Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 20 and 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.


The most prevalent threats highlighted in this roundup are:

  • PUA.Win.Adware.Multiplug-6518212-0
    Adware
    Multiplug delivers a large number of files used to display advertisements.
  • PUA.Win.Adware.Linkury-6518171-0
    Adware
    Linkury is another browser-hijacking adware, which comes bundled with other software.
  • Win.Dropper.Temonde-6517997-0
    Dropper
    This is a trojan compiled in .Net. It performs code injection on another process to avoid detection and extend its control.
  • Win.Dropper.Chapak-6517991-0
    Dropper
    Chapak is a trojan, which makes itself persistent on the host system and contacts a server to fetch commands and potentially download other malware.
  • PUA.Win.Adware.Itorrent-6517988-0
    Adware
    This is a bundler, which installs adware and other potentially unwanted applications.
  • Win.Dropper.Vabushky-6518142-0
    Dropper
    This is a dropper, which unloads Vabushky, a ransomware, onto the local system. Vabushky encrypts local files.
  • PUA.Win.Downloader.Downloadguide-6517985-0
    Downloader
    Yet another malware that installs potentially unwanted programs and browser hijackers.
  • PUA.Win.Adware.Browsefox-6518209-0
    Adware
    Browsefox modifies the browser to display ads and change the search behavior. This adware is typically bundled with other products.
  • Win.Dropper.Gandcrab-6518210-0
    Dropper
    Gandcrab is a ransomware that was particularly prevalent this week. Samples were delivered via Word documents. While the documents were different, the executable fetched by them was the same for each campaign.

THREATS

PUA.Win.Adware.Multiplug-6518212-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
  • Value: ServerExecutable
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TYPELIB
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: DefaultConnectionSettings
  • <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
  • <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
  • <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\VERSION
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
  • Value: CachePrefix
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
  • <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
  • <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\WIN32
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
  • Value: CachePrefix
  • <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
  • <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
  • Value: Version
  • <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
  • <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\WEBAPP\STYLES
  • Value: MaxScriptStatements
  • <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
  • <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
  • Value: Version
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
  • <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32
  • <HKCU>\Software\Microsoft\Internet Explorer\Main
  • <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version
  • <HKCU>\Software\WebApp\Styles
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
  • <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
  • <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
  • <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
  • <HKLM>\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP
  • <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
  • <HKCU>\Software\WebApp
  • <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0
  • <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable

Mutexes

  • N/A

IP Addresses

  • 45[.]77[.]226[.]209

Domain Names

  • R2[.]JOBURNT[.]NET
  • R1[.]JOBURNT[.]NET
  • r2[.]joburnt[.]net
  • r1[.]joburnt[.]net
  • c2[.]allocal[.]info
  • c1[.]allocal[.]info

Files and or directories created

  • images\progressbar.gif
  • %LocalAppData%\Temp\2eB3B1f\steps\1.ini
  • %LocalAppData%\Temp\2eB3B1f\steps\3.ini
  • %LocalAppData%\Temp\2eB3B1f\images
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\SCREEN0[1]
  • %LocalAppData%\Temp\2eB3B1f\steps
  • %LocalAppData%\Temp\2eB3B1f
  • images\loader.gif

File Hashes

  • 93289f85a27f71089eddea6f139d7c41344d318f411850126d75ea51aff6733c
  • 3c2c480d23acacf31423e2b78520f88bd3bb0b481d2f43840aed1d16d0987f93
  • 598c1ca12fb83aaeade0b19ad6d18ed680c011ee085c0798eda44b97aa38644b
  • fbfe94ed1d3d11dff22ebccf7a80028f3052e863aae2b095bd700773a4d5d123
  • a9eb76def683a0ffba1ab2704c40715d133fb6884121849096fcbaf8b3e65541
  • ee92af9885b7b962d550b5c559001b71d3a5186c63edc2b84c6ee0a3d11f6038
  • 1c6c368211a29b5f69ff64da32147ba4241f62fc77d02e66e98873b024bb2046
  • d0424200836fda85e802c7c0e16aa1bcff1f9dacbc7524586244bf0c55b4c83b
  • f5d97121664e2df180bb286d808c899ff085bf67ff42e8cf4573f5a14be52b72
  • 14aee87a92ec1fc11211f5b52f6fe0c8f94c724a5a14b6ea0957ca25dedb0892
  • b8688655f68b5d395cb4914e711e1995b4123688412d7fe06372cc3c0c8267a7
  • 74ef0193265e7ca2e353a75f51fc81324669352775db867030b77687e65316f3
  • 5de9d6ebd6d3c90d5819259d4c2f8bd646a861c36d090cc955c2408d7924ee9d
  • 35a21ae4f4cdcf2681697cab80dae2a19cdd27f978e2e4875199967b100bb69c
  • 0cf84cd5e553946d61bba2ec1e0c6b988c63dda6fdfe55bb70d0e742781bdb15
  • e1a04d38648a472cfd5a87fdfaa480d2e38bcc88bda3b3e5181bbc1a2bcbba9d
  • b193e85ec1b01e95d0a4575093868f92b0179ace355b78d7f6c87541fe68b370
  • ac605db020addf7d28c6f919aca656cc97df7771801748b78d68a34fc2c07721
  • 5afa83ca67022bc19477b014e20b4613e93b3a595dfa5f317ec9d602135aa21d
  • 68fb06e263e78d0993d69c574c8508ee9fab8289310ec22542c4a686c2fbbc11
  • 632e9c757e6a7ff18b8d382161af1fd6491eb8650fc12079cbcb617d624423ae
  • cc80abc53d7720b98517f8a2321f457cd7b7a250f7ae8cd45846bab1c2558a50
  • 16878f5289a2acda314ede318c644f4a3c271f1495e6d4bea1493aa2e3a88a36
  • 1caeb8b04af0bffe857f6f7617f01d82f20177fb1a6913d46b974f62aa20ce2a
  • f8abce29ef422582ed920d36d26be5357041ceca2297442c931f70a7e4f9c8e0


