7fb34f8a0d81afe0a5a778e1a664f092feb6d2de0b3b74a93d98d6013a00551f

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2025, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Size

9.4MB
MD5

4ce0c6c4a5d7e956f49ee2c1d3320ede
SHA1

3b534c5727a76bb73893e4f25ef1df407b644db6
SHA256

7fb34f8a0d81afe0a5a778e1a664f092feb6d2de0b3b74a93d98d6013a00551f
SHA512

6869293b885127ecb6726009124bcb915df039baebd7ba16b3c524e02d406fd3be51541c8701bbc3d5d11bd6473b67cc37bb4fba4da43f0bc2aad4f66a36adc1
SSDEEP

98304:OGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvc:T1eHL5dEvc

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Kazekage.exe

Executes dropped EXE 30 IoCs

pid	Process
1488	smss.exe
2660	smss.exe
4572	Gaara.exe
4776	smss.exe
2804	Gaara.exe
2964	csrss.exe
744	smss.exe
4944	Gaara.exe
5000	Gaara.exe
5012	csrss.exe
5040	csrss.exe
1164	Kazekage.exe
6092	Kazekage.exe
4040	system32.exe
5108	smss.exe
4676	csrss.exe
3568	Kazekage.exe
3128	Gaara.exe
4204	smss.exe
1908	system32.exe
4300	Kazekage.exe
2872	csrss.exe
5920	Gaara.exe
3132	system32.exe
3332	Kazekage.exe
2780	csrss.exe
3276	system32.exe
1404	Kazekage.exe
5700	system32.exe
4436	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
1488	smss.exe
2660	smss.exe
4572	Gaara.exe
4776	smss.exe
2804	Gaara.exe
2964	csrss.exe
744	smss.exe
4944	Gaara.exe
5000	Gaara.exe
5012	csrss.exe
5040	csrss.exe
5108	smss.exe
4676	csrss.exe
3128	Gaara.exe
4204	smss.exe
2872	csrss.exe
5920	Gaara.exe
2780	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 8 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "8-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 8 - 5 - 2025\\smss.exe"	smss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\L:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\X:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Q:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	Gaara.exe
File opened for modification	F:\Desktop.ini	smss.exe
File opened for modification	\??\V:\Desktop.ini	smss.exe
File opened for modification	\??\X:\Desktop.ini	smss.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	\??\J:\Desktop.ini	Gaara.exe
File opened for modification	\??\Z:\Desktop.ini	smss.exe
File opened for modification	\??\U:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	\??\H:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\V:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\E:\Desktop.ini	Gaara.exe
File opened for modification	\??\O:\Desktop.ini	Gaara.exe
File opened for modification	\??\B:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\T:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\L:\Desktop.ini	system32.exe
File opened for modification	\??\B:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	Gaara.exe
File opened for modification	\??\I:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	Gaara.exe
File opened for modification	\??\M:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\U:\Desktop.ini	system32.exe
File opened for modification	\??\M:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	system32.exe
File opened for modification	\??\J:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	\??\G:\Desktop.ini	csrss.exe
File opened for modification	\??\T:\Desktop.ini	csrss.exe
File opened for modification	\??\W:\Desktop.ini	csrss.exe
File opened for modification	\??\Q:\Desktop.ini	smss.exe
File opened for modification	C:\Desktop.ini	Kazekage.exe
File opened for modification	\??\G:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	system32.exe
File opened for modification	F:\Desktop.ini	Kazekage.exe
File opened for modification	\??\R:\Desktop.ini	smss.exe
File opened for modification	C:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\K:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Z:\Desktop.ini	system32.exe
File opened for modification	\??\G:\Desktop.ini	Gaara.exe
File opened for modification	\??\S:\Desktop.ini	smss.exe
File opened for modification	\??\U:\Desktop.ini	smss.exe
File opened for modification	\??\Z:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\L:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	system32.exe
File opened for modification	\??\S:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	smss.exe
File opened for modification	\??\Q:\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\E:\Desktop.ini	csrss.exe
File opened for modification	\??\B:\Desktop.ini	smss.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\B:\Desktop.ini	system32.exe
File opened for modification	F:\Desktop.ini	system32.exe
File opened for modification	F:\Desktop.ini	Gaara.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\N:\Desktop.ini	Kazekage.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\Q:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\G:	csrss.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\K:	system32.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\Z:	Gaara.exe
File opened (read-only)	\??\O:	Kazekage.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\L:	system32.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\N:	Gaara.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\R:	Kazekage.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\B:	Kazekage.exe
File opened (read-only)	\??\N:	Kazekage.exe
