Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 18:52
Behavioral task
behavioral1
Sample
11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe
Resource
win7-20241010-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe
- Size 236KB
- Sample241018-xh7bbasgpf
- SHA256 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb
- MD5 a163adaf62ac40d7e39307a506f11e4e
- SHA1 e9ff377ddf98b6dada91d908cfbd30c218f6b030
- SHA512 1f690e9c3958f7091fec859fd6b95b0c1a3f97aa78a389814e603e0ab43597ef9bd72479f671c9027e6f3d67cfff033ce70b767ba3f76122f1cd88fd565ae098
- SSDEEP 3072:ZBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:ZBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\SysWOW64\drivers\system32.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe - Executes dropped EXE 30 IoCs
pid Process 1612 smss.exe 5032 smss.exe 4100 Gaara.exe 1352 smss.exe 2204 Gaara.exe 412 csrss.exe 2476 smss.exe 1584 Gaara.exe 656 csrss.exe 4640 Kazekage.exe 1756 smss.exe 4088 Gaara.exe 3112 csrss.exe 4500 Kazekage.exe 1728 system32.exe 4920 smss.exe 4340 Gaara.exe 4756 csrss.exe 1304 Kazekage.exe 1868 system32.exe 404 system32.exe 3048 Kazekage.exe 3356 system32.exe 2216 csrss.exe 1808 Kazekage.exe 628 system32.exe 3280 Gaara.exe 4292 csrss.exe 4776 Kazekage.exe 2140 system32.exe - Loads dropped DLL 18 IoCs
pid Process 1612 smss.exe 5032 smss.exe 4100 Gaara.exe 1352 smss.exe 2204 Gaara.exe 412 csrss.exe 2476 smss.exe 1584 Gaara.exe 656 csrss.exe 1756 smss.exe 4088 Gaara.exe 3112 csrss.exe 4920 smss.exe 4340 Gaara.exe 4756 csrss.exe 2216 csrss.exe 3280 Gaara.exe 4292 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "18-10-2024.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 18 - 10 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 18 - 10 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\O:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini csrss.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\X:\Desktop.ini Kazekage.exe File opened for modification \??\E:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\Q:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\S:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini smss.exe File opened for modification \??\A:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\T:\Desktop.ini Kazekage.exe File opened for modification \??\K:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\B:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\X:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\K:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\P:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\T:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\N:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini Kazekage.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\J:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\T:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini system32.exe File opened for modification \??\I:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini system32.exe File opened for modification \??\N:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\Y:\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification \??\H:\Desktop.ini Gaara.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\K: Kazekage.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\B: Kazekage.exe File opened (read-only) \??\G: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\H: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\I: smss.exe File opened (read-only) \??\Q: smss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\O: system32.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\J: system32.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\V: Kazekage.exe File opened (read-only) \??\E: system32.exe File opened (read-only) \??\L: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\N: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\V: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\S: smss.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\U: system32.exe File opened (read-only) \??\Z: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\A: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\P: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\S: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\O: Gaara.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\O: 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\A: Kazekage.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\R: Kazekage.