA512

    5b0de39b6f2efb1d5d414b8278bc81375a70cf06612f4aebb89ea44eaab988590c0cfd14d9abf68030462aaddece1196ad7064b21e36ee14b144b13d58150c75

    Download Submit

  • C:\Windows\SysWOW64\22-8-2024.exe
    Filesize

    148KB

    MD5

    d4f514da35c945f62a257d73b1d5b8a4

    SHA1

    2c9732cbead72e0b51b616f6e500b04448d7fda4

    SHA256

    3329569e1f0f1ec4c5f514144ddef130c4fd2cb89d389a28e3f3d92f0b937416

    SHA512

    82600dceaacdc1ee85a0dcbd2ed6fb6178eadf82a163fca710238fbcd8a28b318cba9874d6273f8cfbaf4a6a5cc1294155b5540dae3430e8e370ba24b91f9c5e

    Download Submit

  • C:\Windows\SysWOW64\Desktop.ini
    Filesize

    65B

    MD5

    64acfa7e03b01f48294cf30d201a0026

    SHA1

    10facd995b38a095f30b4a800fa454c0bcbf8438

    SHA256

    ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

    SHA512

    65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

    Download Submit

  • C:\Windows\SysWOW64\MSCOMCTL.OCX
    Filesize

    148KB

    MD5

    85d07860f180f57b512bf0e29825c385

    SHA1

    d461d66789706c31848bb1f6d819645cc63f070a

    SHA256

    22058d2065eb58853d9d56e45dc4939f50b66b0bc25ff23f3a38a5f419696eb5

    SHA512

    dd3e1dcc309f1965d52c90d9b71e595aad15b87ee680187a9e38d375c999bf118823d51138aa91ece71667ad63ab2e780a7adfa1ed2b99764a3d48a6af11ddc9

    Download Submit

  • C:\Windows\SysWOW64\drivers\Kazekage.exe
    Filesize

    148KB

    MD5

    78fc08e192f644cc5763d006a9e3468b

    SHA1

    5be432c78a30cf2a30e4a5b7a57e194d891cf45a

    SHA256

    6c45ccb3261e4a513df2864246ab0130991c6086c4c863a57081e703947ffbcc

    SHA512

    9e6dcc2d708ef576508b39072b61130eb249581dd1532c1dcd4903e6513f09e09d91bfe750deee0f060bcfa840200d324761aa0f9b9ec30621bd0835c5e7dea5

    Download Submit

  • C:\Windows\SysWOW64\drivers\Kazekage.exe
    Filesize

    148KB

    MD5

    6fff853edfd603002c98005145fc9267

    SHA1

    ee6dc66660f1f195fa9100367aebedd6fe5c637f

    SHA256

    20f930b9d384608b6cccf953cdc4147fc2db2a699a720770c90652b136825917

    SHA512

    bcb1b1eac044f0600386e9b97544249c2d0ebc65f52a3e4b298609e0fc41b18ba10b841e64d6f478c32ca390de900096cfe807794352ba071270ff06100493d4

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    5adade984d44caed1dc21f3b4ca399e2

    SHA1

    753f75a6457b0006041ed9d6ab096261600ea2c7

    SHA256

    695926f0ab6ae659078b076be548f6583fc1d6f6430276705a97bb5fd6fe4f7f

    SHA512

    ef64b1dc6278a455bc3757b0ee07b9b7717d22f01bae70bc88539ee8bb36e6882d40fc1a217d970168f240c8a17e7ce4ae0d86a9621689d1ed83617a047e9355

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    91eef4b351ccad1722002bdaf4aa8501

    SHA1

    c874ad07a9ded195c1e596abb2b9b85b8d982d76

    SHA256

    63219ac218c3d7c0d3e14aade1ae875078434c41a446304f9eff31e061e3991f

    SHA512

    be971c97462640568f9651bea98d1ae8276733c0cd29aa87a484fb517c78833ef6b3c41dee2160b12c044ab4efbfc248f6fb0de5db0d5c7a1f2c1c47732a0cd2

    Download Submit

  • C:\Windows\SysWOW64\drivers\system32.exe
    Filesize

    148KB

    MD5

    4f75d47fb897056c0894583aca3220f2

    SHA1

    837aff5654c9f9a2907d318da75b7bf66e12d890

    SHA256

    6e2bc378a7db27f833e636e6b477970862217d7904d05e1cc6d94bf67fc1dafa

    SHA512

    f66770751a0d974baab163f30f54562f817d2a3e0cc990f7da8e456b277dea21889f0c3b1f3f21ec72eafce9f2a0831bb4d605cc93ee695596f6deccba91d319

    Download Submit

  • C:\Windows\mscomctl.ocx
    Filesize

    148KB

    MD5

    b4545fb59248a16e09a32ae2bad393bd

    SHA1

    ac872f7cecf7e0523e4e69dd98d96d9c904598cd

    SHA256

    3f5c3dc8f160a4ca242717fba196030f75c7bae1c9227eb46b88bdbf5c8231ad

    SHA512

    0f8fc3793748d0a2bc07e43eef841f6706de5b319c55d214f906d275bfb48caaa083e8320c523e1749cd742093f022b6c72caf9611745755ac93a95f15120f54

    Download Submit

  • C:\Windows\system\msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \Windows\Fonts\Admin 22 - 8 - 2024\Gaara.exe
    Filesize

    148KB

    MD5

    54b572e3864338b55fd00a2b8d75fe06

    SHA1

    00dbef5d52cec6883fec47e36697f405453089c9

    SHA256

    cdb1b0d979e90247ee55a62633b4c0c5358df5d13ec52b23e22a84508e580788

    SHA512

    d519123583be7bf431f9922c1083f6946e2257cd74759ae543efdfc6869d684b5a085a5ccbcce144ef32e2c22767403e5a9aa3814e979190889def95988b5739

    Download Submit

  • \Windows\Fonts\Admin 22 - 8 - 2024\smss.exe
    Filesize

    148KB

    MD5

    4ca4d391cd91788045516a09bcf5b5de

    SHA1

    75829041764a84bff14b9feef6ad9e8af0f9018e

    SHA256

    ff720ec4eadbcb78c62d531eeaeda25a17149f9be2a85b7e7ced37ad8b04483c

    SHA512

    4db7033d887ca5371cb6573258c5e32894f99c771e3fc73d0c8308fc9db4795f7f0b7c0e5a6764201d158d2c9dba5cf4fb557b1194ce884c3fe97ddac140168f

    Download Submit

  • memory/340-267-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/348-223-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/408-217-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/544-177-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/660-255-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/776-182-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/828-273-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/888-282-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/908-252-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/916-127-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1248-226-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1508-249-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1532-264-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-191-0x00000000003C0000-0x00000000003E5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-297-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1640-141-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1732-504-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1872-281-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1944-246-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2016-220-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2076-258-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2168-228-0x0000000000510000-0x0000000000535000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2168-298-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2268-261-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-291-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-31-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-625-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-285-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2308-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-505-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-292-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-293-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-74-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2428-86-0x0000000000360000-0x0000000000385000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2476-278-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2620-133-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-88-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-294-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-295-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-296-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-129-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2724-121-0x00000000004B0000-0x00000000004D5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2876-79-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2964-270-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2976-188-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2976-185-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download