File opened (read-only)	\??\K:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\L:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\M:	Gaara.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\Q:	Gaara.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\P:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\A:	Kazekage.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\R:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\E:	Gaara.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\N:	system32.exe
File opened (read-only)	\??\O:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\J:	csrss.exe
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\W:	system32.exe
File opened (read-only)	\??\L:	Kazekage.exe
File opened (read-only)	\??\P:	Kazekage.exe
File opened (read-only)	\??\U:	Kazekage.exe
File opened (read-only)	\??\E:	Kazekage.exe
File opened (read-only)	\??\K:	Kazekage.exe
File opened (read-only)	\??\A:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\J:	system32.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\R:	Gaara.exe
File opened (read-only)	\??\U:	Gaara.exe
File opened (read-only)	\??\W:	Kazekage.exe
File opened (read-only)	\??\J:	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\R:	system32.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\Q:	Kazekage.exe
File opened (read-only)	\??\S:	Kazekage.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\J:	Kazekage.exe
File opened (read-only)	\??\Z:	smss.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\V:\Autorun.inf	smss.exe
File opened for modification	\??\A:\Autorun.inf	Gaara.exe
File created	\??\A:\Autorun.inf	smss.exe
File opened for modification	\??\P:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\R:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\O:\Autorun.inf	Kazekage.exe
File opened for modification	\??\X:\Autorun.inf	smss.exe
File opened for modification	\??\V:\Autorun.inf	Gaara.exe
File opened for modification	\??\B:\Autorun.inf	csrss.exe
File created	\??\W:\Autorun.inf	csrss.exe
File opened for modification	\??\U:\Autorun.inf	Kazekage.exe
File opened for modification	D:\Autorun.inf	system32.exe
File opened for modification	\??\W:\Autorun.inf	system32.exe
File opened for modification	C:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	D:\Autorun.inf	Kazekage.exe
File opened for modification	C:\Autorun.inf	system32.exe
File created	\??\I:\Autorun.inf	system32.exe
File opened for modification	\??\Q:\Autorun.inf	system32.exe
File opened for modification	\??\Z:\Autorun.inf	smss.exe
File opened for modification	\??\W:\Autorun.inf	csrss.exe
File created	\??\W:\Autorun.inf	Kazekage.exe
File opened for modification	\??\M:\Autorun.inf	Gaara.exe
File created	\??\L:\Autorun.inf	csrss.exe
File created	\??\T:\Autorun.inf	csrss.exe
File opened for modification	\??\Y:\Autorun.inf	Kazekage.exe
File opened for modification	\??\G:\Autorun.inf	system32.exe
File created	\??\M:\Autorun.inf	system32.exe
File created	\??\Y:\Autorun.inf	system32.exe
File created	\??\I:\Autorun.inf	smss.exe
File opened for modification	\??\J:\Autorun.inf	Gaara.exe
File created	\??\B:\Autorun.inf	Kazekage.exe
File created	\??\A:\Autorun.inf	system32.exe
File opened for modification	\??\H:\Autorun.inf	system32.exe
File opened for modification	\??\E:\Autorun.inf	Gaara.exe
File opened for modification	\??\A:\Autorun.inf	Kazekage.exe
File opened for modification	\??\B:\Autorun.inf	system32.exe
File opened for modification	\??\O:\Autorun.inf	system32.exe
File created	\??\U:\Autorun.inf	system32.exe
File created	\??\L:\Autorun.inf	smss.exe
File created	\??\P:\Autorun.inf	smss.exe
File opened for modification	\??\V:\Autorun.inf	csrss.exe
File created	\??\L:\Autorun.inf	Kazekage.exe
File created	\??\M:\Autorun.inf	Kazekage.exe
File created	\??\O:\Autorun.inf	system32.exe
File created	\??\Q:\Autorun.inf	system32.exe
File created	\??\B:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\I:\Autorun.inf	Gaara.exe
File opened for modification	\??\L:\Autorun.inf	Gaara.exe
File opened for modification	\??\R:\Autorun.inf	csrss.exe
File created	\??\G:\Autorun.inf	system32.exe
File created	\??\V:\Autorun.inf	system32.exe
File opened for modification	\??\X:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\E:\Autorun.inf	smss.exe
File created	\??\B:\Autorun.inf	csrss.exe
File created	\??\N:\Autorun.inf	system32.exe
File opened for modification	\??\I:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\U:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Autorun.inf	smss.exe
File created	\??\Z:\Autorun.inf	csrss.exe
File created	D:\Autorun.inf	system32.exe
File opened for modification	\??\W:\Autorun.inf	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\S:\Autorun.inf	Gaara.exe
File created	\??\J:\Autorun.inf	csrss.exe
File opened for modification	\??\N:\Autorun.inf	csrss.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File created	C:\Windows\SysWOW64\8-5-2025.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	csrss.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\8-5-2025.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3948-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0007000000024169-11.dat	upx
behavioral1/memory/1488-32-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000800000002415f-31.dat	upx