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\J:\Autorun.inf smss.exe File created D:\Autorun.inf Gaara.exe File created F:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\Y:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\A:\Autorun.inf smss.exe File opened for modification \??\S:\Autorun.inf Gaara.exe File opened for modification C:\Autorun.inf Gaara.exe File opened for modification \??\M:\Autorun.inf csrss.exe File created \??\O:\Autorun.inf csrss.exe File opened for modification \??\X:\Autorun.inf csrss.exe File opened for modification \??\O:\Autorun.inf system32.exe File opened for modification D:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\W:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created \??\K:\Autorun.inf smss.exe File opened for modification \??\E:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf Kazekage.exe File opened for modification \??\R:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification D:\Autorun.inf smss.exe File opened for modification \??\V:\Autorun.inf Gaara.exe File opened for modification \??\L:\Autorun.inf csrss.exe File opened for modification \??\S:\Autorun.inf smss.exe File created \??\Z:\Autorun.inf smss.exe File opened for modification F:\Autorun.inf smss.exe File created \??\V:\Autorun.inf smss.exe File opened for modification \??\Y:\Autorun.inf smss.exe File created \??\L:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf Kazekage.exe File opened for modification \??\N:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\X:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created \??\M:\Autorun.inf system32.exe File created \??\N:\Autorun.inf csrss.exe File created \??\Q:\Autorun.inf Kazekage.exe File opened for modification \??\M:\Autorun.inf smss.exe File opened for modification \??\G:\Autorun.inf csrss.exe File opened for modification \??\K:\Autorun.inf Gaara.exe File opened for modification \??\Q:\Autorun.inf system32.exe File opened for modification \??\W:\Autorun.inf system32.exe File created \??\Z:\Autorun.inf system32.exe File opened for modification \??\Z:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\T:\Autorun.inf smss.exe File created \??\U:\Autorun.inf smss.exe File created \??\L:\Autorun.inf Kazekage.exe File created \??\N:\Autorun.inf Kazekage.exe File opened for modification \??\Z:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\H:\Autorun.inf Gaara.exe File created \??\A:\Autorun.inf Kazekage.exe File created \??\P:\Autorun.inf system32.exe File created \??\G:\Autorun.inf Gaara.exe File created \??\T:\Autorun.inf Gaara.exe File created \??\B:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf Gaara.exe File opened for modification \??\P:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created \??\Y:\Autorun.inf 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification \??\N:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf csrss.exe File created \??\B:\Autorun.inf csrss.exe File opened for modification \??\N:\Autorun.inf csrss.exe File opened for modification \??\H:\Autorun.inf Kazekage.exe File opened for modification \??\E:\Autorun.inf system32.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\SysWOW64\Desktop.ini 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe system32.exe File created C:\Windows\SysWOW64\mscomctl.ocx 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\ 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File created C:\Windows\SysWOW64\18-10-2024.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe smss.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\18-10-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe -
resource yara_rule behavioral2/memory/3840-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023c75-12.dat upx behavioral2/files/0x0007000000023c73-31.dat upx behavioral2/memory/1612-34-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5032-70-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023c77-53.dat upx behavioral2/files/0x0007000000023c74-41.dat upx behavioral2/memory/4100-75-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/5032-80-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023c75-84.dat upx behavioral2/files/0x0007000000023c78-96.dat upx behavioral2/files/0x0007000000023c77-92.dat upx behavioral2/files/0x0007000000023c76-88.dat upx behavioral2/memory/1352-113-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2204-117-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/412-119-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023c78-135.dat upx behavioral2/files/0x0007000000023c77-131.dat upx behavioral2/files/0x0007000000023c76-127.dat upx