dbbf8868f4a98a4743d55b3a2b4e179ea64b36400c5146440747769ffcf6a25b

Analysis

max time kernel
150s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2025, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Size 9.4MB
Sample250507-c646msyrv2
SHA256 dbbf8868f4a98a4743d55b3a2b4e179ea64b36400c5146440747769ffcf6a25b
MD5 7961555feace375700836f3d5f529409
SHA1 053d184e6dbdb75a56535c6eb50497fba4c20b7b
SHA512 d1840de8ac3107b90dc2491bf1292e3faf4ace72b76e1b6b6498916af08facc60b9359dadad5f1e9d7f1ecf7b2102da4e0f7dd9e2c9909176f38d9fbc41e9465
SSDEEP 98304:+GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:D1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Gaara.exe

Executes dropped EXE 30 IoCs

pid	Process
4980	smss.exe
2372	smss.exe
5056	Gaara.exe
572	smss.exe
4556	Gaara.exe
4212	csrss.exe
2748	smss.exe
3548	Gaara.exe
5996	csrss.exe
2964	Kazekage.exe
2780	smss.exe
4392	Gaara.exe
3164	Gaara.exe
3328	csrss.exe
2180	csrss.exe
2068	Kazekage.exe
1816	Kazekage.exe
1676	system32.exe
5148	system32.exe
5540	smss.exe
3700	Gaara.exe
4696	csrss.exe
1400	Kazekage.exe
4660	system32.exe
4940	system32.exe
2556	Kazekage.exe
3220	system32.exe
1948	csrss.exe
3360	Kazekage.exe
5980	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
4980	smss.exe
2372	smss.exe
5056	Gaara.exe
572	smss.exe
4556	Gaara.exe
4212	csrss.exe
2748	smss.exe
3548	Gaara.exe
5996	csrss.exe
2780	smss.exe
4392	Gaara.exe
3164	Gaara.exe
3328	csrss.exe
2180	csrss.exe
5540	smss.exe
3700	Gaara.exe
4696	csrss.exe
1948	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 7 - 5 - 2025\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "7-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 7 - 5 - 2025\\Gaara.exe"	Kazekage.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\J:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Z:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\N:\Desktop.ini	Gaara.exe
File opened for modification	D:\Desktop.ini	system32.exe
File opened for modification	\??\A:\Desktop.ini	smss.exe
File opened for modification	\??\S:\Desktop.ini	smss.exe
File opened for modification	\??\T:\Desktop.ini	csrss.exe
File opened for modification	\??\M:\Desktop.ini	system32.exe
File opened for modification	\??\K:\Desktop.ini	Kazekage.exe
File opened for modification	\??\T:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	F:\Desktop.ini	Gaara.exe
File opened for modification	\??\B:\Desktop.ini	Kazekage.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\S:\Desktop.ini	Kazekage.exe
File opened for modification	\??\K:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\E:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	csrss.exe
File opened for modification	\??\X:\Desktop.ini	system32.exe
File opened for modification	D:\Desktop.ini	smss.exe
File opened for modification	\??\I:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	csrss.exe
File opened for modification	\??\O:\Desktop.ini	Gaara.exe
File opened for modification	\??\G:\Desktop.ini	Kazekage.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\V:\Desktop.ini	Kazekage.exe
File opened for modification	D:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\L:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\M:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Desktop.ini	Gaara.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	D:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	Kazekage.exe
File opened for modification	\??\P:\Desktop.ini	smss.exe
File opened for modification	D:\Desktop.ini	Gaara.exe
File opened for modification	\??\L:\Desktop.ini	smss.exe
File opened for modification	\??\V:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	F:\Desktop.ini	csrss.exe
File opened for modification	\??\I:\Desktop.ini	Gaara.exe
File opened for modification	\??\W:\Desktop.ini	csrss.exe
File opened for modification	\??\E:\Desktop.ini	system32.exe
File opened for modification	\??\S:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	Kazekage.exe
File opened for modification	F:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\O:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\A:\Desktop.ini	Gaara.exe
File opened for modification	F:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	\??\R:\Desktop.ini	smss.exe
File opened for modification	C:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\X:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	system32.exe
File opened for modification	\??\Z:\Desktop.ini	smss.exe
File opened for modification	\??\B:\Desktop.ini	Gaara.exe
File opened for modification	\??\Y:\Desktop.ini	Gaara.exe
File opened for modification	F:\Desktop.ini	system32.exe
File opened for modification	\??\N:\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\K:\Desktop.ini	Gaara.exe
File opened for modification	\??\W:\Desktop.ini	Gaara.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Kazekage.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\U:	Kazekage.exe
File opened (read-only)	\??\N:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\I:	Gaara.exe
File opened (read-only)	\??\N:	Gaara.exe