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid



Umbrella








PUA.Win.Adware.Linkury-6518171-0


INDICATORS OF COMPROMISE


Registry Keys

  • N/A

Mutexes

  • N/A

IP Addresses

  • N/A

Domain Names

  • N/A

Files and or directories created

  • N/A

File Hashes

  • 91e4d7e3fe06af8180d03d35a88b13ad18c91784840b29ebbabd0897f03c85b9
  • bc3e7e29b6fe2012781ef03cf08967ee577e4ddc4f643a753eea6057474dcbdc
  • 969e8b516f4a717475e03661429ac2fa6a446ba26f8bef680e7881ebd66960c4
  • 1fe2e86e58738c48c37274e273adef72e287ce86e3f42fb65b11ae6ebb553ba2
  • 2b0d96ac5f744b63f2ccac770d7ebed16c27f42080a2e3e28d67dda778e4047e
  • 610a95d15b5b189f04d12da43450d0ab8ba84e108943c2bb3a43162e980e82cf
  • 6e5ced523eeec1ca10df59bd446f92ad5c1ed029152250457f27d2a09f6bc6c3
  • 4bf6b5977c3921c9c64a9f96082b1476a8d9c96b31e2af7435471ec1bbae21a6
  • 130ec795353581ee133a6a41ab7a546fd116d2b0144117346ef740fa15be4b98
  • a5cb5b7f01b765fcc51ff84061c609b72aae5cef1bcd795f3e5efa67c8629064
  • 1a8215183cb4bc71f6e30c3c2e72f786cf70d0ad25af0865b49d1d667d52091c
  • bb2f71514dd42d3dfa81df0cf2e5d0f7bd51b40d13925410bd02a29e9dde404f
  • d6c7b30f4cb108f802fc592e7e0aef0140b09514600b5500ad32caa83653db5f
  • 132f430515486d593e247fedff3b503d2fe96013e20660c9afe2251d34c39967
  • e45f125305d1dc217dca73fb75e89fc3243cd839ed22c46483a752b46e142d8c
  • 8037c529362ffc95eaeda800830b56892addd747a416d4ea130ae3ea27fd3b2e
  • e871b106da94ac12cb606e303279fed865c7c93b64ddbba6c758770841ef07a5
  • b07357cedc32609686210cab144e5534289a9917d6731c5d94cb3c39aa6bd375
  • 3aa333d83f3b6b631ed2576ed8fe745a5c90fbf33f3591e0e3ee1c602d7818bd
  • 79b9e3719b1825c2506c39e876fc4007d63d72d2ece87bf952d55feb652057f3
  • 0639d833c0a7d3d6fb8f9b7f92dc94cd562ac9c47060483436fe9d94c16e5135
  • 6a65245e7ed18ede739f10a4d40be6c94f6e5c98b3ed11d0eea248d5cc9ff11b
  • 6c3fd7ca8f725a51fbfbd1f9db7ee4032177c5324bc4ef5706372099d973f009
  • ff10ff4a8ab0c3fee8d071c83d46f5c6c5a9057719a373874617283c544f1b10
  • 5121d56efc3809129297ee364599222b75e77626a0650777f7c4c49345d17e5a