behavioral2/memory/1584-156-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/656-157-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3840-162-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4640-164-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/656-163-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023c76-171.dat upx behavioral2/files/0x0007000000023c78-175.dat upx behavioral2/memory/1612-188-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4088-193-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4100-198-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4088-199-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4500-203-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3112-204-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4500-207-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1728-210-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/412-229-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4920-232-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4340-236-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4756-238-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1304-242-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4640-241-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1868-245-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/404-248-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3048-254-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3356-255-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1728-258-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2216-259-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1808-262-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/628-265-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3280-268-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4292-271-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2140-275-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4776-274-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2140-278-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/files/0x0007000000023ca5-455.dat upx - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\mscoree.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\ csrss.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe csrss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\msvbvm60.dll system32.exe File opened for modification C:\Windows\system\mscoree.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe system32.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\ smss.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\system\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg csrss.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe Kazekage.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File opened for modification C:\Windows\mscomctl.ocx 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\ 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\Fonts\The Kazekage.jpg 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File created C:\Windows\Fonts\Admin 18 - 10 - 2024\msvbvm60.dll 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg system32.exe File opened for modification C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4080 ping.exe 2844 ping.exe 3204 ping.exe 3752 ping.exe 1768 ping.exe 4692 ping.exe 1724 ping.exe 4944 ping.exe 1520 ping.exe 1208 ping.exe 4968 ping.exe 4368 ping.exe 1508 ping.exe 2580 ping.exe 5012 ping.exe 3960 ping.exe 4080 ping.exe 4432 ping.exe 4912 ping.exe 1856 ping.exe 2888 ping.exe 2032 ping.exe 3156 ping.exe 4008 ping.exe 3356 ping.exe 3784 ping.exe 4416 ping.exe 2476 ping.exe 3408 ping.exe 3120 ping.exe 3068 ping.exe 5040 ping.exe 4552 ping.exe 2840 ping.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Size = "72" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Screen Saver.Marquee Kazekage.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main system32.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe - Runs ping.exe 1 TTPs 34 IoCs
pid Process 3784 ping.exe 4080 ping.exe 1208 ping.exe 2888 ping.exe 5040 ping.exe 4416 ping.exe 2840 ping.exe 1520 ping.exe 3960 ping.exe 2580 ping.exe 5012 ping.exe 2032 ping.exe 4080 ping.exe 1856 ping.exe 3204 ping.exe 4552 ping.exe 4912 ping.exe 3068 ping.exe 1724 ping.exe 2844 ping.exe 3156 ping.exe 4968 ping.exe 3356 ping.exe 3752 ping.exe 3120 ping.exe 4368 ping.exe 3408 ping.exe 4008 ping.exe 2476 ping.exe 4944 ping.exe 1508 ping.exe 4432 ping.exe 1768 ping.exe 4692 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 1612 smss.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 4100 Gaara.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe 412 csrss.exe - Suspicious use of SetWindowsHookEx 30 IoCs