File opened (read-only)	\??\J:	system32.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\B:	smss.exe
File opened (read-only)	\??\X:	Kazekage.exe
File opened (read-only)	\??\E:	Gaara.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\U:	Gaara.exe
File opened (read-only)	\??\V:	Gaara.exe
File opened (read-only)	\??\U:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\X:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\Y:	Gaara.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\N:	csrss.exe
File opened (read-only)	\??\M:	system32.exe
File opened (read-only)	\??\O:	Kazekage.exe
File opened (read-only)	\??\I:	system32.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\A:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\I:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\B:	Gaara.exe
File opened (read-only)	\??\R:	csrss.exe
File opened (read-only)	\??\W:	Gaara.exe
File opened (read-only)	\??\A:	system32.exe
File opened (read-only)	\??\L:	system32.exe
File opened (read-only)	\??\E:	Kazekage.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\G:	Gaara.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\L:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\O:	csrss.exe
File opened (read-only)	\??\O:	system32.exe
File opened (read-only)	\??\Y:	system32.exe
File opened (read-only)	\??\A:	Kazekage.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\Q:	Kazekage.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\R:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\J:	Kazekage.exe
File opened (read-only)	\??\L:	Kazekage.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\G:	system32.exe
File opened (read-only)	\??\P:	Kazekage.exe
File opened (read-only)	\??\S:	Gaara.exe
File opened (read-only)	\??\J:	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\G:\Autorun.inf	csrss.exe
File created	\??\V:\Autorun.inf	Kazekage.exe
File created	\??\L:\Autorun.inf	system32.exe
File created	\??\V:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\I:\Autorun.inf	smss.exe
File created	\??\Q:\Autorun.inf	csrss.exe
File opened for modification	C:\Autorun.inf	Kazekage.exe
File created	\??\M:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	F:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\U:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\S:\Autorun.inf	Gaara.exe
File opened for modification	C:\Autorun.inf	csrss.exe
File opened for modification	\??\V:\Autorun.inf	Kazekage.exe
File created	\??\J:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\H:\Autorun.inf	smss.exe
File created	\??\W:\Autorun.inf	smss.exe
File created	\??\N:\Autorun.inf	csrss.exe
File opened for modification	\??\B:\Autorun.inf	system32.exe
File opened for modification	\??\K:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\T:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\S:\Autorun.inf	smss.exe
File created	\??\E:\Autorun.inf	Kazekage.exe
File created	\??\L:\Autorun.inf	Kazekage.exe
File opened for modification	\??\S:\Autorun.inf	Kazekage.exe
File created	\??\U:\Autorun.inf	Kazekage.exe
File opened for modification	F:\Autorun.inf	smss.exe
File opened for modification	F:\Autorun.inf	Gaara.exe
File opened for modification	\??\P:\Autorun.inf	csrss.exe
File opened for modification	\??\N:\Autorun.inf	Kazekage.exe
File opened for modification	\??\X:\Autorun.inf	Kazekage.exe
File opened for modification	\??\T:\Autorun.inf	system32.exe
File opened for modification	\??\Y:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\N:\Autorun.inf	smss.exe
File created	\??\U:\Autorun.inf	csrss.exe
File created	D:\Autorun.inf	Kazekage.exe
File created	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	C:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	F:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Autorun.inf	smss.exe
File opened for modification	\??\E:\Autorun.inf	Gaara.exe
File created	\??\X:\Autorun.inf	Gaara.exe
File opened for modification	\??\G:\Autorun.inf	csrss.exe
File opened for modification	\??\I:\Autorun.inf	csrss.exe
File opened for modification	\??\T:\Autorun.inf	Kazekage.exe
File created	\??\I:\Autorun.inf	system32.exe
File opened for modification	\??\O:\Autorun.inf	system32.exe
File created	\??\P:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\M:\Autorun.inf	csrss.exe
File created	\??\P:\Autorun.inf	Kazekage.exe
File created	\??\X:\Autorun.inf	system32.exe
File created	D:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Q:\Autorun.inf	Kazekage.exe
File opened for modification	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	\??\M:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\L:\Autorun.inf	csrss.exe
File opened for modification	\??\Q:\Autorun.inf	csrss.exe
File opened for modification	\??\G:\Autorun.inf	Kazekage.exe
File opened for modification	\??\J:\Autorun.inf	Kazekage.exe
File opened for modification	\??\L:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Q:\Autorun.inf	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\P:\Autorun.inf	Gaara.exe