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid








Win.Dropper.Temonde-6517997-0


INDICATORS OF COMPROMISE


Registry Keys

  • N/A

Mutexes

  • Global\CLR_CASOFF_MUTEX

IP Addresses

  • N/A

Domain Names

  • N/A

Files and or directories created

  • N/A

File Hashes

  • b0662b7e4ca76b633d7fa52a06b4720cc853528d4400c309ed42b9f861c4d0ac
  • 47376c59afd142cadb3e254a7e63b24e1e77de31e181187c7d342104253c7574
  • ccbe3c1a79cf6b7d07e6a2fb24ef3ebc1152354b4994cd0d9b5ca94c2df46da6
  • 3a14fd4223810486654135562a655c0681fdd2974ece9176052ee5e36a0e9ea7
  • ce41b0bc6b918b0866cc195784d2ba08d33c2f599c5b7ff383390517593239be
  • ad2f25d3c2840f42c9b0d496b4125b428c5d339cff3314b55ae54e8b79ee3ed4
  • 0c37f6474d2d93a51da230b381a01da8b053248c5dfc4dbb6779d57b190f26a3
  • 870778c3c6d04c83f05805b3b0a9d56356224f7f76d42ad29ecfe882e3c20d20
  • 4620f7f7a2340f01f98b4d78f2b61aeb40a8354c91151280a3c54477a49c757d
  • 5f157c0ba35bfe6d325cdef614c9aa677d749f1651b0a1228a00089269cbdb2d
  • 93692c5ff1a68074c64d0669eeb133bf74d8946300bbf2ee03230e00e4b3a8ba
  • 94d3a893baefe31231d40934db7eb6a9fd1243b56386dfa022dc6c30cfdf16ee
  • ef05bc231e06777d5fdc77b3ca76bd167c39e31b3a728b88628a183ec9115a0c
  • e7c4eff70017f79df91242135de536cc57e808d9cfddcfcef143ac76fb6459cf
  • 1231830b27d1e59968e92f0cd5c4d4d2202eff9721ccb24dd87eba864da466ac
  • 160c33212fbfeeb2afd8a9413d00a506b7f7c795375ee3bdcf8b10d50564bf0e
  • bedc93271e1e0765ccec9f6560361413356948c7363494994048660477cfae45
  • 8c26f89d4073d3cf99da3197f556a13aaee0af9fa71887d837236109ee0dda11
  • c8fe4346e53515c87a35e6b401efd28659e0cdc3c21094949d0c270e2a10b5a9
  • d1c779a3f3540e7100aac4774d21a9cc0f79944f649b34991eec85e025b74240
  • 8677ab94aea9a1ce5dbec3b5701a27c86dbfd5eb6ef30ff99c57ec21b942b1f1
  • 1fd97e491e3ebc4ab1fc9fe1dac1eb700924cd4920839007ae257579780580be
  • c4d7447ee91e066529282c2b6caccb285e4d264765c6483ba4ff802209b6afe6
  • eb6399c420bd574436d1a508ec3f22e1540be110606d7a5679fc92ad217e26ce
  • ea68665c2dadd9bbff4d81ed2c3037530dfb2b388eb212a4f666743e44877ad4


COVERAGE


SCREENSHOTS OF DETECTION

AMP


ThreatGrid








Win.Dropper.Chapak-6517991-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: SavedLegacySettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: DefaultConnectionSettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
  • Value: pfypvwhssoy
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyServer
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyOverride
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyEnable
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoConfigURL
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Mutexes

  • \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4

IP Addresses

  • 66[.]171[.]248[.]178

Domain Names

  • NS2[.]VIRMACH[.]RU
  • 1[.]0[.]168[.]192[.]in-addr[.]arpa
  • politiaromana[.]bit
  • ns1[.]virmach[.]ru
  • ns2[.]virmach[.]ru
  • ipv4bot[.]whatismyipaddress[.]com
  • malwarehunterteam[.]bit
  • NS1[.]VIRMACH[.]RU
  • gdcb[.]bit

Files and or directories created

  • %AppData%\Microsoft\rojovu.exe
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\7TZAD419.htm
  • %WinDir%\Dorawonu kenevuli

File Hashes

  • 38e70f6ab21df8f358a0339efacf813c398d2c81ac84eb170692b7f4a9d85a11
  • c5284d7f81af2640b87e389739c393377f9cf44f66c734544dd7c5d36e5ebce8
  • 511d460a7a89f8e04ae63c095a6bd609ea3430070c2219abf52b54b6a68cf65d
  • 771be31a99b3a142530974876c7b19631e41909014aa830d8901db4ea0dcdf75
  • 6116763086a3f5cca15f35eaf1c4e5b622486e180f57b97fedf03b9d489ee944
  • fdc1af5f15cc306e1a31af6fa92b5c78a02839cf1623c44ed6dedf3c96e3e66c
  • 4a9d4dcc8bd9a5648254db92047fd1b34d5b62ae9a73ad472ebc8831e5f7cf14
  • aeeff1ad563cc9fd9e7199209c489fbe4ca86bda6d650b6d0437341a65949adc
  • 5c902360da48c8aa3764fd81471f58ca9a741af24955101a9ff8927bd1e284d0
  • f4e6ba27da9e31d52ae6a0483cccf0806aeb23590cff70af85f2af89f55b9dc5
  • e8027abfcbe9f3d3fbda1e635318a9f9ff7dbadec2697a630f21ecdf72d43a6e
  • 6500b0fc6b279282716162300a4ebfe059ef254479313392514bf9af7b0b5f54
  • 1a0a083d3905c1b37f010130b19e73db0cd4385090c35c951dd6807da14db397
  • 39027deb5b01892736313fc5b1acef81ee0d6e581ee3514768416371b9482c3b
  • be15a74b15c3607d6d6d9995e1752bac8b78d4316098971669c9f6c10a7d9c0c
  • b88dffcb8f1ecf6629100041f13c5b406c72ca5620067d49c6cdcbf46b8458a9
  • 91435815f46bc5ad768c77636c23ee71ec6a82b88819e545f499b0c498d477c0
  • 691f1968e302150ca31abb2e25ba117882418a4de9227a6201b8a6e759740bbd
  • 49abf7cf6af3fda93f22c08316706d8596f29b45d2513f9682ff2d209b8f4d43
  • 757825ffc0c5e38b61b3d56d57f7372223401bf47b891f1b6e333021b4804a20
  • 516b2b6db75a4155fde2e0497da0ac000404e9872acf701ff1898df0ba4a51cb
  • f2a55bf2bb857bf74eaabccf704ba5424de2c14fb88306327164abb8ad678536
  • 85e84238a760302bbfd913d9dbf6d57d4a4c5939e27c930eaca6145f24f58b95
  • ea4c4220c9d997032a3269b002a86752725c83115a1f1f9b12371721836945bf
  • e1fa4987144085f9924993039e07d6f4e3d90b4b7b63864655bab7209fe9d97f


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid


Umbrella








PUA.Win.Adware.Itorrent-6517988-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKCU>\Software\Microsoft\GDIPlus

Mutexes

  • N/A

IP Addresses

  • 52[.]29[.]64[.]41
  • 52[.]29[.]39[.]104

Domain Names

  • info[.]atmili[.]ru
  • s[.]itorrent[.]bz

Files and or directories created

  • %LocalAppData%\Temp\98CBEC1.tmp
  • %LocalAppData%\Temp\98CBEC2.tmp

File Hashes

  • 5d4374d3efad7aa1fb713f39228ca03ba2d635d95dcc868448c64ced8462669b
  • 4d19aaf8351aa917ae7e0451e5e3d555266230492b92df14924207898fe0556e
  • ff7cbe2b22c305e60d97df17900c6dbd1f3ee04f893aa2f0064e8baca4b095e3
  • 3650b0eb28ec8aa62803b5225f1d802c8c86030183d13568ca5b7ca83433c6b3
  • 14189877093a87f0c1134cec073ca1b2feae37b98db1dc9ac11b28d22eacad41
  • 0674b063dd2337e1ef589c6140513bd03775f98a8e7cdcd48ad516f2206196ea
  • 4aafbe0e0fadbf24d9b7606ec02ed67472bfa2dfd80e911b80783ceac9ef707a
  • 62fc29d2df8aa13dff0aeeaefc5226745fe49d7e0e676475924e365764fb93aa
  • bfd7f93e3a51fe337dd83ae8b10db73db759d8950e41ffa5f10f3a9dd4637c16
  • 8dfcd382927817426e77d43b6eb0a1b549a90dd623e3322bb87c8bc5b3af9a80
  • 0ac7f7714b66003494e817c495a7cff7d00ed9c776f3852d6ae97a4f87fa76b1
  • 8305265d4dc7323eca0bdc4b8dd05f7aefa8bedeaaca32de0158503624a901da
  • 64f60f5274a7c672c9ab2616209c622aebc384a05d23f118f423a8ad7c89537d
  • 4081b52e671a7ad760d8247d8946d1ee7909e727330efa8029afeac4926837e5
  • 606f74b199f3ebffa19c8b97c80afdf81cbfc320d4cc27530166ac32d77184bc
  • 7c5460496f4ce2ff5384ea07fa07a8022557a6f07e796a06269bba39c92b825a
  • 8bf4e8f31580ad26afd918b8d895c1e222d5d60290c63a98ac22f046a5d63c9b
  • f487f94cdb442263a9536771a081e04f8890e0884ff85d49992357066c5a6447
  • c557ea0836e365f9c3b490cc7e03c180b4924a562c0d13d0720d902efb9bcca9
  • 163c50c2c5fd71fc90d32c5b201eae19ef0f07ed17006058c210a6856021f892
  • 71d8a2b00a79567120449b5be30ccbbb30b3df3619bd22bb72666a548f13eeea
  • ad7e4d6ef119c9a1bd24cad2d540ca97b6d8f872f1a7cc56f284fe1fbbcfeeb2
  • efa15c4ecc4a72a498103e9ee3fe46c8fb10f356996c51b55be1d838441f5905
  • 2bb8cd9afc4b1dcbbea1aef78e7dd1fd4519dbcd84e318ae8d95ab6b2d3291b5
  • cc44c2e0af8ecb0c3f6d06e12171b0a7b579a535d98d9cf16708a37f9c01d53f


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid



Umbrella



Screenshot









Win.Dropper.Vabushky-6518142-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
  • Value: CachePrefix
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: UNCAsIntranet
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpDefaultGateway
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpDomain
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpNameServer
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpSubnetMaskOpt
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpInterfaceOptions
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyServer
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoDetect
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyOverride
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyEnable
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoConfigURL
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
  • Value: WpadDetectedUrl
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
  • Value: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
  • Value: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
  • Value: WpadDecisionReason
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpNetbiosOptions
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • Value: DhcpNameServerList
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: SavedLegacySettings
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: DefaultConnectionSettings
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
  • Value: CachePrefix
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
  • Value: CachePrefix
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value: WpadDetectedUrl
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value: WpadNetworkName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value: WpadDecisionReason
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
  • Value: DhcpDomain
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
  • Value: DhcpNameServer
  • <HKLM>\SOFTWARE\VBSZKYHV
  • Value: h
  • <HKLM>\SOFTWARE\VBSZKYHV
  • Value: w
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
  • Value: DhcpScopeID
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}\d0-ec-4e-4c-68-09
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • <HKLM>\software\vBszKyhV
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\d0-ec-4e-4c-68-09

Mutexes

  • N/A

IP Addresses

  • 93[.]115[.]93[.]16

Domain Names

  • N/A

Files and or directories created

  • %System32%\vBszKyhVp.dll
  • %System32%\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat

File Hashes

  • e5d37e741c64965d38d30ce53e8b80996a26b806ce4400789bb89deec6522632
  • 62321486dbed50c38e356e48863522c8c34e1300fe00276839ccf8d5afb9c841
  • 6d7dda4b9afd2609b3a9994304d611e532162d29b812f96a03aa0f9e156c4577
  • fa168315e0e19fe319c9b48bea50b7e51519b16c828d74acc3f9d23ae8ee85f8
  • b6c714f8167add365e23d2479c1dd401740cad0bc8b63dc214de63a56df54669
  • 1eef403ddd8dd010b7ab5bcf6b6712a44b61cff62c2db804c4e8caf0a3df5257
  • dcd3dc2fee778172e4adce4ea100e2cba0e590028c9b7ecef7e6736b8a50b289
  • 8cd0afe406d49d69c16574f75256e3df1421296894062c619f0da2173f771e64
  • e69d973504e34512b713f9e827113933fcb0317e0a96f0d0f34cd0ad86f99121
  • b43b77f254c0f554634b7cbf524c1466c9cd9cf8d1eb59aa47c508cb47b3ca83
  • 9ef72f076e0cd74e58e93654a8fe556144102221b63daba988448c6851bc12bb
  • fd182a516290da90accab1ed6111b2833b56b10adaafd09105c31abab9b6158a
  • 3399af9c82bc394bd730d9f7dd947947431a8033979d6d5ae64a53d4715541da
  • e9801efc84681d52ecb905a22f154f41e848077319b67a31afb85c3ff7212c6d
  • 463aa2d0b27a92d0d1b872d70bc13abe90a8b4622649a0e8d5b8135cd20cd901
  • bdf235c92c2d880df003221ba993639971f3ea5aba29597a561c48a684949743
  • 2b6d7d1c3d31bd042d6dbc31386b8641863d58e6b791c0b3c7b88cea6ae88950
  • a3213eed4e1ffaf58f680c2d76f4be16783f1c40ba25d7480d7d1b2bedeb4c23
  • 25b9b7e68b36e941c41376fec5c929dde6e3ffe05223cae34becf22c5c4f4e3d
  • 3145293a52c8730bddfe326e00f9a6afcea42fa22ae12eb70cb64c47d06b2ed2
  • be8b254407529caf893760aaa1db43303eb0f4b00bb51c7e0d4a1d05bd702014
  • 2344027fc2269e49976251e652faf815d943ba12cafa340b4f3064161207ddd7
  • d982d7d4bb9a9bbfa5d0a0e5cddfe4ab5a6455761d2f30a27ded543b9bcd42fe
  • a6aeb422cb95bd79dadb200ee9db1479723bdbd4ea090bcf6f5e5cf9dd2457d9
  • 4c2e70f4ec71f29a4ff7fb069c0c0a0b71050a99667fe9afd83c46ee3af58fa6


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid



Screenshot








PUA.Win.Downloader.Downloadguide-6517985-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOWSSEARCH
  • Value: Version
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: SavedLegacySettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: DefaultConnectionSettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
  • Value: CacheOptions
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
  • Value: CachePath
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
  • Value: CacheRepair
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
  • Value: CacheLimit
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyServer
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyOverride
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyEnable
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoConfigURL
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKCU>\Software\Microsoft\Windows Script\Settings
  • <HKCU>\Software\Microsoft\Internet Explorer\Main
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKCU>\Software\Microsoft\Internet Explorer\Main\WindowsSearch
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHist012018042620180427

Mutexes

  • \BaseNamedObjects\DlgCpp

IP Addresses

  • 104[.]40[.]188[.]185
  • 104[.]45[.]146[.]238
  • 104[.]41[.]149[.]192
  • 104[.]40[.]156[.]71
  • 72[.]21[.]81[.]200

Domain Names

  • cs9[.]wpc[.]v0cdn[.]net
  • dlg-messages[.]buzzrin[.]de
  • dlg-configs[.]buzzrin[.]de
  • dlg-configs-weu[.]cloudapp[.]net
  • dlg-messages-eus[.]cloudapp[.]net
  • az687722[.]vo[.]msecnd[.]net

Files and or directories created

  • %LocalAppData%\Temp\DLG\loadingImage\loadingImage.bmp
  • %LocalAppData%\Temp\DLG\ui\common\last\js\jquery-1.10.2.min.js
  • %LocalAppData%\Temp\DLG\ui\common\last\css
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\icon.png
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\progress.png
  • %LocalAppData%\Temp\DLG\initWindow\css\style.css
  • %LocalAppData%\Microsoft\Windows\History\History.IE5\MSHist012018042620180427
  • %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\img
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\css
  • %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\css
  • %LocalAppData%\Temp\DLG628A.tmp
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img
  • %LocalAppData%\Temp\DLG\ui
  • %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\img\img1.png
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img\img1.png
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825
  • %LocalAppData%\Temp\DLG\ui\common\progress\progress.zip.part
  • %LocalAppData%\Temp\DLG\initWindow
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\css\style.css
  • %LocalAppData%\Temp\DLG\ui\common\base
  • %LocalAppData%\Temp\DLG\ui\common\base\js\jquery-1.10.2.min.js
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\br-rb.png
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\index.html
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\bar-lb.png
  • %LocalAppData%\Temp\DLG\ui\common\last\img
  • %LocalAppData%\Temp\DLG
  • %LocalAppData%\Temp\DLG\ui\common\last\img\img1.png
  • %LocalAppData%\Temp\DLG\dlgres\DLG-Product-Logo.png
  • %LocalAppData%\Temp\DLG\ui\common\last\index.html
  • %LocalAppData%\Temp\DLG\requirements
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\br-b.png
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\img
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\img1.png
  • %LocalAppData%\Temp\DLG\ui\common\last\js
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\progress-bar.png
  • %LocalAppData%\Temp\DLG\ui\common\progress\index.html
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img\progress-bar.png
  • %LocalAppData%\Temp\DLG\initWindow\css
  • %LocalAppData%\Temp\DLG\ui\common\base\css
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\js\jquery-1.10.2.min.js
  • %LocalAppData%
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\uifile.zip.part
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\index.html
  • %LocalAppData%\Temp\DLG\loadingImage
  • %LocalAppData%\Temp\DLG\ui\common\progress\css\style.css
  • %LocalAppData%\Temp\DLG\ui\common\base\index.html
  • %LocalAppData%\Temp\DLG\ui\common\last\last.zip.part
  • %LocalAppData%\Temp\DLG\ui\common\progress\img\151.gif
  • %LocalAppData%\Temp\DLG\ui\common\progress\js\jquery-1.10.2.min.js
  • %LocalAppData%\Microsoft\Windows\History\History.IE5\MSHist012018042620180427\container.dat
  • %LocalAppData%\Temp\DLG\ui\common\progress
  • %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\uifile.zip.part
  • %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\css
  • %LocalAppData%\Temp\DLG\ui\common\progress\js

File Hashes

  • 9e80a9629faaf49911b2d55e47d662e93a9f0c3a44cdb8f6e073248ac6dc351c
  • 6f96cb6e06e72dca25f5a86bafbbf54ff41444408370b5948078ac54eae173dd
  • 7f0a548256c1ae127d63567454b3423f1f1bb0894e1c4052419ac3b559451d97
  • 36b4be4057e110d4cc2f6bd51c64a378c33e51ccf1704490218f71b7680ae34c
  • 48e9a887ad404d4cd86c1a2a5cd554a53bb726626d21d0816275c3ddfd557d9d
  • 4219002c5441b449b4467be6adc3bffc20acc99de0bdc83110874ef9207430ee
  • 93faa77350b1950cd65f55d5be5f7ff5912c8668b3b62c718aed1fe8a38f86f5
  • 6c3c69f854fadcda9c13b80f1723579ccfe71aca91aed8b5c4fd7b0628d51c4b
  • f825588ce048eaa7c398be354bea3ffe0f7c6512f345962243bcb59cdb30a4f3
  • bfbb38e548a52a0f382ed522eb4af650dcaae568f2cdc50f12e47af8d58fdf5a
  • 2a63b30132cf5e87858e1c4e17c803980e40d2c88d78a5217dd96cc1cb7159a5
  • bd7b9ab1834ac41e95174f00240d37eda802c3d42cbafc8dbc3ad30dcc007369
  • d861c6696a5e6c3b2022df85ffc7640f33b0e54428ae497bb330b2aba259b7e9
  • 2bc14d1d7c7d5d0ab5062568888ffbb2e9d1260b2e1285c9b40c45821bd2bf72
  • aba71484082260bb50ca65395a81ab9fbd35b6e166186b06464b3308157c83ff
  • 99490c14e2a4f0f483556dbcad7b2d54f69ce512656224ef16f71e0090a25f57
  • b31ff12203cb9ffb5d9727c2a67a19da79d87d8120b6e9d11d4b95e7a9e8e91c
  • 58a8d3881e95c490f07f45d993938fc4d6456445f34de3231769d6780f338ab5
  • cc8d8e263a8e0b6bd427cf5acf4fc4dc221cda4b457db08c1784dbb93e99e3ed
  • c370fa71ae2f4fcefa06bc564102f4f29bb4dcac1fcbcd32d9dd2bfae7e711a0
  • 25c86d135b52ea0178efee2d61381b217f0d9eccf47bdd67f556524dd0aefe3c
  • f7308eede1d35ad4ff82d5772fc1942675ac68d326966d74477cc5e7062cf457
  • 65ccc33e020e5f954be9caa62e3f4ead076fd7670eca20aeb0169661100f40c9
  • 9798ccc97125290bbbac1bce664e2d7db30a8177477af78aa4e820931272ebfd
  • 7dd11a1e78d6b3aae7743733767a9062ff73455e631c16d1cc007207d35cd555


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid



Screenshot







PUA.Win.Adware.Browsefox-6518209-0


INDICATORS OF COMPROMISE


Registry Keys

  • N/A

Mutexes

  • N/A

IP Addresses

  • N/A

Domain Names

  • N/A

Files and or directories created

  • N/A

File Hashes

  • c8e854f4dae4072154f324023486d4e80f13e33617ecb4835bfc1e1cd39b3917
  • e6aaa4ee84ce59b1fb8840f60e10d6b44af458641670479577e40bf87a12213f
  • f9c662335648b5a9b41fc5fd924b3dc003399840c50e545edae35035827ca158
  • 36519727bef36b4a878c5f74d7822ef79d916e9b2dd945430ad062be37e15dac
  • c8de2537db16100c8e993a95210eaa922aaab758693253015ea7e6b1ae97efc1
  • 802ecca3de31fc5c856cd45eab1bd312ba376e43cc53e4c72aa76c2eb1d107e0
  • 1148c11c538fc4b62926ae3c817e7ee6f6066710e90da8da250c67a65cd39824
  • df2c8d329cec7769b3f80e4e233fa872f1ad829ac1d0fef2707762edb5be7b5f
  • bd3e42ffe6573c0678169da09f4a4c9edfbf4743547258450199b88b9ddea1cf
  • 2b5478b13a17c2b07aa4e5e6d60a20880ad96d2ff6a4f5538a5eb76a581d2707
  • 2d43ea47c4718358ba2338204f39484adf74746720140f82eb4d1ef5de2aaf92
  • 0a59af6f94c49f2cc979c1797aaf1116601c6bd224c4cb71d7c68994e27adf82
  • 9a7ba66c452046a923c365bf422a2cc47bda02ec99b0572a9afc3232a3aa778b
  • 748ca5b71088c520cdace941ac85655883622ecf64c18e3dbb55f6ff48ba4ca6
  • 7407c38ab706c460fc3c78b7cb1d63f87cc823d43e46031bf5744868a3b0d9ef
  • 6b9657efde984d01479364ca72edaa8da05e3286f46eca5fefe22de79dec83ca
  • 52202a3bfd2e6cf27eca88aec33c3c10b878ac7ef45a837f946e9a7147ab317b
  • 5b6eabf0b67e59ffdc19d7de742d97a0a01e5e142824723d8b213af8a01b534a
  • 888bf7e0cae92f6218e98ebe17de3884f06b99d343df55d3c563039de449d88b
  • c7609ad5e50d5b908a5474fb8648c824f335fc03e28a976743089952e1f7abed
  • b20ea863ccb7ccd780af4c0e9075d97d2c64c3c795de438ba4be7e371e8dce13
  • 3cb57462b962fd65d746743506651952a8f516246502b1598aa1a971ee1e7ec7
  • 0daa164a8b453ada5fff14f3e29ddb4395d47d4c4102b1eebde5228be80e51f8
  • 0408eed39aee7c02e3eac8c967f786bebab5b2716332dddc63529ada7cbe94d2
  • 3c080b429de9c04801079c31c1496a61df7226a356f718dbe44161d33d9207a0


COVERAGE


SCREENSHOTS OF DETECTION

AMP


ThreatGrid



Screenshot






Win.Dropper.Gandcrab-6518210-0


INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: SavedLegacySettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value: DefaultConnectionSettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
  • Value: skhclrzohqf
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyServer
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyOverride
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: ProxyEnable
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  • Value: AutoConfigURL
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: ProxyBypass
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
  • Value: CachePrefix
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Mutexes

  • \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4

IP Addresses

  • 66[.]171[.]248[.]178

Domain Names

  • zonealarm[.]bit
  • 1[.]0[.]168[.]192[.]in-addr[.]arpa
  • ipv4bot[.]whatismyipaddress[.]com
  • ns2[.]cloud-name[.]ru
  • ns1[.]cloud-name[.]ru
  • ransomware[.]bit

Files and or directories created

  • %AppData%\Microsoft\czhatp.exe
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\R0L7W0PH.htm

File Hashes

  • 9f3fff0d33f24a6c33cbe2eb73279f9a84bab0e9ebbeecc0812d840bb1a7a9cd
  • ee76c548867fe400ffba20191ff3cda4b0c17e757a34a5e033beb27609ce00d2
  • 6a724649c1ff4713811d2cd20040a4b297b609baac3d7365f86bc0a46181f0bc
  • 3167af650dbf40ce92c280ede3a98827bfa91393e9eb82c7d2706dbdb7314055
  • 1249d39166972fecea8a6d9883fcb787aa5d3a76fc069bff30d8169f6f6cac39
  • 55717667e82abb6640728e3f54f417c0e43e4074263ed8609cb3a53a8a71cea4
  • f377f6456d01efb32b2f0d872309d846a0067a778e2759ef8eca366ab392d9f3
  • eab4bd04e2cc37b0515c6afd8859aeccacf48f004211ff78d1c86697c7db1bca
  • 1a3f9284c72f1b50669f16b4b883e20f7ae179fa90837d223a19814059c42789
  • b28c5559bc1ac8b8ac03db87b99c5ff0860c4eae72776d8a658a373cd238df71
  • c8798863e8741484557a2bc60963fa6b8f454a644673645fa2e5610305e1cf66
  • 72389784141f9e694c4c547f234eca74a9ae563cbd7f13132cc9be113ba45600
  • 0f110c3e3830554f19c906d03bc54631dd552897b974461e6a6bf469524c2449
  • 8d9f1ffb082214e56252b51ce071c892d4a80b7a8ba5f664953848407c4ee536
  • 7b1bdb0119f6bbac4ef62ce9a0fe03cf1a7d8f9a9243a4d9921dbc78311df503
  • 20edf76d80a009863089ea1a2a13204fca58a9e15393b40dd1f9e325fb2cc676
  • 78707d5e62547d52e7f0d76b7b43a4a8b0902a6463592b48beaad7b074ad5724
  • 60c38375999628c4e0dda146f71d54dccebae44e6fe9caa232a8599653a3392b
  • 23084b55e2f962ac0d809563e2fd8a6a91973d88e8ae0788316ff9398394aa30
  • f8f59273834de7c36422384cc8533b3f46c54c4198d5e3b99c8c3e585a3bd057
  • f6e56a84834c8dfcc405e8376706e56a064921a97275733c1d5518719718583a
  • 1d6f2497e4cf0d6ed08a8678db2382c1a6a914455afa91ba72d9790782f5671b
  • f83d3b17f1472f1b4aae34d5e9d344a9c2ba2dad0c51c41a29a18213ddc9c237
  • 46f3e720df4661afe0075c6f9ca0a8158a758c267c249994070a455be97a6297
  • 2135a6aa534cc195a340d1853fb7927fac025b08b8a151fd2a2b0b86aa2c298e


COVERAGE


SCREENSHOTS OF DETECTION

AMP



ThreatGrid