pid Process 3840 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe 1612 smss.exe 5032 smss.exe 4100 Gaara.exe 1352 smss.exe 2204 Gaara.exe 412 csrss.exe 2476 smss.exe 1584 Gaara.exe 656 csrss.exe 4640 Kazekage.exe 1756 smss.exe 4088 Gaara.exe 3112 csrss.exe 4500 Kazekage.exe 1728 system32.exe 4920 smss.exe 4340 Gaara.exe 4756 csrss.exe 1304 Kazekage.exe 1868 system32.exe 404 system32.exe 3048 Kazekage.exe 2216 csrss.exe 1808 Kazekage.exe 628 system32.exe 3280 Gaara.exe 4292 csrss.exe 4776 Kazekage.exe 2140 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3840 wrote to memory of 1612 3840 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe 86 PID 3840 wrote to memory of 1612 3840 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe 86 PID 3840 wrote to memory of 1612 3840 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe 86 PID 1612 wrote to memory of 5032 1612 smss.exe 87 PID 1612 wrote to memory of 5032 1612 smss.exe 87 PID 1612 wrote to memory of 5032 1612 smss.exe 87 PID 1612 wrote to memory of 4100 1612 smss.exe 88 PID 1612 wrote to memory of 4100 1612 smss.exe 88 PID 1612 wrote to memory of 4100 1612 smss.exe 88 PID 4100 wrote to memory of 1352 4100 Gaara.exe 89 PID 4100 wrote to memory of 1352 4100 Gaara.exe 89 PID 4100 wrote to memory of 1352 4100 Gaara.exe 89 PID 4100 wrote to memory of 2204 4100 Gaara.exe 91 PID 4100 wrote to memory of 2204 4100 Gaara.exe 91 PID 4100 wrote to memory of 2204 4100 Gaara.exe 91 PID 4100 wrote to memory of 412 4100 Gaara.exe 92 PID 4100 wrote to memory of 412 4100 Gaara.exe 92 PID 4100 wrote to memory of 412 4100 Gaara.exe 92 PID 412 wrote to memory of 2476 412 csrss.exe 93 PID 412 wrote to memory of 2476 412 csrss.exe 93 PID 412 wrote to memory of 2476 412 csrss.exe 93 PID 412 wrote to memory of 1584 412 csrss.exe 94 PID 412 wrote to memory of 1584 412 csrss.exe 94 PID 412 wrote to memory of 1584 412 csrss.exe 94 PID 412 wrote to memory of 656 412 csrss.exe 95 PID 412 wrote to memory of 656 412 csrss.exe 95 PID 412 wrote to memory of 656 412 csrss.exe 95 PID 412 wrote to memory of 4640 412 csrss.exe 96 PID 412 wrote to memory of 4640 412 csrss.exe 96 PID 412 wrote to memory of 4640 412 csrss.exe 96 PID 4640 wrote to memory of 1756 4640 Kazekage.exe 97 PID 4640 wrote to memory of 1756 4640 Kazekage.exe 97 PID 4640 wrote to memory of 1756 4640 Kazekage.exe 97 PID 4640 wrote to memory of 4088 4640 Kazekage.exe 98 PID 4640 wrote to memory of 4088 4640 Kazekage.exe 98 PID 4640 wrote to memory of 4088 4640 Kazekage.exe 98 PID 4640 wrote to memory of 3112 4640 Kazekage.exe 99 PID 4640 wrote to memory of 3112 4640 Kazekage.exe 99 PID 4640 wrote to memory of 3112 4640 Kazekage.exe 99 PID 4640 wrote to memory of 4500 4640 Kazekage.exe 100 PID 4640 wrote to memory of 4500 4640 Kazekage.exe 100 PID 4640 wrote to memory of 4500 4640 Kazekage.exe 100 PID 4640 wrote to memory of 1728 4640 Kazekage.exe 101 PID 4640 wrote to memory of 1728 4640 Kazekage.exe 101 PID 4640 wrote to memory of 1728 4640 Kazekage.exe 101 PID 1728 wrote to memory of 4920 1728 system32.exe 102 PID 1728 wrote to memory of 4920 1728 system32.exe 102 PID 1728 wrote to memory of 4920 1728 system32.exe 102 PID 1728 wrote to memory of 4340 1728 system32.exe 103 PID 1728 wrote to memory of 4340 1728 system32.exe 103 PID 1728 wrote to memory of 4340 1728 system32.exe 103 PID 1728 wrote to memory of 4756 1728 system32.exe 104 PID 1728 wrote to memory of 4756 1728 system32.exe 104 PID 1728 wrote to memory of 4756 1728 system32.exe 104 PID 1728 wrote to memory of 1304 1728 system32.exe 105 PID 1728 wrote to memory of 1304 1728 system32.exe 105 PID 1728 wrote to memory of 1304 1728 system32.exe 105 PID 1728 wrote to memory of 1868 1728 system32.exe 106 PID 1728 wrote to memory of 1868 1728 system32.exe 106 PID 1728 wrote to memory of 1868 1728 system32.exe 106 PID 412 wrote to memory of 404 412 csrss.exe 107 PID 412 wrote to memory of 404 412 csrss.exe 107 PID 412 wrote to memory of 404 412 csrss.exe 107 PID 4100 wrote to memory of 3048 4100 Gaara.exe 108 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe"C:\Users\Admin\AppData\Local\Temp\11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3840 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1612 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5032
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4100 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:412 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:656