behavioral1/files/0x0007000000024169-46.dat	upx
behavioral1/files/0x000700000002416a-49.dat	upx
behavioral1/files/0x000700000002416b-53.dat	upx
behavioral1/files/0x000700000002416c-57.dat	upx
behavioral1/memory/2660-70-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2660-74-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0008000000024160-76.dat	upx
behavioral1/memory/4572-77-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002416c-97.dat	upx
behavioral1/memory/4776-115-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2804-118-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2964-121-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0007000000024169-120.dat	upx
behavioral1/memory/3948-126-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002416c-139.dat	upx
behavioral1/memory/744-152-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1488-151-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002416b-134.dat	upx
behavioral1/memory/4944-160-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/744-164-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5040-173-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5000-177-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4944-175-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4572-170-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2964-190-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1164-188-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5040-184-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1164-200-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002416a-201.dat	upx
behavioral1/memory/5108-218-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4040-215-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3128-235-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5108-237-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4676-239-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3568-234-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4300-254-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1908-253-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6092-252-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3568-258-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2872-263-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3128-266-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4040-268-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4300-274-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4204-272-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1908-270-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2872-283-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5920-287-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3132-291-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3332-293-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2780-297-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3276-301-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1404-305-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4436-310-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3948-311-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1488-312-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6092-313-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4572-314-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4040-315-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2964-316-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1488-318-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	Kazekage.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\mscomctl.ocx	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	csrss.exe
File opened for modification	C:\Windows\system\mscoree.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\msvbvm60.dll	csrss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Kazekage.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\	csrss.exe
File opened for modification	C:\Windows\system\mscoree.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\	system32.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	system32.exe
File opened for modification	C:\Windows\system\mscoree.dll	system32.exe
File created	C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\	Gaara.exe
File opened for modification	C:\Windows\	Kazekage.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Gaara.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3204	ping.exe
4684	ping.exe
1748	ping.exe
5540	ping.exe
5484	ping.exe
3844	ping.exe
3564	ping.exe
5556	ping.exe
4480	ping.exe
4792	ping.exe
4988	ping.exe
1636	ping.exe
1720	ping.exe
3940	ping.exe
208	ping.exe
4160	ping.exe
4004	ping.exe
5652	ping.exe
6132	ping.exe
5972	ping.exe
3708	ping.exe
2500	ping.exe
3172	ping.exe
4208	ping.exe
6080	ping.exe
3132	ping.exe
1112	ping.exe
1472	ping.exe
4604	ping.exe
5300	ping.exe
2696	ping.exe
116	ping.exe
2324	ping.exe
4764	ping.exe
5480	ping.exe
1744	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\WallpaperStyle = "2"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Size = "72"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\WallpaperStyle = "2"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Size = "72"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe

Runs ping.exe 1 TTPs 36 IoCs

Remote System Discovery

T1018

pid	Process
1472	ping.exe
3172	ping.exe
1636	ping.exe
4004	ping.exe
1748	ping.exe
1720	ping.exe
6132	ping.exe
4764	ping.exe
1744	ping.exe
5652	ping.exe
3708	ping.exe
3564	ping.exe
6080	ping.exe
2696	ping.exe
4480	ping.exe
5484	ping.exe
5972	ping.exe
3132	ping.exe
1112	ping.exe
5556	ping.exe
4208	ping.exe
4684	ping.exe
4604	ping.exe
3844	ping.exe
116	ping.exe
4792	ping.exe
3204	ping.exe
3940	ping.exe
4988	ping.exe
5300	ping.exe
5540	ping.exe
208	ping.exe
5480	ping.exe
2500	ping.exe
4160	ping.exe
2324	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
2964	csrss.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe
4040	system32.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
1488	smss.exe
2660	smss.exe
4572	Gaara.exe
4776	smss.exe
2804	Gaara.exe
2964	csrss.exe
744	smss.exe
4944	Gaara.exe
5000	Gaara.exe
5012	csrss.exe
5040	csrss.exe
6092	Kazekage.exe
1164	Kazekage.exe
4040	system32.exe
5108	smss.exe
4676	csrss.exe
3568	Kazekage.exe
3128	Gaara.exe
1908	system32.exe
4204	smss.exe
4300	Kazekage.exe
2872	csrss.exe
5920	Gaara.exe
3132	system32.exe
3332	Kazekage.exe
2780	csrss.exe
3276	system32.exe
1404	Kazekage.exe
5700	system32.exe
4436	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1488	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	88
PID 3948 wrote to memory of 1488	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	88
PID 3948 wrote to memory of 1488	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	88
PID 1488 wrote to memory of 2660	1488	smss.exe	89
PID 1488 wrote to memory of 2660	1488	smss.exe	89
PID 1488 wrote to memory of 2660	1488	smss.exe	89
PID 1488 wrote to memory of 4572	1488	smss.exe	90
PID 1488 wrote to memory of 4572	1488	smss.exe	90
PID 1488 wrote to memory of 4572	1488	smss.exe	90
PID 4572 wrote to memory of 4776	4572	Gaara.exe	91
PID 4572 wrote to memory of 4776	4572	Gaara.exe	91
PID 4572 wrote to memory of 4776	4572	Gaara.exe	91
PID 4572 wrote to memory of 2804	4572	Gaara.exe	92
PID 4572 wrote to memory of 2804	4572	Gaara.exe	92
PID 4572 wrote to memory of 2804	4572	Gaara.exe	92
PID 4572 wrote to memory of 2964	4572	Gaara.exe	93
PID 4572 wrote to memory of 2964	4572	Gaara.exe	93
PID 4572 wrote to memory of 2964	4572	Gaara.exe	93
PID 2964 wrote to memory of 744	2964	csrss.exe	94
PID 2964 wrote to memory of 744	2964	csrss.exe	94
PID 2964 wrote to memory of 744	2964	csrss.exe	94
PID 3948 wrote to memory of 4944	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 3948 wrote to memory of 4944	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 3948 wrote to memory of 4944	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	95
PID 2964 wrote to memory of 5000	2964	csrss.exe	96
PID 2964 wrote to memory of 5000	2964	csrss.exe	96
PID 2964 wrote to memory of 5000	2964	csrss.exe	96
PID 3948 wrote to memory of 5012	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 3948 wrote to memory of 5012	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 3948 wrote to memory of 5012	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	97
PID 2964 wrote to memory of 5040	2964	csrss.exe	98
PID 2964 wrote to memory of 5040	2964	csrss.exe	98
PID 2964 wrote to memory of 5040	2964	csrss.exe	98
PID 2964 wrote to memory of 6092	2964	csrss.exe	100
PID 2964 wrote to memory of 6092	2964	csrss.exe	100
PID 2964 wrote to memory of 6092	2964	csrss.exe	100
PID 3948 wrote to memory of 1164	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 3948 wrote to memory of 1164	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 3948 wrote to memory of 1164	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	99
PID 6092 wrote to memory of 5108	6092	Kazekage.exe	102
PID 6092 wrote to memory of 5108	6092	Kazekage.exe	102
PID 6092 wrote to memory of 5108	6092	Kazekage.exe	102
PID 3948 wrote to memory of 4040	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 3948 wrote to memory of 4040	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 3948 wrote to memory of 4040	3948	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe	101
PID 1488 wrote to memory of 4676	1488	smss.exe	103
PID 1488 wrote to memory of 4676	1488	smss.exe	103
PID 1488 wrote to memory of 4676	1488	smss.exe	103
PID 6092 wrote to memory of 3128	6092	Kazekage.exe	104
PID 6092 wrote to memory of 3128	6092	Kazekage.exe	104
PID 6092 wrote to memory of 3128	6092	Kazekage.exe	104
PID 1488 wrote to memory of 3568	1488	smss.exe	105
PID 1488 wrote to memory of 3568	1488	smss.exe	105
PID 1488 wrote to memory of 3568	1488	smss.exe	105
PID 4040 wrote to memory of 4204	4040	system32.exe	106
PID 4040 wrote to memory of 4204	4040	system32.exe	106
PID 4040 wrote to memory of 4204	4040	system32.exe	106
PID 1488 wrote to memory of 1908	1488	smss.exe	107
PID 1488 wrote to memory of 1908	1488	smss.exe	107
PID 1488 wrote to memory of 1908	1488	smss.exe	107
PID 4572 wrote to memory of 4300	4572	Gaara.exe	108
PID 4572 wrote to memory of 4300	4572	Gaara.exe	108
PID 4572 wrote to memory of 4300	4572	Gaara.exe	108
PID 6092 wrote to memory of 2872	6092	Kazekage.exe	109

