Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
23/10/2024, 00:38
Behavioral task
behavioral1
Sample
85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe
Resource
win7-20240903-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe
- Size 382KB
- Sample241023-ay2dnssbrf
- SHA256 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7
- MD5 7a5ead4a01a1b4db5f4d8d3625d8fea4
- SHA1 a3f2d943835cab39a06a07b09e947551a17b6fb7
- SHA512 5dea8c15acbd4119f26451ed7226546151af03259939bef78c96e112b641c5c9177e467aecedb4fee16b2267bd8754a1bf2a92d539ef9f72368774b8ee724219
- SSDEEP 6144:uVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:uVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\SysWOW64\drivers\system32.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe - Executes dropped EXE 30 IoCs
pid Process 748 smss.exe 2260 smss.exe 2072 Gaara.exe 1864 smss.exe 1324 Gaara.exe 1148 csrss.exe 2828 smss.exe 4936 Gaara.exe 932 csrss.exe 1504 Kazekage.exe 732 smss.exe 852 Gaara.exe 1216 csrss.exe 5028 Kazekage.exe 4424 system32.exe 4732 smss.exe 1800 Gaara.exe 4596 csrss.exe 3216 Kazekage.exe 3084 system32.exe 4204 system32.exe 1416 Kazekage.exe 428 system32.exe 3420 csrss.exe 5000 Kazekage.exe 2692 system32.exe 2012 Gaara.exe 1864 csrss.exe 3988 Kazekage.exe 3944 system32.exe - Loads dropped DLL 18 IoCs
pid Process 748 smss.exe 2260 smss.exe 2072 Gaara.exe 1864 smss.exe 1324 Gaara.exe 1148 csrss.exe 2828 smss.exe 4936 Gaara.exe 932 csrss.exe 732 smss.exe 852 Gaara.exe 1216 csrss.exe 4732 smss.exe 1800 Gaara.exe 4596 csrss.exe 3420 csrss.exe 2012 Gaara.exe 1864 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "23-10-2024.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 23 - 10 - 2024\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 23 - 10 - 2024\\Gaara.exe" smss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification F:\Desktop.ini csrss.exe File opened for modification F:\Desktop.ini Kazekage.exe File opened for modification \??\B:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini Gaara.exe File opened for modification \??\U:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini smss.exe File opened for modification \??\V:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini csrss.exe File opened for modification \??\H:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\G:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini csrss.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\K:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\L:\Desktop.ini Gaara.exe File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\L:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\O:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini Kazekage.exe File opened for modification \??\P:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini Kazekage.exe File opened for modification \??\U:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\M:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\N:\Desktop.ini Kazekage.exe File opened for modification \??\I:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini Kazekage.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\E:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini smss.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification \??\G:\Desktop.ini Kazekage.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini system32.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\W:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\I:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini system32.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification C:\Desktop.ini Kazekage.exe File opened for modification \??\G:\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\J: smss.exe File opened (read-only) \??\I: system32.exe File opened (read-only) \??\U: Gaara.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\E: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\A: system32.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\I: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\S: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\H: smss.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\W: system32.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\G: smss.exe File opened (read-only) \??\P: Gaara.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\U: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\Y: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\T: system32.exe File opened (read-only) \??\V: Gaara.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\Q: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\N: system32.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\T: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\Y: system32.exe File opened (read-only) \??\Y: Gaara.exe File opened (read-only) \??