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4640 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4088
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4500
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1728 -
C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4340
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4756
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4368
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3068
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4080
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1724
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4008
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3752
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3120
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3356
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3408
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3204
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:404
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4968
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2888
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4552
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4432
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2840
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3156
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1208
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4080
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4416
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2476
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4944
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1856
-
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2216
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1808
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4692
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3960
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3784
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2032
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4912
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2844
-
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3280
-
-
C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2140
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1768
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1520
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5040
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2580
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5012
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Kazekage VS Hokage.exe
- Size 236KB
- SHA256 affeae22984ae700474fbf368a142c8db24133a5254671105565f282ea126c3f
- MD5 d38877dbbcb917624191ac44d97ee790
- SHA1 c12e10f6f8a4832c83d117de196422bd45cd3187
- SHA512 f84405655d05b22c00c678aa7da6c15e6a5ee7a95f24cbb280bf207a2b1dcfa765a6e044cff53cd4917cde3f03f5284d50e569957f8371c3ee46ed2742a6c213
- SSDEEP 3072:RBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:RBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 18 - 10 - 2024\Gaara.exe
- Size 236KB
- SHA256 96df11cbd197aae33275408872d634a798e3c3fcf35dbc046357e9dd93be4cd8
- MD5 27892b9514e49c37675e51a3eb1cca8f
- SHA1 6c0ce69e82a166cb1bb37f9496495860f3e5d9d3
- SHA512 c1c3a549c92d21cb349d990e8dc1b91ae13905f672a629f9b45d81b26381720472e793d772b3b96cec6207026795890149d4c07cd6307ca62a78a5bc23718e64
- SSDEEP 3072:EBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:EBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe
- Size 236KB
- SHA256 11caa3e563dfc36bc1de13a586d6470322a1adac71d462d3a681c279269d13cb
- MD5 a163adaf62ac40d7e39307a506f11e4e
- SHA1 e9ff377ddf98b6dada91d908cfbd30c218f6b030
- SHA512 1f690e9c3958f7091fec859fd6b95b0c1a3f97aa78a389814e603e0ab43597ef9bd72479f671c9027e6f3d67cfff033ce70b767ba3f76122f1cd88fd565ae098
- SSDEEP 3072:ZBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:ZBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 18 - 10 - 2024\csrss.exe
- Size 236KB
- SHA256 fb1c20865873beaf00bd45ef7986fdfda4248717c46e2c9f484165dc1579ebe3
- MD5 6d14bec162daad10915784f28aee73f9
- SHA1 6299a97e60e6ac93d273351e39e62c0500e264db
- SHA512 f5322d440bae3adaa0e7c7e02f937221de4714ff4c84b90314886866ec1dcc47164909b19e3b381b10a10281bf20d267f9df1717260d00c357a53c93c63ff932
- SSDEEP 3072:2Bx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:2BxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 18 - 10 - 2024\smss.exe
- Size 236KB
- SHA256 d3b9c448309cf0fc5a9083df56d335e892673c68d306ed7623c638774124cdbf
- MD5 7dc644cdf5e482e2ec36cf062ddae5b8