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-08_4ce0c6c4a5d7e956f49ee2c1d3320ede_amadey_black-basta_elex_hijackloader_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3948
- C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1488
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2660
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4572
  - - C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4776
  - - C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2804
  - - C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2964
    - - C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:744
    - - C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5000
    - - C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5040
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:6092
      - C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5108
      - C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3128
      - C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3332
      - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3276
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5480
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2500
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5300
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4004
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5484
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:116
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5700
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4988
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3564
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4764
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4604
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5540
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6132
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4300
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3132
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3708
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4792
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3204
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4684
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5652
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3940
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4676
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3568
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1908
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1472
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:208
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6080
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4160
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3132
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4480
- C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4944
- C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5012
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1164
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4040
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4204
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5920
- - C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2780
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1404
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4436
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5556
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3172
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1748
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2696
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5972
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3844
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2324
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1112
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1636
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4208
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1720
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 8 - 5 - 2025\smss.exe
1⤵
PID:5780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 8 - 5 - 2025\Gaara.exe
1⤵
PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 8-5-2025.exe
1⤵
PID:936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Admin Games\Readme.txt

Filesize
736B

MD5
bb5d6abdf8d0948ac6895ce7fdfbc151

SHA1
9266b7a247a4685892197194d2b9b86c8f6dddbd

SHA256
5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

SHA512
878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

Download Submit
C:\Autorun.inf

Filesize
196B

MD5
1564dfe69ffed40950e5cb644e0894d1

SHA1
201b6f7a01cc49bb698bea6d4945a082ed454ce4

SHA256
be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

SHA512
72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

Download Submit
C:\Windows\Fonts\Admin 8 - 5 - 2025\Gaara.exe

Filesize
9.4MB

MD5
3ebf5f19c9b83895abe3a60b17661aeb

SHA1
e17d170e5dbd6b0022682445ec68afcd62d27a25

SHA256
f26181148710d5e329bcaf9d01c485d26d03c3f0f470852d00b3ca5ab5ba11b2

SHA512
0bb6af33cc475b5d774e3856783a868dc881b1faff0d8731ea728fa301430d3e568c46f39a16e41f4d70ac948a6c79bccee555952b220731a5a360900b020d6c

Download Submit
C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe

Filesize
9.4MB

MD5
4ce0c6c4a5d7e956f49ee2c1d3320ede

SHA1
3b534c5727a76bb73893e4f25ef1df407b644db6

SHA256
7fb34f8a0d81afe0a5a778e1a664f092feb6d2de0b3b74a93d98d6013a00551f

SHA512
6869293b885127ecb6726009124bcb915df039baebd7ba16b3c524e02d406fd3be51541c8701bbc3d5d11bd6473b67cc37bb4fba4da43f0bc2aad4f66a36adc1

Download Submit
C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe

Filesize
9.4MB

MD5
0d0e2792f62a2fa5622cc65f4c415902

SHA1
f768859da05d7014ec3550f518d8330515306ddd

SHA256
0147250cf7eabd0a942d6ec01c26ee593f5a6c8aad815e4731218acd02c37d04

SHA512
900b44211770fe3b31a99d98a5ab1e359c677d08662b6fbfb9eb5bc0affce59ee3f38666fc443b0d2daec690a38ba5ae8b56c7ab4c023752cc23bd527a1c043e

Download Submit
C:\Windows\Fonts\Admin 8 - 5 - 2025\csrss.exe

Filesize
9.4MB

MD5
dc6103a3f58a01bfe84210c7ab57b1a2

SHA1
eab0817c6ff292a80ff828b4d698266a280db2c8

SHA256
29a5aa07b4962547b7e4387008aa5f032bcc72b81be657bee0d48c61859eeca4

SHA512
45a7eb7616c024e3ba585754406ca67d25699c3c590e36947dad9aa09cfc640acf70892c485eb6433887c6146d43ae5f06322f58bdf6e33ad87b4d45e55db52a

Download Submit
C:\Windows\Fonts\Admin 8 - 5 - 2025\smss.exe

Filesize
9.4MB

MD5
383e00d059f660ffd6adaf98e5ab0e44

SHA1
8dc29087a70ba9ef0256c200c8cf354071f88022

SHA256
546084fd1bf1886f639b9e72851ad80dcc76863d3228cfca6bf5608657b5834c

SHA512
1b2ae36a7afa80143c3867c6d5dfe4c065d9b596daf8185167ce13941c7393020bd7bfa300443335f7b817e99f873443b8c6530070fa881b3e37084820ba29ee

Download Submit
C:\Windows\Fonts\The Kazekage.jpg

Filesize
1.4MB

MD5
d6b05020d4a0ec2a3a8b687099e335df

SHA1
df239d830ebcd1cde5c68c46a7b76dad49d415f4

SHA256
9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

SHA512
78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

Download Submit
C:\Windows\SysWOW64\8-5-2025.exe

Filesize
9.4MB

MD5
e7e1df80f760eb62d0965db8c0cd3145

SHA1
e0416dfee55af148f2f35af19fdfe2af1549c777

SHA256
01b0e5c74820e949bfc0f6a0de33be07191155e7fab256ab7a7451f298262556

SHA512
06c4066380906bb0d1ea335c3bf198ab51c325a1cfc8f4d284c8093787f78e78c36199416d6105bbce58085a30e4ce4536dbf948eda1d152b34d451534fbb558

Download Submit
C:\Windows\SysWOW64\8-5-2025.exe

Filesize
9.4MB

MD5
d92a296bf5f3a1a966f5955e863463d3

SHA1
602c251bfeb5c602fbf51fff439c12b39d449249

SHA256
ccb1bf9673e2e69ecea62d3a0afdf06026ef06a776910a6b634d520ba8181a9a

SHA512
7b21356bbbe1b4af582c1ee03c7964b86e6779f98600e7b3667fb8df50c0f2047cd756ca389d028ec623a33ccf0a08888b312d74f015308a8338a43b2de49cce

Download Submit
C:\Windows\SysWOW64\Desktop.ini

Filesize
65B

MD5
64acfa7e03b01f48294cf30d201a0026

SHA1
10facd995b38a095f30b4a800fa454c0bcbf8438

SHA256
ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

SHA512
65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe

Filesize
9.4MB

MD5
b7a01ec88c6d058f8e053db30fa4ba9b

SHA1
110986e9fadabc07cb3dc4e5cf4a8bb67abffd94

SHA256
46e49bc0569e1186b96bdd5275d1f865c661c884238d09dade855bbe7f83164e

SHA512
3028028261d6baa1bb7e3f8e72da7de544681f1f85ba85c7c93add73abb46b8749b5dca58cb72bb012154ecba0f28fc7d01f31e85772ed53f3a95e1a7b534bc5

Download Submit
C:\Windows\SysWOW64\drivers\Kazekage.exe

Filesize
9.4MB

MD5
9c800797da858ec128f094448ab77377

SHA1
a6c799f48cebdca06b758d2bbd7562c9a453a967

SHA256
584ce29aa568d0a4ecf6dd250008f4d45dc0b3762523a9d180c00c98e72ae808

SHA512
a870c9fdefca044c98b83e2157f4db609dfb4c27c011bd08e1f9b9cd04bca24794d4c54bfa375a375b6a38f34ca8d23330b37517c9af11dcfb8981cc9ef9da04

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe

Filesize
9.4MB

MD5
bdbd2d8c18eefd740c27acfc8718f86b

SHA1
b04090e42bceb31aee6c97b136ff93de6c01096d

SHA256
70e5f97abb9cb77cabe9ce6e440202ec4002b3ae552692f98883759ecd902d75

SHA512
b74961ea59205ca1ca67470887fa02ca1796e8463124c08131271feb66d74cda9bd25e5df37bac0948f3a94ab58201b894dfbaac48f91cf363d9f5dae88aa80a

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe

Filesize
9.4MB

MD5
a9b6549a1b8cdeb2dbe896c271d0ad96

SHA1
266503942272d6b180d306d1f9917b447d67367f

SHA256
3ae9ebc7a704d5a4ce9f5e3c9fb03e89de8806ca1f69b1168e653bf2e456abef

SHA512
38d1ed63482fca068a3e34e51451eac46c66adbf597c71180ad550be218eadbe9192dfce6215a5dfd39c6c121d1c07437d17e2441fcec48bedd7aa8de2b9164a

Download Submit
C:\Windows\SysWOW64\drivers\system32.exe

Filesize
9.4MB

MD5
f15d716e0eb312e80ecfd42571e0e120

SHA1
ce3047f5a053cd5902a30c5c670bc7d10da68718

SHA256
6996942a63c16b8882586fe7cd4dda1fb95c9a5aa95add24cfcfc7f269aad11d

SHA512
3f8013ef8cccbf5c677447f603338d020a47104bb38a86d4ae6e9c16758f2d8dd23bec6a22bff59ecced2fbcd5fa4e1a27231f7de70cd82654bf50b678236075

Download Submit
C:\Windows\System\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
memory/744-164-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/744-152-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1164-188-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1164-200-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1404-305-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1488-32-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1488-312-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1488-151-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1488-318-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1488-502-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1908-270-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1908-253-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2660-70-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2660-74-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-297-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2804-118-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2872-263-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2872-283-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2964-190-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2964-121-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2964-547-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2964-316-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3128-235-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3128-266-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3132-291-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3276-301-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3332-293-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3568-234-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3568-258-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3948-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3948-126-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3948-311-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3948-372-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4040-315-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4040-268-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4040-593-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4040-215-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4204-272-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4300-254-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4300-274-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4436-310-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4572-525-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4572-170-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4572-314-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4572-77-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4676-239-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4776-115-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4944-175-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4944-160-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5000-177-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5040-173-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5040-184-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5108-237-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5108-218-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5920-287-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6092-313-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6092-252-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6092-591-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download