File opened for modification	F:\Autorun.inf	Kazekage.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	smss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	system32.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File created	C:\Windows\SysWOW64\7-5-2025.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File opened for modification	C:\Windows\SysWOW64\7-5-2025.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5772-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09b-11.dat	upx
behavioral2/files/0x001900000002b099-31.dat	upx
behavioral2/memory/4980-34-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09a-41.dat	upx
behavioral2/memory/2372-70-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5056-79-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09d-93.dat	upx
behavioral2/files/0x001900000002b09b-85.dat	upx
behavioral2/files/0x001900000002b09c-89.dat	upx
behavioral2/memory/2372-78-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09e-97.dat	upx
behavioral2/memory/4556-114-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4556-119-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4212-122-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09e-138.dat	upx
behavioral2/memory/5772-151-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4980-156-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3548-163-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5996-167-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2964-170-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b09d-171.dat	upx
behavioral2/files/0x001900000002b09c-177.dat	upx
behavioral2/files/0x001900000002b09e-181.dat	upx
behavioral2/memory/5056-195-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4392-201-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3164-221-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2068-225-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2068-233-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-239-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1816-238-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2964-252-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5148-258-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3700-264-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5540-260-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4212-216-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4392-215-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3328-211-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4696-269-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4696-273-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1400-277-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4660-281-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4940-282-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4940-286-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-289-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2556-291-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3220-298-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3360-301-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5980-305-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4212-306-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2964-307-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5772-308-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4980-309-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-310-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5056-311-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4980-370-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5056-429-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b0df-501.dat	upx
behavioral2/memory/5772-530-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2964-531-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4212-584-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1676-588-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File created	C:\Windows\mscomctl.ocx	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	smss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\system\mscoree.dll	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	Gaara.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\msvbvm60.dll	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	csrss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	system32.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5068	ping.exe
4572	ping.exe
2508	ping.exe
4896	ping.exe
5368	ping.exe
2728	ping.exe
2544	ping.exe
2708	ping.exe
5852	ping.exe
3796	ping.exe
1184	ping.exe
4432	ping.exe
1960	ping.exe
4924	ping.exe
4872	ping.exe
5728	ping.exe
5748	ping.exe
3152	ping.exe
2580	ping.exe
2388	ping.exe
4760	ping.exe
4888	ping.exe
4680	ping.exe
6036	ping.exe
1056	ping.exe
1892	ping.exe
748	ping.exe
2448	ping.exe
5864	ping.exe
584	ping.exe
3900	ping.exe
4832	ping.exe
4340	ping.exe
4908	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\WallpaperStyle = "2"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\WallpaperStyle = "2"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe

Runs ping.exe 1 TTPs 34 IoCs

Remote System Discovery

T1018

pid	Process
1056	ping.exe
584	ping.exe
4872	ping.exe
1960	ping.exe
2508	ping.exe
748	ping.exe
1184	ping.exe
4432	ping.exe
2544	ping.exe
4572	ping.exe
1892	ping.exe
2388	ping.exe
4760	ping.exe
5728	ping.exe
2580	ping.exe
2448	ping.exe
4340	ping.exe
4680	ping.exe
6036	ping.exe
5852	ping.exe
4908	ping.exe
3900	ping.exe
3796	ping.exe
4832	ping.exe
2728	ping.exe
2708	ping.exe
4924	ping.exe
5368	ping.exe
5748	ping.exe
4888	ping.exe
5068	ping.exe
3152	ping.exe
5864	ping.exe
4896	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
5056	Gaara.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe
4212	csrss.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
4980	smss.exe
2372	smss.exe
5056	Gaara.exe
572	smss.exe
4556	Gaara.exe
4212	csrss.exe
2748	smss.exe
3548	Gaara.exe
5996	csrss.exe
2964	Kazekage.exe
2780	smss.exe
4392	Gaara.exe
3164	Gaara.exe
3328	csrss.exe
2180	csrss.exe
2068	Kazekage.exe
1816	Kazekage.exe
1676	system32.exe
5148	system32.exe
5540	smss.exe
3700	Gaara.exe
4696	csrss.exe
1400	Kazekage.exe
4660	system32.exe
4940	system32.exe
2556	Kazekage.exe
3220	system32.exe
1948	csrss.exe
3360	Kazekage.exe
5980	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 4980	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	82
PID 5772 wrote to memory of 4980	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	82
PID 5772 wrote to memory of 4980	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	82
PID 4980 wrote to memory of 2372	4980	smss.exe	85
PID 4980 wrote to memory of 2372	4980	smss.exe	85
PID 4980 wrote to memory of 2372	4980	smss.exe	85
PID 4980 wrote to memory of 5056	4980	smss.exe	86
PID 4980 wrote to memory of 5056	4980	smss.exe	86
PID 4980 wrote to memory of 5056	4980	smss.exe	86
PID 5056 wrote to memory of 572	5056	Gaara.exe	87
PID 5056 wrote to memory of 572	5056	Gaara.exe	87
PID 5056 wrote to memory of 572	5056	Gaara.exe	87
PID 5056 wrote to memory of 4556	5056	Gaara.exe	88
PID 5056 wrote to memory of 4556	5056	Gaara.exe	88
PID 5056 wrote to memory of 4556	5056	Gaara.exe	88
PID 5056 wrote to memory of 4212	5056	Gaara.exe	89
PID 5056 wrote to memory of 4212	5056	Gaara.exe	89
PID 5056 wrote to memory of 4212	5056	Gaara.exe	89
PID 4212 wrote to memory of 2748	4212	csrss.exe	90
PID 4212 wrote to memory of 2748	4212	csrss.exe	90
PID 4212 wrote to memory of 2748	4212	csrss.exe	90
PID 4212 wrote to memory of 3548	4212	csrss.exe	91
PID 4212 wrote to memory of 3548	4212	csrss.exe	91
PID 4212 wrote to memory of 3548	4212	csrss.exe	91
PID 4212 wrote to memory of 5996	4212	csrss.exe	92
PID 4212 wrote to memory of 5996	4212	csrss.exe	92
PID 4212 wrote to memory of 5996	4212	csrss.exe	92
PID 4212 wrote to memory of 2964	4212	csrss.exe	94
PID 4212 wrote to memory of 2964	4212	csrss.exe	94
PID 4212 wrote to memory of 2964	4212	csrss.exe	94
PID 2964 wrote to memory of 2780	2964	Kazekage.exe	95
PID 2964 wrote to memory of 2780	2964	Kazekage.exe	95
PID 2964 wrote to memory of 2780	2964	Kazekage.exe	95
PID 2964 wrote to memory of 4392	2964	Kazekage.exe	96
PID 2964 wrote to memory of 4392	2964	Kazekage.exe	96
PID 2964 wrote to memory of 4392	2964	Kazekage.exe	96
PID 5772 wrote to memory of 3164	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 5772 wrote to memory of 3164	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 5772 wrote to memory of 3164	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 2964 wrote to memory of 3328	2964	Kazekage.exe	98
PID 2964 wrote to memory of 3328	2964	Kazekage.exe	98
PID 2964 wrote to memory of 3328	2964	Kazekage.exe	98
PID 5772 wrote to memory of 2180	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 5772 wrote to memory of 2180	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 5772 wrote to memory of 2180	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 2964 wrote to memory of 2068	2964	Kazekage.exe	100
PID 2964 wrote to memory of 2068	2964	Kazekage.exe	100
PID 2964 wrote to memory of 2068	2964	Kazekage.exe	100
PID 5772 wrote to memory of 1816	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 5772 wrote to memory of 1816	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 5772 wrote to memory of 1816	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 2964 wrote to memory of 1676	2964	Kazekage.exe	102
PID 2964 wrote to memory of 1676	2964	Kazekage.exe	102
PID 2964 wrote to memory of 1676	2964	Kazekage.exe	102
PID 5772 wrote to memory of 5148	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	103
PID 5772 wrote to memory of 5148	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	103
PID 5772 wrote to memory of 5148	5772	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe	103
PID 1676 wrote to memory of 5540	1676	system32.exe	104
PID 1676 wrote to memory of 5540	1676	system32.exe	104
PID 1676 wrote to memory of 5540	1676	system32.exe	104
PID 1676 wrote to memory of 3700	1676	system32.exe	105
PID 1676 wrote to memory of 3700	1676	system32.exe	105
PID 1676 wrote to memory of 3700	1676	system32.exe	105
PID 1676 wrote to memory of 4696	1676	system32.exe	106

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-07_7961555feace375700836f3d5f529409_black-basta_elex_hijackloader_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5772
- C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4980
- - C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2372
- - C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5056
  - - C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:572
  - - C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4556
  - - C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4212
    - - C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
    - - C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3548
    - - C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5996
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2964
      - C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3328
      - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1676
        
        C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5540
        
        C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3700
        
        C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4696
        
        C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4660
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2708
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4340
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1056
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5852
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1892
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3796
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2448
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1184
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4760
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3900
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4940
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2544
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5748
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5864
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2580
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4908
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4872
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2556
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3220
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5728
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2728
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3152
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6036
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4924
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2508
- - C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1948
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3360
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5980
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5368
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:748
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4432
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4680
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2388
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1960
- C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3164
- C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2180
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1816
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5148
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4832
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4896
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4888
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5068
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4572
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 7 - 5 - 2025\smss.exe
1⤵
PID:5324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 7 - 5 - 2025\Gaara.exe
1⤵
PID:1228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 7-5-2025.exe
1⤵
PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Anbu Team Sampit (Nothing).exe

Path C:\Admin Games\Anbu Team Sampit (Nothing).exe
Size 9.4MB
SHA256 4a8d28543009ddd0761ddc4d6561745c3267c33f858128d264679cc073a62ae6
MD5 c48e6200b0741436a08fa8b044a1de3c
SHA1 8206a07f9116de298c67ef66514d5b4357bf04bb
SHA512 0513e42f1f9c966b24031e48e7f35c856a5367420ebd757bced092ea458b2b7ee62ca4937396479e7652299e11f38594747fc9c590e6dad1e4dff31c45c7636b
SSDEEP 98304:0GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:B1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Readme.txt