- SHA1 ea65859552c0e1407d55ce8af1e2ce908eeecbe3
- SHA512 0833b201aa345596cdca206cd2967825920b04068e981f6532da2a00f7e12b79a21568b2b64f7af8f5adfc78691f4fc19305f5aa8d9a47e7a07fab467603776b
- SSDEEP 3072:6Bx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:6BxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 64KB
- SHA256 2f1e8342eb4b9a7a44c95bb730fafd4edafb36eeb8b81a2201ef509ab5d0ee2b
- MD5 39f79bb9bde0ce5a8e10f200d947be82
- SHA1 ca9c386f064ca1ed15b1dd68c51f0ecfd6342e6d
- SHA512 d69b3f8a4f11ad9c5ddcb5633195cccc5c9f303531e0ec97ca7c78b47bf2413e00b2f4e72f49b9265e828d4d5d3582573b169876148b5af72f6cfd6783e3e7f8
- SSDEEP 6:BSlSf4UUUUUUUUUUUUUUUUUUUUUUUUUUN:wcO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\18-10-2024.exe
- Size 236KB
- SHA256 a79a2a61ad7d4eeebe5d550a6213cedc06ebcdef57d2051f5fcc1308ab6d6855
- MD5 93b4cb960b5349f7f5440070f2f16beb
- SHA1 f978b82e786bbd527bfc9df2460c5646880eaa4a
- SHA512 9de8936a4665c34f536f8642b8cd1f91c67ae96136102d13fa6f637baa77199c141d5eeb6d41f1052643e2dc7e905cd1109e08165e26a700fafd9aa7e247cd32
- SSDEEP 3072:bBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:bBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\18-10-2024.exe
- Size 236KB
- SHA256 b9dd562385f73c1e94b70f5b0d60e37704c8b30bc1f94d5d31fb0a525b6fee5d
- MD5 f5456229cae42e7a78c94349fdcd4fe7
- SHA1 d3b6959d126980bae6666b26aba8efb9dcd3f5f9
- SHA512 ecbf19cd2ceeeb5c3f9dee04046d0208be9a8767fb730f761c0af8433ef53bf393e965f680319546a8c0da9e25547980425afdc081a31ab39a4c3c760a866c02
- SSDEEP 3072:hBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:hBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\18-10-2024.exe
- Size 236KB
- SHA256 8b8a4e73e8a911d3dedee0db50213606bbe12595868610a9a849c9f0f02b04a2
- MD5 a7cfa21f28025e22669a6fa0c3bd38c7
- SHA1 b05d3864a472fb3a8f10b7b62172266d507d19f1
- SHA512 74d294929c0b31568db0fbd8e9e8ee86bf08228dee48bb206501623441def55b89ba5a557b9898194a44622c0ca2312fbec112cbaf401461e8870bc071802999
- SSDEEP 3072:sBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:sBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 e14f53ab9e8a12ec1f65f2a164b5996dcfc821b0d1d1a0f8cdf726b7cee22157
- MD5 3b8ea495b40fb8435188f88b1c21c055
- SHA1 daa66ac93fdfa13a0a3541ab83123744b00ba644
- SHA512 8b0eacc5da443a605696a562d2fe29f15e63c5b22c61bbce84415cf553fa5518b64eefc2e598f7553f4df305af9331872ef51d42584eccb3e866eae2cf894a09
- SSDEEP 3072:TBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:TBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 f3217bbc8009f76bcbd213059046b916db2e8edb7c389d71a801ba540a939126
- MD5 edf6016451f7141ceab82c90b88fa8be
- SHA1 f7cc8b78fc8e5b3fa6d251a5c77ac9be82aadb1c
- SHA512 9658bccf64252fabd9d574b57170dcb9c8459c984d62a2ff970b98762580e778cf363de91b0acc554e7903916c14080bf05a75b66dea39af9d1ba8fb29564273
- SSDEEP 3072:BBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:BBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 236KB
- SHA256 8de30ef13f9a9ea5d60b76fba7a6029f2c58620f5512e3ec61a9c55c29c405e7
- MD5 cb1af052b6479f4e6d52ec103a4ee65b
- SHA1 36bee0f591cbcd7ccc40f1f9323c992f81905d86
- SHA512 1f0647644c50cfbe6e5d671764f80da64b983b831ef5f5e89ddb5712020709927a76f348ab77950eb0aa2e37de2e359a62c3433e9415f5ce57b26e20cc58e2c2
- SSDEEP 3072:wBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:wBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 27a300464883258d51a37c9d15f86bd06ab11a01d693de32606ad3255b467e1f
- MD5 66eb70d045b441731d3081089eeacdfb
- SHA1 0c567c7e3f37884bef876325173f4427bef8b3e5
- SHA512 2e3762ae0c2d89d9ed97556d0a7f8e0b6ccf66b818c2a5e2c63c6d84512774dac13606cc8d58eccd8cb93a5371805d404f662033e2cb4e23c10c0da281c98757
- SSDEEP 3072:/Bx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:/BxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 651f547b0c5ae62d3e2f53cfdd4241045ffddd16a0aa1ec1bad191437a2f9b30
- MD5 00a6d4ba0b5dbc6a6de37e124ebb691b
- SHA1 2132051fd47a5cd2092b1fb18d60b738ca7b7099
- SHA512 e0115eb8dcd9f55abc3038092e2c672aee70f599f8b0c27fc1c256ef2e0f78a9e38d051218d913291861b1b3c0d4592c3e23c44e3ab6226967273db0208af3e7
- SSDEEP 3072:5Bx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:5BxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 236KB
- SHA256 05265ce9f0dd00aaae0f53e9dd5533c036a95d4755267dbfac3d5054e8a9e77b
- MD5 f2189d65420b3ec1bae468e1a65203e5
- SHA1 765616dc4e572b94ac4e600e5b679949425568fd
- SHA512 a4be867fb5ec4202a6caf4d73169dd86247b2a91701488f4b8b2da5e7e706a44611f88549de3ee7671136c9c59b11b17d07c48e9a36d684fbd57cd7ee4c20f99
- SSDEEP 3072:sBx6AHjYzaFXg+w17jsgS/jHagQg19Vlnhfxu:sBxzYzaFXi17jklh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP