e764b39653a26d2477269eb436b48a97ffddc725dd5eed28fc90824cedd0b65c

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2025, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Size 9.5MB
Sample250503-tljsmsfk5v
SHA256 e764b39653a26d2477269eb436b48a97ffddc725dd5eed28fc90824cedd0b65c
MD5 7e16e6e474b33e8b6e4e769ccaf11fdd
SHA1 4fc3ac9b9280e9738dff787da7a371d368f41ab0
SHA512 72fe0bb35e6d1225a9335aac61edc9643ee17523fa7f80e19cb65534a5f986349a7107708384e78d3e2bb7586d37d1e5bf3d5a696cb11aac67f9103d835ec0ad
SSDEEP 98304:vyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:M1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe

Executes dropped EXE 30 IoCs

pid	Process
1964	smss.exe
1224	smss.exe
4316	Gaara.exe
4768	smss.exe
5004	Gaara.exe
5076	csrss.exe
5728	Gaara.exe
5796	smss.exe
4828	csrss.exe
4880	Gaara.exe
4932	csrss.exe
2320	csrss.exe
5436	Kazekage.exe
5276	Kazekage.exe
4336	Kazekage.exe
5144	smss.exe
5960	system32.exe
2608	system32.exe
1092	Kazekage.exe
2696	Gaara.exe
2088	system32.exe
5112	smss.exe
4004	csrss.exe
4160	Gaara.exe
5956	Kazekage.exe
5352	system32.exe
1996	csrss.exe
3572	system32.exe
4352	Kazekage.exe
1048	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
1964	smss.exe
1224	smss.exe
4316	Gaara.exe
4768	smss.exe
5004	Gaara.exe
5076	csrss.exe
5728	Gaara.exe
5796	smss.exe
4828	csrss.exe
4880	Gaara.exe
4932	csrss.exe
2320	csrss.exe
5144	smss.exe
2696	Gaara.exe
5112	smss.exe
4004	csrss.exe
4160	Gaara.exe
1996	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\V:\Desktop.ini	csrss.exe
File opened for modification	\??\Y:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\B:\Desktop.ini	csrss.exe
File opened for modification	\??\A:\Desktop.ini	system32.exe
File opened for modification	\??\G:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\L:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	Gaara.exe
File opened for modification	\??\X:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	csrss.exe
File opened for modification	\??\Y:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	Kazekage.exe
File opened for modification	\??\G:\Desktop.ini	system32.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\Y:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	Gaara.exe
File opened for modification	\??\R:\Desktop.ini	system32.exe
File opened for modification	D:\Desktop.ini	smss.exe
File opened for modification	F:\Desktop.ini	csrss.exe
File opened for modification	\??\R:\Desktop.ini	csrss.exe
File opened for modification	D:\Desktop.ini	Gaara.exe
File opened for modification	D:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Desktop.ini	system32.exe
File opened for modification	\??\U:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\L:\Desktop.ini	smss.exe
File opened for modification	\??\P:\Desktop.ini	Kazekage.exe
File opened for modification	\??\M:\Desktop.ini	system32.exe
File opened for modification	\??\U:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\S:\Desktop.ini	Kazekage.exe
File opened for modification	\??\H:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\B:\Desktop.ini	smss.exe
File opened for modification	\??\J:\Desktop.ini	smss.exe
File opened for modification	\??\E:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	\??\E:\Desktop.ini	Gaara.exe
File opened for modification	F:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	system32.exe
File opened for modification	\??\E:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	csrss.exe
File opened for modification	\??\K:\Desktop.ini	csrss.exe
File opened for modification	\??\N:\Desktop.ini	system32.exe
File opened for modification	\??\S:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	Gaara.exe
File opened for modification	\??\T:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Desktop.ini	csrss.exe
File opened for modification	\??\Z:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\G:\Desktop.ini	Gaara.exe
File opened for modification	\??\T:\Desktop.ini	Gaara.exe
File opened for modification	\??\S:\Desktop.ini	csrss.exe
File opened for modification	\??\Z:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\T:\Desktop.ini	Kazekage.exe
File opened for modification	C:\Desktop.ini	system32.exe
File opened for modification	\??\P:\Desktop.ini	Gaara.exe
File opened for modification	\??\V:\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\V:\Desktop.ini	system32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	system32.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\K:	Kazekage.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\Y:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\O:	Gaara.exe
File opened (read-only)	\??\M:	system32.exe
File opened (read-only)	\??\H:	Kazekage.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\Z:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\Q:	Kazekage.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\I:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\K:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\P:	system32.exe
File opened (read-only)	\??\R:	system32.exe
File opened (read-only)	\??\V:	system32.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\O:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\U:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\S:	Kazekage.exe
File opened (read-only)	\??\X:	Kazekage.exe
File opened (read-only)	\??\J:	Gaara.exe
File opened (read-only)	\??\L:	Gaara.exe
File opened (read-only)	\??\M:	Gaara.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\A:	Kazekage.exe
File opened (read-only)	\??\V:	Kazekage.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\R:	Gaara.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\R:	Kazekage.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\T:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\H:	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\V:	Gaara.exe
File opened (read-only)	\??\W:	Gaara.exe
File opened (read-only)	\??\W:	system32.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\T:	Kazekage.exe
File opened (read-only)	\??\U:	Kazekage.exe
File opened (read-only)	\??\G:	Gaara.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\N:	Kazekage.exe
File opened (read-only)	\??\P:	Kazekage.exe
File opened (read-only)	\??\W:	Kazekage.exe
File opened (read-only)	\??\Y:	Gaara.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\I:	Gaara.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\B:	smss.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\S:\Autorun.inf	Kazekage.exe
File created	\??\K:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\O:\Autorun.inf	smss.exe
File created	\??\O:\Autorun.inf	Gaara.exe
File opened for modification	\??\G:\Autorun.inf	system32.exe
File created	\??\I:\Autorun.inf	system32.exe
File opened for modification	\??\O:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\T:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Autorun.inf	smss.exe
File created	\??\Z:\Autorun.inf	smss.exe
File opened for modification	\??\J:\Autorun.inf	csrss.exe
File opened for modification	\??\W:\Autorun.inf	Kazekage.exe
File created	\??\L:\Autorun.inf	smss.exe
File created	\??\V:\Autorun.inf	smss.exe
File created	\??\Z:\Autorun.inf	Gaara.exe
File created	\??\O:\Autorun.inf	csrss.exe
File created	\??\N:\Autorun.inf	Kazekage.exe
File opened for modification	\??\N:\Autorun.inf	system32.exe
File opened for modification	\??\Q:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\H:\Autorun.inf	smss.exe
File opened for modification	\??\R:\Autorun.inf	smss.exe
File opened for modification	\??\B:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\A:\Autorun.inf	csrss.exe
File created	\??\U:\Autorun.inf	csrss.exe
File created	\??\Q:\Autorun.inf	Kazekage.exe
File created	\??\A:\Autorun.inf	system32.exe
File created	\??\Q:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\N:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\O:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Autorun.inf	smss.exe
File created	\??\R:\Autorun.inf	smss.exe
File opened for modification	\??\O:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	csrss.exe
File created	\??\R:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\X:\Autorun.inf	Gaara.exe
File opened for modification	\??\B:\Autorun.inf	csrss.exe
File created	D:\Autorun.inf	csrss.exe
File created	\??\W:\Autorun.inf	csrss.exe
File created	\??\O:\Autorun.inf	system32.exe
File opened for modification	\??\W:\Autorun.inf	system32.exe
File created	\??\X:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\K:\Autorun.inf	smss.exe
File opened for modification	\??\P:\Autorun.inf	Kazekage.exe
File opened for modification	\??\Z:\Autorun.inf	Kazekage.exe
File opened for modification	\??\B:\Autorun.inf	system32.exe
File created	\??\W:\Autorun.inf	system32.exe
File opened for modification	\??\P:\Autorun.inf	Gaara.exe
File opened for modification	\??\Y:\Autorun.inf	Gaara.exe
File opened for modification	\??\P:\Autorun.inf	csrss.exe
File opened for modification	D:\Autorun.inf	csrss.exe
File opened for modification	\??\T:\Autorun.inf	csrss.exe
File opened for modification	\??\U:\Autorun.inf	Kazekage.exe
File created	\??\N:\Autorun.inf	system32.exe
File opened for modification	\??\L:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\M:\Autorun.inf	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	D:\Autorun.inf	smss.exe
File opened for modification	\??\Y:\Autorun.inf	smss.exe
File created	\??\H:\Autorun.inf	Gaara.exe
File created	\??\R:\Autorun.inf	csrss.exe
File created	\??\E:\Autorun.inf	Gaara.exe
File created	\??\E:\Autorun.inf	smss.exe
File opened for modification	\??\T:\Autorun.inf	smss.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	system32.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\3-5-2025.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3116-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024242-11.dat	upx
behavioral1/files/0x0007000000024240-31.dat	upx
behavioral1/memory/1964-32-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1224-72-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024241-74.dat	upx
behavioral1/memory/4316-75-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/3116-90-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1964-112-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5004-116-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024242-117.dat	upx
behavioral1/memory/5076-119-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024244-135.dat	upx
behavioral1/memory/5728-140-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4316-150-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5796-154-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5728-161-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5796-163-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4880-170-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4828-169-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2320-176-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5076-175-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000800000002423d-180.dat	upx
behavioral1/memory/5436-181-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5276-187-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4932-191-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5276-217-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5960-218-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4336-216-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024244-215.dat	upx
behavioral1/memory/5436-226-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2608-234-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1092-235-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2696-248-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2088-254-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5960-255-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5352-260-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5956-261-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4160-262-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5352-267-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1996-268-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/4352-273-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/3572-274-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1048-277-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0007000000024268-519.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	system32.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Kazekage.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\	smss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\system\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Gaara.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	system32.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	Gaara.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\system\mscoree.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Kazekage.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3852	ping.exe
1124	ping.exe
3048	ping.exe
4504	ping.exe
5920	ping.exe
1940	ping.exe
3892	ping.exe
4632	ping.exe
5964	ping.exe
5012	ping.exe
5432	ping.exe
2124	ping.exe
3812	ping.exe
1584	ping.exe
6088	ping.exe
3168	ping.exe
1608	ping.exe
4568	ping.exe
5948	ping.exe
4596	ping.exe
3832	ping.exe
3056	ping.exe
3980	ping.exe
5708	ping.exe
4196	ping.exe
5032	ping.exe
1936	ping.exe
5068	ping.exe
1660	ping.exe
5724	ping.exe
228	ping.exe
5900	ping.exe
2608	ping.exe
2688	ping.exe
5688	ping.exe
3432	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\WallpaperStyle = "2"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Size = "72"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\WallpaperStyle = "2"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Screen Saver.Marquee	csrss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe

Runs ping.exe 1 TTPs 36 IoCs

Remote System Discovery

T1018

pid	Process
1124	ping.exe
4196	ping.exe
6088	ping.exe
4632	ping.exe
2124	ping.exe
3892	ping.exe
3832	ping.exe
5012	ping.exe
1940	ping.exe
4568	ping.exe
2688	ping.exe
3168	ping.exe
5900	ping.exe
3056	ping.exe
3980	ping.exe
3812	ping.exe
228	ping.exe
5964	ping.exe
5688	ping.exe
5948	ping.exe
1936	ping.exe
5920	ping.exe
5068	ping.exe
1584	ping.exe
2608	ping.exe
4596	ping.exe
5724	ping.exe
3048	ping.exe
5432	ping.exe
4504	ping.exe
3852	ping.exe
1660	ping.exe
3432	ping.exe
1608	ping.exe
5032	ping.exe
5708	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
1964	smss.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
5436	Kazekage.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe
4316	Gaara.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
1964	smss.exe
1224	smss.exe
4316	Gaara.exe
4768	smss.exe
5004	Gaara.exe
5076	csrss.exe
5728	Gaara.exe
5796	smss.exe
4828	csrss.exe
4880	Gaara.exe
4932	csrss.exe
2320	csrss.exe
5436	Kazekage.exe
4336	Kazekage.exe
5276	Kazekage.exe
5144	smss.exe
5960	system32.exe
2608	system32.exe
1092	Kazekage.exe
2696	Gaara.exe
2088	system32.exe
5112	smss.exe
4004	csrss.exe
4160	Gaara.exe
5956	Kazekage.exe
1996	csrss.exe
5352	system32.exe
4352	Kazekage.exe
3572	system32.exe
1048	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1964	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	86
PID 3116 wrote to memory of 1964	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	86
PID 3116 wrote to memory of 1964	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	86
PID 1964 wrote to memory of 1224	1964	smss.exe	88
PID 1964 wrote to memory of 1224	1964	smss.exe	88
PID 1964 wrote to memory of 1224	1964	smss.exe	88
PID 1964 wrote to memory of 4316	1964	smss.exe	89
PID 1964 wrote to memory of 4316	1964	smss.exe	89
PID 1964 wrote to memory of 4316	1964	smss.exe	89
PID 4316 wrote to memory of 4768	4316	Gaara.exe	90
PID 4316 wrote to memory of 4768	4316	Gaara.exe	90
PID 4316 wrote to memory of 4768	4316	Gaara.exe	90
PID 4316 wrote to memory of 5004	4316	Gaara.exe	91
PID 4316 wrote to memory of 5004	4316	Gaara.exe	91
PID 4316 wrote to memory of 5004	4316	Gaara.exe	91
PID 4316 wrote to memory of 5076	4316	Gaara.exe	92
PID 4316 wrote to memory of 5076	4316	Gaara.exe	92
PID 4316 wrote to memory of 5076	4316	Gaara.exe	92
PID 3116 wrote to memory of 5728	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	93
PID 3116 wrote to memory of 5728	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	93
PID 3116 wrote to memory of 5728	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	93
PID 5076 wrote to memory of 5796	5076	csrss.exe	94
PID 5076 wrote to memory of 5796	5076	csrss.exe	94
PID 5076 wrote to memory of 5796	5076	csrss.exe	94
PID 3116 wrote to memory of 4828	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 3116 wrote to memory of 4828	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 3116 wrote to memory of 4828	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 5076 wrote to memory of 4880	5076	csrss.exe	96
PID 5076 wrote to memory of 4880	5076	csrss.exe	96
PID 5076 wrote to memory of 4880	5076	csrss.exe	96
PID 5076 wrote to memory of 4932	5076	csrss.exe	97
PID 5076 wrote to memory of 4932	5076	csrss.exe	97
PID 5076 wrote to memory of 4932	5076	csrss.exe	97
PID 1964 wrote to memory of 2320	1964	smss.exe	99
PID 1964 wrote to memory of 2320	1964	smss.exe	99
PID 1964 wrote to memory of 2320	1964	smss.exe	99
PID 3116 wrote to memory of 5436	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 3116 wrote to memory of 5436	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 3116 wrote to memory of 5436	3116	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 5076 wrote to memory of 5276	5076	csrss.exe	100
PID 5076 wrote to memory of 5276	5076	csrss.exe	100
PID 5076 wrote to memory of 5276	5076	csrss.exe	100
PID 1964 wrote to memory of 4336	1964	smss.exe	101
PID 1964 wrote to memory of 4336	1964	smss.exe	101
PID 1964 wrote to memory of 4336	1964	smss.exe	101
PID 5436 wrote to memory of 5144	5436	Kazekage.exe	102
PID 5436 wrote to memory of 5144	5436	Kazekage.exe	102
PID 5436 wrote to memory of 5144	5436	Kazekage.exe	102
PID 1964 wrote to memory of 5960	1964	smss.exe	103
PID 1964 wrote to memory of 5960	1964	smss.exe	103
PID 1964 wrote to memory of 5960	1964	smss.exe	103
PID 5076 wrote to memory of 2608	5076	csrss.exe	104
PID 5076 wrote to memory of 2608	5076	csrss.exe	104
PID 5076 wrote to memory of 2608	5076	csrss.exe	104
PID 4316 wrote to memory of 1092	4316	Gaara.exe	105
PID 4316 wrote to memory of 1092	4316	Gaara.exe	105
PID 4316 wrote to memory of 1092	4316	Gaara.exe	105
PID 5436 wrote to memory of 2696	5436	Kazekage.exe	106
PID 5436 wrote to memory of 2696	5436	Kazekage.exe	106
PID 5436 wrote to memory of 2696	5436	Kazekage.exe	106
PID 4316 wrote to memory of 2088	4316	Gaara.exe	107
PID 4316 wrote to memory of 2088	4316	Gaara.exe	107
PID 4316 wrote to memory of 2088	4316	Gaara.exe	107
PID 5960 wrote to memory of 5112	5960	system32.exe	108

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-03_7e16e6e474b33e8b6e4e769ccaf11fdd_black-basta_elex_hijackloader_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3116
- C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1964
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1224
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4316
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4768
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5004
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5076
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5796
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4880
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4932
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5276
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2608
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3852
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1124
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5032
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3892
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3048
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5012
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1092
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2088
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4504
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4568
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:228
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5948
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3980
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3432
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2320
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4336
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5960
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5112
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4160
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1996
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4352
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1048
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1584
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2608
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5964
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1660
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5708
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5920
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1940
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1608
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6088
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3168
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3832
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3056
- C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5728
- C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4828
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5436
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5144
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2696
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4004
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5956
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5352
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3812
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4196
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4596
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4632
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1936
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5432
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3572
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5068
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2124
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2688
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5688
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5724
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 3 - 5 - 2025\smss.exe
1⤵
PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 3 - 5 - 2025\Gaara.exe
1⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 3-5-2025.exe
1⤵
PID:4088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Gaara games - Naruto.exe

Path C:\Admin Games\Gaara games - Naruto.exe
Size 9.5MB
SHA256 ac997922d673d1e8edbe447269329d5148359ce2204562b2527afda0a6d05192
MD5 a0e25b2bc430f241e6a496206ad4fa74
SHA1 2da7e9720b381566a97bdbcbedddc70613da741f
SHA512 e049da7af07dbe48cf0594c0653c6b287958a5b40b0c63fb719eb9611215c8174e3bab2b03761d24dfc5bcc259c97ed43f6191a699a69e915ef8717387ef0546
SSDEEP 98304:qyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:d1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Readme.txt

Path C:\Admin Games\Readme.txt
Size 736B
SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Autorun.inf
Size 196B
SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
MD5 1564dfe69ffed40950e5cb644e0894d1
SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
MD5 SHA1 SHA512

Submit Download

Gaara.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
Size 9.5MB
SHA256 3ffeb6ce5c4cfaef5c95e7c67b18f83a3d9a6724bb02fe3e44fba7950dea5d15
MD5 48a8bd3d4b220c037a65a77afb740eb8
SHA1 daa42720d96765f14a3aef9ac87b4a73f25db664
SHA512 23879fe0d3bfd83b61aa0dc6439c61b756461dae7820407673898c843ba516129f89649e9ceccce4656e39933e2c2be245f9a9e3cbeab7d7dd15115825ec306d
SSDEEP 98304:qyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:d1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
Size 9.5MB
SHA256 e764b39653a26d2477269eb436b48a97ffddc725dd5eed28fc90824cedd0b65c
MD5 7e16e6e474b33e8b6e4e769ccaf11fdd
SHA1 4fc3ac9b9280e9738dff787da7a371d368f41ab0
SHA512 72fe0bb35e6d1225a9335aac61edc9643ee17523fa7f80e19cb65534a5f986349a7107708384e78d3e2bb7586d37d1e5bf3d5a696cb11aac67f9103d835ec0ad
SSDEEP 98304:vyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:M1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
Size 9.5MB
SHA256 80085a9e40913813c55790415ddb298395689d66b18da07afa1f72da308b8f66
MD5 7251844779f93d35ab7246c3d5f5d1ad
SHA1 531dd024e72847f36cf9cecf137480753abc1b24
SHA512 4583ab7f694b50990356a109776e4aa6e8a1eb91d9b8b64a6b719a2496dd83d08312594e3e6e8ae042f63e5761566534a3253f44e8a9eb90152db553599a1d0c
SSDEEP 98304:UyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:H1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
Size 9.5MB
SHA256 645609ac4e73248bd845904a9c3f10756b3ae347956bbb8488f5a0358896074b
MD5 77ef525d9aae6873a4d6bb36e2cee0b7
SHA1 2aaddce08ad76c004d4b792709be701e5936063e
SHA512 0f9635cd1b52a6ed4559d9c0b24bf6bc421b26dfe3708179496a342f2b4a770fab22bfec870d74fce0023376feb91dea202d778454427b5610dc2a4a5da27f98
SSDEEP 98304:5yyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:G1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

The Kazekage.jpg

Path C:\Windows\Fonts\The Kazekage.jpg
Size 1.4MB
SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
MD5 d6b05020d4a0ec2a3a8b687099e335df
SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.ini

Path C:\Windows\SysWOW64\Desktop.ini
Size 65B
SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
MD5 64acfa7e03b01f48294cf30d201a0026
SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
MD5 SHA1 SHA512

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.5MB
SHA256 eaeae824b338692ec82425e33d941511ccf599a2240e5a9ea67617bab5d1aeb9
MD5 54c6723ca24dd7e4ebe9c61fce034d6b
SHA1 3bf596b611dcc24b489ab616c10d3d2201a71a33
SHA512 1724a84d0366fb268346ecf7c1bfd44396e916d0681cc988115d65d1bfd88582e4da75ca431cc055c53280b11dc8d067aaefd72bb17713bede83001a113c3e4d
SSDEEP 98304:MyyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:/1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.5MB
SHA256 35ba2ead26d2adc267f4c47c80626b949081491af6b0c9ff19aa181b0fdbf176
MD5 a6a83289cd1641f62b359f75d7341c9f
SHA1 ce028670bc66c16816b352a6c290e7df31993208
SHA512 c19cef961c63dc3f41862074b3b8a9b1a653b5c4eda6f809667ee8a64f3b590ccb13d8cbf8dd8151a79e7433602f46ecfec482352d923a945c694858aba730e6
SSDEEP 98304:+yyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:B1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.5MB
SHA256 60438490f6e480a2a7222ef3dc93035806afd9ead835dd22cef1b19a68945c31
MD5 bc455396b55f8441525c2eab0af7f617
SHA1 0c1c2b6d0ac0d78d6fca54eabba118227514a224
SHA512 ae64a19d5fd3d8f2b88efef55ad92e03ad791e6820aef9484951c2d770aec5096acd35ca49028c1e12f9be2a26bac805e6bb5fb32f0e657f8dfaad14c722e6e3
SSDEEP 98304:syyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvP:f1eHL5dEvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\System\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-277-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1092-235-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1224-72-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1964-112-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1964-32-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1996-268-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2088-254-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2320-176-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2608-234-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2696-248-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3116-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3116-90-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3572-274-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4160-262-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4316-75-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4316-150-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4336-216-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4352-273-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4828-169-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4880-170-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4932-191-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5004-116-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5076-119-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5076-175-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5276-217-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5276-187-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5352-267-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5352-260-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5436-226-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5436-181-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5728-140-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5728-161-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5796-154-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5796-163-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5956-261-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5960-255-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5960-218-0x0000000000400000-0x000000000042B000-memory.dmp

Download