Path C:\Admin Games\Readme.txt
Size 736B
SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Autorun.inf
Size 196B
SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
MD5 1564dfe69ffed40950e5cb644e0894d1
SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
MD5 SHA1 SHA512

Submit Download

Gaara.exe

Path C:\Windows\Fonts\Admin 7 - 5 - 2025\Gaara.exe
Size 4.3MB
SHA256 c7643f0fed7489471cc61ae6633d10aa342a40dc3bfd0cfc2803243d4c2d49b5
MD5 9682a0037f6e805bae79d74d56e215aa
SHA1 2444181d23e5657f49c76a4f71ee403e091d9d1b
SHA512 4c43ea02a75d47722203904421b499e34537e85aae1f58311a932353f9091b4b8b7d3131e8723443947f140109ae047ffb39106e5b0bc35af9a946e21c1bb016
SSDEEP 24576:AVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:AGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
Size 9.4MB
SHA256 dbbf8868f4a98a4743d55b3a2b4e179ea64b36400c5146440747769ffcf6a25b
MD5 7961555feace375700836f3d5f529409
SHA1 053d184e6dbdb75a56535c6eb50497fba4c20b7b
SHA512 d1840de8ac3107b90dc2491bf1292e3faf4ace72b76e1b6b6498916af08facc60b9359dadad5f1e9d7f1ecf7b2102da4e0f7dd9e2c9909176f38d9fbc41e9465
SSDEEP 98304:+GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:D1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 7 - 5 - 2025\csrss.exe
Size 9.4MB
SHA256 7dc15066d134263c1fe5dfc83a8eccbf1ab7c517554a7779a5d1709aa7e85ceb
MD5 97b81c755cbaceb0b46cb8e55efc979a
SHA1 fb59decd819f5bc61bc5349328fb991a8adda504
SHA512 ecfe71e0c2bbbc16562e364ab060158fc76541c314a5ab155a75116cecae23c335d66271e58606f6e44f8afdde22d3355f8d36e10e3b4be30fdab104d5d9cf70
SSDEEP 98304:qGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:P1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\Fonts\Admin 7 - 5 - 2025\smss.exe
Size 9.4MB
SHA256 6221ec4bf4bd61f4623b6c5cbd72c43b240fcabb9a6f33c90c2602ac79611535
MD5 88db40707000569a0cb35970ab255da8
SHA1 f87d9f8f1499d056258f4bfa8752a5c93269fb19
SHA512 1146e14437d818b601120347ab43477460d6f43817c2ec75901e1c60af91b60dcf05920db75654df2b0cdf4b050f0c5daab727963d6cc6409ccb979e781cadf4
SSDEEP 98304:AGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:t1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

The Kazekage.jpg

Path C:\Windows\Fonts\The Kazekage.jpg
Size 1.4MB
SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
MD5 d6b05020d4a0ec2a3a8b687099e335df
SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-5-2025.exe

Path C:\Windows\SysWOW64\7-5-2025.exe
Size 4.3MB
SHA256 a985def04f6a198e852af5ecef8ee8cb738b42f9d0fd625179e5fd0691c84708
MD5 e322b2f1b4dda79734d592a7302f230d
SHA1 b3f960c8d245857dd5dfacf0adb30a610d5ea4a7
SHA512 78a559e4e8bfaae1c825a566a848dd17b9ba1890ec483ff20d698ad3811c6d698c57ec643fde99581f8cbc4952b2d5903993e97aacc646079b1961e945c6d615
SSDEEP 24576:QVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:QGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-5-2025.exe

Path C:\Windows\SysWOW64\7-5-2025.exe
Size 9.4MB
SHA256 a957ad726b840d07e3652883dcbc191a7d2ee40d043a9427efdf36d13e59af98
MD5 bf2d2058f8e09ef362c63137addc52a3
SHA1 b6142345c6a3ce399f352a9c741d70575bb14451
SHA512 22130e2dd270a10dcb65259c795d7d1202fc72cab3254d585e9ceb5db7074cae60ceeab802ee8a56224870f00a255bc0909752625e3972c3f4ccd2b75c57d361
SSDEEP 98304:cGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:Z1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.ini

Path C:\Windows\SysWOW64\Desktop.ini
Size 65B
SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
MD5 64acfa7e03b01f48294cf30d201a0026
SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
MD5 SHA1 SHA512

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.4MB
SHA256 c53fe40a918f2253e57e7e700995314882d2202bc4adb88e73d239ed07803f1d
MD5 4ce534ddb024c561b9615a07328bcb9a
SHA1 2f25e45b5da3a767c73807c418e34e207ff08035
SHA512 1f8760cfb0bd9d40b9a7059ed69f0cb823c8c7d182fcde5662a858cb5505b4b659f4856e7974bf89a79085863fba4bd85402901e0bfab20d1b2c5e213a789c4c
SSDEEP 98304:QGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:91eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.4MB
SHA256 f6e0417788715da06d94921e8256224e604ee4f855217db0c9e4450a2f3ddd3d
MD5 05e82a3a89e6796859fbebc55f6bf71f
SHA1 1981df04d0a002e3389b6c474ec477e9fd2fe9b2
SHA512 6fd432aaf0dd7b3169da0f8bfa4631308a77624221ba8ecf4116942ba305cb3ca92dde4a9b783ba4659d1d0d785214ff165cdf968a0ab466aa53a10cd75f4139
SSDEEP 98304:nGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:g1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 d1489071a639669a82efac0ff43814c512a08eb61ddf935382e982bf0706997b
MD5 561343370660e64e291b630e742a9ce7
SHA1 d69d646ad936550adf4a9413c004ed6607e58299
SHA512 10d1798222c7f701edd8cce8e1c2d44266c44aede0e9622eb7a129892abc2afbf1454a306e38f349e530d98fd5fd4e5b3bafaca7d61a27acd44b9bcb8724ffc4
SSDEEP 98304:kGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:x1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 39b5b1711306355d196cacd0f3eecc1e09fc2d94dac213977488f621481057f9
MD5 e231903555c3a2a8729b20218974d0c6
SHA1 67a65df4980f9addc099918b2c7ea8be1d0d4c80
SHA512 30e373025ab42f1cd90674ac9120f0724869c037e446f8f79109e7817b1b69cddd52e9527d8599a913b5e22bd5445b2236950d010174b6b54d403a07964d2335
SSDEEP 98304:uGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:z1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 27da02674f23b444dee77add713f7f03e09917f4b5e826cf064767df689fceb9
MD5 69ed4a182baca055b83f266c54aa0327
SHA1 5c9730ebecf1581c5af7e7f91826f165cf4b4123
SHA512 1e77cbdfb4fa0aa332d00a2481b7a1e1f4b5d71613858ee0b9a43ca07ee675c77ab43cfa370e0096d15a61f9200e3f90d5b0cc98e2f230b08468a263469af327
SSDEEP 98304:XGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvF:Q1eHL5dEvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\System\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-277-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1676-310-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1676-239-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1676-588-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1676-289-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1816-238-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2068-225-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2068-233-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2372-70-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2372-78-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2556-291-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2964-252-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2964-531-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2964-170-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2964-307-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3164-221-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3220-298-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3328-211-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3360-301-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3548-163-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3700-264-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4212-584-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4212-216-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4212-122-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4212-306-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4392-201-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4392-215-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4556-114-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4556-119-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4660-281-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4696-273-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4696-269-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4940-282-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4940-286-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-156-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-34-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-370-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-309-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-429-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-311-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-79-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-195-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5148-258-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5540-260-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5772-151-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5772-308-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5772-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5772-530-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5980-305-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5996-167-0x0000000000400000-0x000000000042A000-memory.dmp

Download