\P: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\Q: system32.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\B: Kazekage.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\V: smss.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\J: Kazekage.exe File opened (read-only) \??\L: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\N: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\H: Kazekage.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\Y: smss.exe File opened (read-only) \??\T: smss.exe File opened (read-only) \??\M: Gaara.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\M: system32.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\M: smss.exe File opened (read-only) \??\X: 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\V: system32.exe File opened (read-only) \??\L: Gaara.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\L:\Autorun.inf system32.exe File created \??\P:\Autorun.inf system32.exe File created \??\R:\Autorun.inf smss.exe File created \??\S:\Autorun.inf Kazekage.exe File created \??\Z:\Autorun.inf smss.exe File opened for modification \??\O:\Autorun.inf Gaara.exe File created \??\N:\Autorun.inf csrss.exe File opened for modification \??\A:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created \??\Q:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\H:\Autorun.inf csrss.exe File created \??\P:\Autorun.inf csrss.exe File opened for modification \??\B:\Autorun.inf csrss.exe File opened for modification F:\Autorun.inf csrss.exe File created \??\J:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification D:\Autorun.inf csrss.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf system32.exe File created \??\A:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created D:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\T:\Autorun.inf smss.exe File opened for modification D:\Autorun.inf Gaara.exe File created \??\M:\Autorun.inf csrss.exe File created \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\M:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created \??\U:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File created \??\K:\Autorun.inf system32.exe File opened for modification \??\Q:\Autorun.inf csrss.exe File created \??\U:\Autorun.inf Kazekage.exe File created \??\Q:\Autorun.inf Gaara.exe File opened for modification \??\E:\Autorun.inf csrss.exe File opened for modification \??\Y:\Autorun.inf csrss.exe File opened for modification \??\U:\Autorun.inf Kazekage.exe File opened for modification \??\G:\Autorun.inf system32.exe File opened for modification \??\K:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\Y:\Autorun.inf smss.exe File opened for modification \??\Z:\Autorun.inf smss.exe File created \??\S:\Autorun.inf Gaara.exe File created \??\Z:\Autorun.inf csrss.exe File created \??\O:\Autorun.inf system32.exe File created \??\X:\Autorun.inf system32.exe File created C:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created \??\O:\Autorun.inf smss.exe File opened for modification \??\T:\Autorun.inf Gaara.exe File opened for modification \??\Z:\Autorun.inf Gaara.exe File created \??\O:\Autorun.inf Kazekage.exe File created \??\R:\Autorun.inf Kazekage.exe File created \??\H:\Autorun.inf smss.exe File created \??\N:\Autorun.inf smss.exe File created \??\K:\Autorun.inf csrss.exe File created \??\I:\Autorun.inf system32.exe File created \??\J:\Autorun.inf system32.exe File opened for modification \??\O:\Autorun.inf system32.exe File opened for modification \??\U:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification \??\O:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf smss.exe File created \??\O:\Autorun.inf Gaara.exe File created \??\R:\Autorun.inf Gaara.exe File created \??\Z:\Autorun.inf Gaara.exe File created \??\K:\Autorun.inf Kazekage.exe File opened for modification F:\Autorun.inf system32.exe File opened for modification F:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created \??\H:\Autorun.inf 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification D:\Autorun.inf smss.exe - Drops file in System32 directory 39 IoCs
description ioc Process File created C:\Windows\SysWOW64\23-10-2024.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe csrss.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File created C:\Windows\SysWOW64\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\ 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File created C:\Windows\SysWOW64\mscomctl.ocx 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\SysWOW64\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe system32.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File opened for modification C:\Windows\SysWOW64\23-10-2024.exe smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe -
resource yara_rule behavioral2/memory/4412-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b80-31.dat upx behavioral2/memory/748-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b82-45.dat upx behavioral2/files/0x000a000000023b81-41.dat upx behavioral2/files/0x000a000000023b85-57.dat upx behavioral2/files/0x000a000000023b84-53.dat upx behavioral2/memory/2260-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b85-96.dat upx behavioral2/files/0x000a000000023b84-92.dat upx behavioral2/memory/1864-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b83-88.dat upx behavioral2/files/0x000a000000023b82-84.dat upx behavioral2/memory/1324-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b83-130.dat upx behavioral2/files/0x000a000000023b85-138.dat upx behavioral2/files/0x000a000000023b84-134.dat upx behavioral2/memory/2828-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b83-176.dat upx behavioral2/memory/732-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b85-180.dat upx behavioral2/memory/732-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000a000000023b83-226.dat upx behavioral2/memory/1800-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x000100000000002d-342.dat upx behavioral2/memory/748-414-0x0000000000400000-0x000000000042A000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WBEM\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe system32.exe File created C:\Windows\mscomctl.ocx 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\ Gaara.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File opened for modification C:\Windows\ system32.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\Fonts\The Kazekage.jpg 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\ Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe csrss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\mscoree.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe system32.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\system\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe csrss.exe File opened for modification C:\Windows\system\mscoree.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\msvbvm60.dll smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe smss.exe File opened for modification C:\Windows\ csrss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\msvbvm60.dll Gaara.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe system32.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File opened for modification C:\Windows\system\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe smss.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe smss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe Gaara.exe File opened for modification C:\Windows\mscomctl.ocx smss.exe File created C:\Windows\Fonts\Admin 23 - 10 - 2024\msvbvm60.dll 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4612 ping.exe 5116 ping.exe 2948 ping.exe 2616 ping.exe 3888 ping.exe 2100 ping.exe 3448 ping.exe 2244 ping.exe 1368 ping.exe 2444 ping.exe 4360 ping.exe 2524 ping.exe 3876 ping.exe 5012 ping.exe 2648 ping.exe 2832 ping.exe 4312 ping.exe 456 ping.exe 3060 ping.exe 1596 ping.exe 2600 ping.exe 3924 ping.exe 372 ping.exe 4468 ping.exe 4696 ping.exe 4824 ping.exe 4520 ping.exe 4316 ping.exe 1664 ping.exe 4356 ping.exe 3648 ping.exe 3544 ping.exe 2856 ping.exe 3364 ping.exe 2860 ping.exe 4708 ping.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "2" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "2" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Size = "72" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" smss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop smss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe - Modifies registry class 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe - Runs ping.exe 1 TTPs 36 IoCs
pid Process 4708 ping.exe 1664 ping.exe 2648 ping.exe 2616 ping.exe 2832 ping.exe 3544 ping.exe 5116 ping.exe 2524 ping.exe 3924 ping.exe 2244 ping.exe 3888 ping.exe 4316 ping.exe 1368 ping.exe 3876 ping.exe 2600 ping.exe 4696 ping.exe 372 ping.exe 4360 ping.exe 3648 ping.exe 4824 ping.exe 2444 ping.exe 4356 ping.exe 1596 ping.exe 4612 ping.exe 4520 ping.exe 456 ping.exe 2860 ping.exe 2856 ping.exe 2948 ping.exe 3448 ping.exe 4312 ping.exe 3060 ping.exe 4468 ping.exe 3364 ping.exe 2100 ping.exe 5012 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1148 csrss.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 1504 Kazekage.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 748 smss.exe 2260 smss.exe 2072 Gaara.exe 1864 smss.exe 1324 Gaara.exe 1148 csrss.exe 2828 smss.exe 4936 Gaara.exe 932 csrss.exe 1504 Kazekage.exe 732 smss.exe 852 Gaara.exe 1216 csrss.exe 5028 Kazekage.exe 4424 system32.exe 4732 smss.exe 1800 Gaara.exe 4596 csrss.exe 3216 Kazekage.exe 3084 system32.exe 4204 system32.exe 1416 Kazekage.exe 428 system32.exe 3420 csrss.exe 5000 Kazekage.exe 2692 system32.exe 2012 Gaara.exe 1864 csrss.exe 3988 Kazekage.exe 3944 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 748 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 86 PID 4412 wrote to memory of 748 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 86 PID 4412 wrote to memory of 748 4412 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe 86 PID 748 wrote to memory of 2260 748 smss.exe 87 PID 748 wrote to memory of 2260 748 smss.exe 87 PID 748 wrote to memory of 2260 748 smss.exe 87 PID 748 wrote to memory of 2072 748 smss.exe 89 PID 748 wrote to memory of 2072 748 smss.exe 89 PID 748 wrote to memory of 2072 748 smss.exe 89 PID 2072 wrote to memory of 1864 2072 Gaara.exe 90 PID 2072 wrote to memory of 1864 2072 Gaara.exe 90 PID 2072 wrote to memory of 1864 2072 Gaara.exe 90 PID 2072 wrote to memory of 1324 2072 Gaara.exe 91 PID 2072 wrote to memory of 1324 2072 Gaara.exe 91 PID 2072 wrote to memory of 1324 2072 Gaara.exe 91 PID 2072 wrote to memory of 1148 2072 Gaara.exe 92 PID 2072 wrote to memory of 1148 2072 Gaara.exe 92 PID 2072 wrote to memory of 1148 2072 Gaara.exe 92 PID 1148 wrote to memory of 2828 1148 csrss.exe 93 PID 1148 wrote to memory of 2828 1148 csrss.exe 93 PID 1148 wrote to memory of 2828 1148 csrss.exe 93 PID 1148 wrote to memory of 4936 1148 csrss.exe 94 PID 1148 wrote to memory of 4936 1148 csrss.exe 94 PID 1148 wrote to memory of 4936 1148 csrss.exe 94 PID 1148 wrote to memory of 932 1148 csrss.exe 95 PID 1148 wrote to memory of 932 1148 csrss.exe 95 PID 1148 wrote to memory of 932 1148 csrss.exe 95 PID 1148 wrote to memory of 1504 1148 csrss.exe 98 PID 1148 wrote to memory of 1504 1148 csrss.exe 98 PID 1148 wrote to memory of 1504 1148 csrss.exe 98 PID 1504 wrote to memory of 732 1504 Kazekage.exe 99 PID 1504 wrote to memory of 732 1504 Kazekage.exe 99 PID 1504 wrote to memory of 732 1504 Kazekage.exe 99 PID 1504 wrote to memory of 852 1504 Kazekage.exe 100 PID 1504 wrote to memory of 852 1504 Kazekage.exe 100 PID 1504 wrote to memory of 852 1504 Kazekage.exe 100 PID 1504 wrote to memory of 1216 1504 Kazekage.exe 102 PID 1504 wrote to memory of 1216 1504 Kazekage.exe 102 PID 1504 wrote to memory of 1216 1504 Kazekage.exe 102 PID 1504 wrote to memory of 5028 1504 Kazekage.exe 103 PID 1504 wrote to memory of 5028 1504 Kazekage.exe 103 PID 1504 wrote to memory of 5028 1504 Kazekage.exe 103 PID 1504 wrote to memory of 4424 1504 Kazekage.exe 105 PID 1504 wrote to memory of 4424 1504 Kazekage.exe 105 PID 1504 wrote to memory of 4424 1504 Kazekage.exe 105 PID 4424 wrote to memory of 4732 4424 system32.exe 106 PID 4424 wrote to memory of 4732 4424 system32.exe 106 PID 4424 wrote to memory of 4732 4424 system32.exe 106 PID 4424 wrote to memory of 1800 4424 system32.exe 107 PID 4424 wrote to memory of 1800 4424 system32.exe 107 PID 4424 wrote to memory of 1800 4424 system32.exe 107 PID 4424 wrote to memory of 4596 4424 system32.exe 108 PID 4424 wrote to memory of 4596 4424 system32.exe 108 PID 4424 wrote to memory of 4596 4424 system32.exe 108 PID 4424 wrote to memory of 3216 4424 system32.exe 109 PID 4424 wrote to memory of 3216 4424 system32.exe 109 PID 4424 wrote to memory of 3216 4424 system32.exe 109 PID 4424 wrote to memory of 3084 4424 system32.exe 110 PID 4424 wrote to memory of 3084 4424 system32.exe 110 PID 4424 wrote to memory of 3084 4424 system32.exe 110 PID 1148 wrote to memory of 4204 1148 csrss.exe 111 PID 1148 wrote to memory of 4204 1148 csrss.exe 111 PID 1148 wrote to memory of 4204 1148 csrss.exe 111 PID 2072 wrote to memory of 1416 2072 Gaara.exe 112 - System policy modification 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe"C:\Users\Admin\AppData\Local\Temp\85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4412 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:748 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2072 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1148 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4936
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1504 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:732
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:852
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1216
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4424 -
C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4596
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3084
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2948
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2616
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3888
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:372
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655007⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2444
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655007⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3876
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4708
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2600
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2244
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4520
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4824
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2100
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4360
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4356
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3544
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2856
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4316
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1368
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:428
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1596
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2648
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2832
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4312
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4696
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2860
-
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3420
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5000
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5012
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5116
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3648
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3924
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4468
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3364
-
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3988
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3944
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1664
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4612
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3448
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:456
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 23 - 10 - 2024\Gaara.exe
- Size 382KB
- SHA256 a3064ab064b835ee2f3547e80aba4269f45f127bec1543a2493f04c89667d68a
- MD5 3d6ac828b9d77ae1e18ad71b6dbc733b
- SHA1 4b9246eb305f368bf6a06a3036084570d8a0a593
- SHA512 b3e2b979848f97de94d163610dab7164d21a368a4507a478ccd1941e9c02aec75ed45273410ecdb674768ad164c24f31366b7cdc547b732a04933d4a6b6cb411
- SSDEEP 6144:FVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:FVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe
- Size 382KB
- SHA256 82a3841ff72ac4b7c6771f51399c25ef543b77b06f3db02b1beba683d3856884
- MD5 ffea18d06abda22976e2dbd590e193a6
- SHA1 c4ac814412fba8a76e53a4083a02408e649b41ed
- SHA512 c3e41bf30c63bf635d611e5b315865e0becfbefe2107271d991ba68385d928a371c59395894b12de2feed2424fa86972e4c31004e7d13c1d44679b07d592f857
- SSDEEP 6144:AVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:AVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 23 - 10 - 2024\csrss.exe
- Size 382KB
- SHA256 67ae4bd7affed2fed0e5c5682e376509a86e872cbf6a5195a9dbc4eb5c619b5c
- MD5 2ebdf20a5d72be8ee94aff639e608214
- SHA1 77f28836ad9c4d18eb23dd7a9237cd4ef5b14e86
- SHA512 2fd9103cc1ce5d86ef9750fe8e97ab4c7f888cfa8f21a683cc520076c3db7ed44b6c5ae3e1bacc5baa6c3c309549273579db091cfbe8b395a9bb4da8bb9440ca
- SSDEEP 6144:pVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:pVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 23 - 10 - 2024\smss.exe
- Size 382KB
- SHA256 4cc99ec43da149b839d726619abc7f42d1e4f6d2c33311f69a364e14f9ceae26
- MD5 1ca7a59f4a90eb147c90a9f7fd234f4e
- SHA1 ffb171a704fae5d0b33911bafa6a41225a7a2e6e
- SHA512 6450fc5874151e56ede81e075305b1834ef86eb4b3a1cefb964ddb8eb07877b30b3e1df896875e425418748bea6a06e91c2aeebe1c85770b8904831841258484
- SSDEEP 6144:2VG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:2VG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\23-10-2024.exe
- Size 382KB
- SHA256 9a7151814676187dde26e70ad518416e96f02bb586dde7e213d3bdd8081930da
- MD5 7c9f2c9df4bd1c5aa132cd9bc3a64b0a
- SHA1 72540285fa09acc2e304822e5a69271e0fc4fab8
- SHA512 fc734a7f9494463a3e8469177b72536d126cedfdc0b0209418cf98004ba314379a0bb227090d4605731404d1d06a6819a44d6add6b9417147fe8aaa6010cfb8f
- SSDEEP 6144:9VG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:9VG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\23-10-2024.exe
- Size 382KB
- SHA256 ae6cb8f0364da4a24b32aed5160b7278a230f654b200eb5cfcca05a23cb589f6
- MD5 49c869606074b0e926dd83ccce46d849
- SHA1 bffae5ca03744ef03996ebee8d4c0a45c19a850e
- SHA512 43b17fd4301f0a54b53ad6136c1f6b0810c78b45d40532698905e1c176b6da535da8046b8da338d601181b45a5d33361ddc85e8033c34dd303fe7d3bc8136ea7
- SSDEEP 6144:bVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:bVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\23-10-2024.exe
- Size 382KB
- SHA256 69675c852406d88a63d755fd5c0349370ec9811427b144fb6b11d797ea171c03
- MD5 30a05481863d01e6bcf0510885f9bfe3
- SHA1 58f5d876a2b5226d492350820d18b2027cf10187
- SHA512 4d2840669551252e52f9846d2bd89cba4e0e99b1438a6585c02e75cce6e6f5e73b809944b84bd946020166cf2778314a43b608f025326db83a9bd5dd1b8b90e4
- SSDEEP 6144:rVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:rVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\23-10-2024.exe
- Size 382KB
- SHA256 c61a14a01551ca143abc06fbc1d78f7cdbb3f018ba2e548036d74a7e25bb056f
- MD5 8984fa5eb2b411142580481cd5daa9e4
- SHA1 cb10cdad5c66aed47af93ca87240f60f285c24d7
- SHA512 ba744f8c1d740f28651726d100e0c5b2455a53a0390480ab64f2c9d7cf878629baa06f56fb8f0bed97e5d98d4e0c8330b7957ef20b04fdbbd8bb92ccdb3bc740
- SSDEEP 6144:nVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:nVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\23-10-2024.exe
- Size 382KB
- SHA256 0009b1751ed548c499872fb7bc126778ce7104e763cc04ef8a9cd2444a4480a0
- MD5 f51edb0ec6e43b62d2690218eb721b0b
- SHA1 91f760f87179a9bfceb3dad519da75ffcb16118c
- SHA512 256f795a682f150d598e38d12d29ec292c04570bbe91e1eca1ba7506005967ba1eeed77b874e7aa4540ff6066da41ef304c5674910e3b5c0fcb718702a00d373
- SSDEEP 6144:rVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:rVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 382KB
- SHA256 93681188efd3dac74a108365f845b63e737ce01029dddc1184550ad20046748e
- MD5 d26c10c12af264e2c1c2debad8cf07de
- SHA1 c83165a5e1f8f1170e3a9522729c8708b81cb9e9
- SHA512 51c38a35eff0ed65ccbebd7444feb142a770d47d90cf5b8056255bf307ecb21609a03196bef02174763547de17e2ca09868d65010a35d72b4f1490433a51d9cc
- SSDEEP 6144:FVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:FVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 382KB
- SHA256 0fa7bfaecf901f6d07ac26555becc7f46e233681acd6c5b411270e170e4d6d2e
- MD5 69e02527404556d8aca3ec0830d3e52b
- SHA1 36efc370e2821e8aa96139a3a596d3e13b3ac5c7
- SHA512 e60772acc2a32e0a5d756a037d1a2abb9fedb28745e62610565c6002baebb91d6ad7ee9f99e1b19dfb08201a0ee173b5c0c28ec568d80cb73dc0ca8394ebcd8b
- SSDEEP 6144:KVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:KVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 382KB
- SHA256 1dab0dc2091ac08a73b6a5ac866c6f9444669b968b70e0c2e791e737be0ebe35
- MD5 99ddc7f890a35d38ae571a091620ad9a
- SHA1 e2f26b0030f18ee0bee4973a9792d44654114833
- SHA512 3d279a04ecd35e1ede822bd92ed656a0411345d9c7d39593d121caa658ee040bc71902bbc9015cc4204b13aa3682e5cbf51934566517d28d1af905adb2ece652
- SSDEEP 6144:XVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:XVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 382KB
- SHA256 2c332537b859300e763302328b96f9ecd874fac3198db49a3a1163dcc0df56f4
- MD5 742d2cde766349a567c679366bbf09a7
- SHA1 227b0b5aef8385649c142722f3693f5c3699af96
- SHA512 be03a335ef59ee6cf0a3f6b5e17d1b21c24bd9f2ee9d193124628b51417986619bb5ae1f96a7e4049992ebbf9999e469b144735de8340e396d890e5c4aeef7ea
- SSDEEP 6144:RVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:RVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 382KB
- SHA256 4432461d50babebb7b9ab68de70d3c854f3a9504804328ed881cce029e490487
- MD5 6b87a5669f993c464cbf968f9a4233dd
- SHA1 edca52c2b678462f9895b574bd72c09d59df2276
- SHA512 08340d7d1e1233522c340595a175f4a8154b365457c0e1526df49114493fc37a4cfbd914ef885071a5ae10da11e67edc5a9dcb55547c77fd41e89351869b2c8b
- SSDEEP 6144:zVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:zVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 382KB
- SHA256 c5789803c61dbc19a3482982035be7c9c58f3949f88270b954e3e54d42c15980
- MD5 dfca2b5df7377e1913ed56cf2fd05844
- SHA1 169d806268804d790666cc1049b375df84c2420e
- SHA512 3727cb3e0ceb11f3bc7daff6ac990264c1e479a8e97ad56ee33ad0f0543ab757d9f9a046908cf505d4fd28dced455beb27e42243e631b463707ea3cfda45d5db
- SSDEEP 6144:mVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:mVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 382KB
- SHA256 7e06b74812a16bdb9598ba7bd1c10690947f059daf424a71adbb6ad18415e527
- MD5 96d3a292fbc75794f827735a066a9974
- SHA1 dcd2761df94dd440f6d67d9b7d899cf50df29d20
- SHA512 28a0e43b39c0d997d45fadaaf453891d973e6059eafb68d5045ad9dd243c9b32204ce0635838b31e0795efa05c221681be9096ff60d72fad1349957d1dcc15bf
- SSDEEP 6144:jVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:jVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Gaara.exe
- Size 382KB
- SHA256 85806aca051226870f708eed2f08584e7b5819a30e17f3ab60e8773533a2ced7
- MD5 7a5ead4a01a1b4db5f4d8d3625d8fea4
- SHA1 a3f2d943835cab39a06a07b09e947551a17b6fb7
- SHA512 5dea8c15acbd4119f26451ed7226546151af03259939bef78c96e112b641c5c9177e467aecedb4fee16b2267bd8754a1bf2a92d539ef9f72368774b8ee724219
- SSDEEP 6144:uVG84jqfhJVG84jqfhdVG84jqfhiVG84jqfhJVG84jqfhdVG84jqfhN:uVG84YDVG84YXVG84YYVG84YDVG84YXn
- MD5 SHA1 SHA512 SSDEEP