Friday, April 12, 2019

Threat Roundup for April 5 to April 12


Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 05 and April 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

  • Win.Malware.Eyooun-6931755-0
    Malware
    Eyooun downloads and installs additional malicious and non-malicious programs onto the system.
     
  • Doc.Malware.Sagent-6932497-0
    Malware
    Sagent launches PowerShell through macros in Microsoft Office documents. The PowerShell then downloads unwanted software from remote websites.
     
  • Win.Malware.Emotet-6933520-0
    Malware
    Emotet is a banking trojan that remains relevant due to its ability to evolve and bypass antivirus products. It is commonly spread via malicious email attachments and links.
     
  • Win.Worm.Scar-6934835-0
    Worm
    Scar will download and execute files to the system while attempting to spread to other machines by copying itself to removable media.
     
  • Win.Worm.Aspxor-6935052-0
    Worm
    Aspxor botnet has the capabilities to send spam, download and execute other samples. This botnet is known for collecting credentials from infected computers.
     
  • Win.Malware.Vbkeylog-6935273-0
    Malware
    This generic family will attempt to deceive the infected computer's users into receiving a payment or getting personal data.
     
  • Win.Malware.Zbot-6935412-0
    Malware
    Zbot, also known as Zeus, is trojan that steals information such as banking credentials using a variety of methods, including key-logging and form-grabbing.
     
  • Win.Ransomware.Cerber-6935713-0
    Ransomware
    Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."
     
  • Win.Trojan.Winwebsec-6935682-0
    Trojan
    Winwebsec installs itself to a compromised system as a "anti-malware" software with desktop links and various persistence techniques (Windows service, Registry Run key, etc.). This family is known for using fake alerts for malware found on the system to deceive users into buying services before the "malware" can be removed.
     
  • Win.Malware.Tovkater-6936213-0
    Malware
    This malware is able to download and upload files, inject malicious code and install additional malware.
     

Threats

Win.Malware.Eyooun-6931755-0


Indicators of Compromise


Registry Keys Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS
Value Name: DisabledComponents
34
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
Value Name: GlobalAssocChangedCounter
23
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\APPLICATIONDESTINATIONS
Value Name: MaxEntries
18
<HKLM>\SOFTWARE\MICROSOFT\TRACING\WCLGSITA_RASAPI32
Value Name: FileDirectory
8
<HKLM>\SOFTWARE\MICROSOFT\TRACING\WCLGSITA_RASMANCS
Value Name: FileDirectory
8
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECTDRAW\MOSTRECENTAPPLICATION
Value Name: ID
7
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: svchost.exe
5
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LYPWXAWN
Value Name: WOW64
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ISFCQMJB
Value Name: DisplayName
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IUGPWHEJ
Value Name: WOW64
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OJIKFFNJ
Value Name: name
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\PSCEGPBN
Value Name: DisplayName
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\QSWARNLV
Value Name: WOW64
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATDUWYIG
Value Name: WOW64
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OTMYZEPH
Value Name: DisplayName
2
Mutexes Occurrences
CommLogDbgStrMutex 61
\BaseNamedObjects\CommLogDbgStrMutex 61
DBWinMutex 32
8Bc0E7-2F5D-49c0-A6D6-appadvert 19
Local\MSIMGSIZECacheMutex 14
openbox 12
adkuai8_client_newdown 11
adkuai8_newdown 11
04AEB7B0-04A8-04A82810F7B640-8A4A82810F7B6 10
Local\__DDrawCheckExclMode__ 7
Local\__DDrawExclMode__ 7
Local\DDrawDriverObjectListMutex 7
Local\DDrawWindowListMutex 7
Local\InternetExplorerDOMStoreQuota 2
Local\http://www.baidu.com/ 2
Local\DirectSound DllMain mutex (0x00000174) 1
fc23890639e7d704fbd1b52b749200a5 1
fccb83f4591c45a062aa5389a08b9eef 1
8e92460d25c534d048fd1c88e802f7e8 1
dbc843e527e2b5c81be3562287f89d3c 1
5d25335e7777648b50dc7504f83b06da 1
Local\DirectSound DllMain mutex (0x000005AC) 1
73b50e38332dbd8c708884de7b44d0f0 1
efc928dd753ae98b928ed12919a305ca 1
53279609cec7acce6827bdec60299b7d 1
See JSON for more IOCs
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
18[.]223[.]92[.]145 42
116[.]28[.]63[.]214 42
122[.]152[.]212[.]224 32
218[.]65[.]30[.]41 30
117[.]41[.]234[.]92 30
122[.]224[.]34[.]103 25
150[.]138[.]92[.]62 24
18[.]218[.]183[.]21 23
222[.]214[.]218[.]239 20
113[.]105[.]164[.]31 20
120[.]55[.]244[.]212 19
175[.]126[.]163[.]124 14
42[.]62[.]4[.]62 13
47[.]92[.]249[.]152 12
120[.]77[.]171[.]37 12
47[.]107[.]83[.]212 12
219[.]150[.]218[.]119 12
125[.]88[.]158[.]212 11
219[.]145[.]240[.]86 11
219[.]145[.]240[.]85 11
219[.]145[.]240[.]84 11
106[.]122[.]250[.]212 10
150[.]138[.]92[.]106 10
219[.]150[.]218[.]44 9
59[.]110[.]185[.]104 9
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
wj[.]center[.]oldlist[.]info 61
ecount[.]2019cn[.]com 54
nj9qq[.]cn 42
top[.]sefcg[.]com 23
pack[.]1e5[.]com 22
ad[.]uuuwin[.]com 19
ks2[.]we2019[.]com 14
imgwx4[.]2345[.]com 13
tv[.]2345[.]com 13
imgwx3[.]2345[.]com 13
imgwx2[.]2345[.]com 13
imgwx1[.]2345[.]com 13
imgwx5[.]2345[.]com 13
mini[.]sefcg[.]com 13
log2[.]nagirl[.]cn 13
LOG2[.]NAGIRL[.]CN 13
union[.]lm33[.]com 12
liosm231[.]com 12
list[.]adkuai8[.]com 11
p2p[.]adkuai8[.]com 11
down02[.]adkuai8[.]com 11
ipaddress[.]adkuai8[.]com 11
tongji[.]adkuai8[.]com 11
log[.]uinfo[.]soomeng[.]com 10
next[.]91xiaba[.]com 10
See JSON for more IOCs
Files and or directories created Occurrences
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\desktop.ini 59
%TEMP%\SSL 40
%TEMP%\SSL\cert.db 40
%TEMP%\SSL\Small DigiCert Baltimore Root 2.cer 34
%SystemRoot%\SysWOW64\Log 31
%TEMP%\h2u31tg4.exe 30
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\config[1].zip 30
\PC*\MAILSLOT\NET\NETLOGON 23
%HOMEPATH%\Desktop\¿³°×Öí±¬9999¼¶ÉñÆ÷.lnk 23
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\190[1].ico 23
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\215[1].ico 23
\DosDevices\C:\Windows\System32\wfp\wfpdiag.etl 23
%System32%\wfp\wfpdiag.etl 23
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\procelist[1].ini 22
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\018[1].exe 19
%LOCALAPPDATA%\Microsoft\Windows\WebCache\V0100009.log 14
%LOCALAPPDATA%\Microsoft\Windows\WebCache\V010000B.log 14
%LOCALAPPDATA%\Microsoft\Windows\WebCache\V010000D.log 14
%LOCALAPPDATA%\Microsoft\Windows\WebCache\V010000F.log 14
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\mini[1].htm 13
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\hideconfig[1].zip 13
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\classicTv_tvHotMini[1].htm 12
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\LOLO[1].png 12
%SystemRoot%\api-ms-win-cx0-l1-01-19.dll 12
%SystemRoot%\SysWOW64\del.bat 12
See JSON for more IOCs
File Hashes
  • 002a3ee5d238a80bd8c3759d8478d7d9098af54cbcbd264bcd78ad172c7fded5
  • 0066dccf58f6d2ea4e303e870aea20c25d0c945a4b5c6796548acb20ae2dd268
  • 015d9a05e3595d8902031dda87e999396a9a2b5267195e35f3752cef08a37b50
  • 0181a703fa74afdd4640b52de9338b0dd6e14446c0635bebf8883999cfa0be01
  • 090f9030986cdb1413bc9f5c6901952e23be5f6c48b7ce0f9858e92e91142d26
  • 09d3b0027fba2e0419841177734b811e506aed12d758d75d77a1f71ebb1b16bf
  • 09f0116a571ccf405cf2b83507fb2d3c139a8f9fe7ce9fc77595c7c66d4f9a53
  • 0f0d5f033b1096e209857c255edb94e30306087a172edb5816f4464c92a9870c
  • 1029ddb2e83f17e8318199afb81a4434de65e12728552f66255cd7814b7cce0f
  • 159a0f8cc9ed369de6b89806b3d29a287183dc15deb59ea916d246d736385684
  • 179662d10fbf28f36e7fbf9d61e20ecf01ea0efe03223e19aad2e24a4ae56bb0
  • 19fb21319fb6479eb23cf06f3298f991466dbd1954c320db749e6f4ee727a27c
  • 1ac81f029e1fc5c7c11045d910ba3882946bd6535369675c6b443c35ef2e5c18
  • 1f78e240a8cdfda72e443b39cbfdf4faab1ed8092cdf9b02bdc7456dffbe1f47
  • 1fb5ec3d10289d0f00460070da92853ba1d90dbebd6dc6a8266a09ad3c36a154
  • 208d2e1fdf8b87f1b37644e57f340b984c8d68de8ba02525c61b6158b9d6e539
  • 24b4b426368e29fe933d6b427d1ae47e31fb346b2392e2161a67add890bae196
  • 2d60ced2eef863bc23232f4c3a80be8545902f2efa4dd9eab7f680a5643d8289
  • 2ec0873e6ce50626bccb3217c8fe10fd421604dd5fe45fa58c6f54b90b369d6b
  • 30944e432f0f25fda774cfe7090a9cef872b02bd754636a1176e98f7298c5780
  • 3291d369e4f69353b221ef184731f93c80f3762de2114d4b4f1a6b200f66aab8
  • 388259027de10322e1da522901d84a83bc8a5585d2d61a47b4ecd9c87cc30d26
  • 3960aa9d31ec0dacc0f11edbebc8820e4f929bdfc2943aec52dea840c456e264
  • 39d8b6f916b96060c7e55c468fb066a51ccd5a8c1e0f3d43fa29dc12dad129f0
  • 3a328a6515c449cf1f1807ede10f790014b5905cda161828d3eea7750a7d2264
  • See JSON for more IOCs

Coverage


Screenshots of Detection

AMP



ThreatGrid



Umbrella



Doc.Malware.Sagent-6932497-0


Indicators of Compromise


Registry Keys Occurrences
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: AutoDetect
10
<HKCR>\WOW6432NODE\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\WOW6432NODE\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\WOW6432NODE\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\WOW6432NODE\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\WOW6432NODE\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} 10
<HKCR>\WOW6432NODE\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} 10
<HKCR>\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} 10
<HKCR>\WOW6432NODE\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} 10
<HKCR>\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} 10
<HKCR>\WOW6432NODE\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776} 10
<HKCR>\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776} 10
<HKCR>\WOW6432NODE\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9} 10
<HKCR>\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9} 10
<HKCR>\WOW6432NODE\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} 10
<HKCR>\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} 10
<HKCR>\WOW6432NODE\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} 10
<HKCR>\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} 10
<HKCR>\WOW6432NODE\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} 10
<HKCR>\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} 10
Mutexes Occurrences
Global\I98B68E3C 10
Global\M98B68E3C 10
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
89[.]188[.]124[.]145 10
190[.]117[.]82[.]103 10
190[.]0[.]32[.]206 10
104[.]18[.]35[.]163 7
104[.]18[.]34[.]163 3
43[.]229[.]62[.]186 1
104[.]2[.]2[.]153 1
201[.]165[.]102[.]49 1
187[.]189[.]210[.]143 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
xoso[.]thememanga[.]com 10
Files and or directories created Occurrences
\EVENTLOG 10
%APPDATA%\Microsoft\Forms 10
%APPDATA%\Microsoft\Forms\WINWORD.box 10
%HOMEPATH%\80.exe 10
\REGISTRY\MACHINE\SOFTWARE\Classes\.doc 1
%System32%\WindowsPowerShell\v1.0\Certificate.format.ps1xml 1
%SystemRoot%\SysWOW64\A7Nx4PQT5.exe 1
%SystemRoot%\SysWOW64\N6yvu6lNl.exe 1
%SystemRoot%\SysWOW64\g6iqfJhcB0Xc88E.exe 1
%SystemRoot%\SysWOW64\f9XnJqVa5Bt6Sf.exe 1
%SystemRoot%\SysWOW64\9yMQn0Zw.exe 1
%SystemRoot%\SysWOW64\c33fB.exe 1
%SystemRoot%\SysWOW64\aThVJIMunDfvC.exe 1
%SystemRoot%\SysWOW64\SqxzR9tB3STZYB9o1.exe 1
%SystemRoot%\SysWOW64\WyFb5EUyZBFDn5Gb.exe 1
%SystemRoot%\SysWOW64\TYVGTeXwXGD.exe 1
File Hashes
  • 310c672343531ecc8fb2bc22b979a34f6e3c3d6c56eaad0dadeecade3e6c64d9
  • 60973bfc7ccac458d9ac4b7192a40774316b04d86cdb106b0c205d75778b7c65
  • b3ff81bf64f077e1b466d3696c3528f9c644d503b515473b16803610f240dd05
  • d1d756451258f60d10e1c46540438f9a7c9ad84bfe7b4a1cb944ae02e456d3aa
  • dfcb889cbff15a54eab56367f8f5da6855cf534ad732938eb4cc472a77c231a0
  • e39863e66ab0f1bf0b8d35f2715d3de220f6bb3d0c28b68d8f14d53ed1acb7e4
  • e8ca6c66c79cca9404a9f6a6920ff02010dc799435381a97fd5c57cf0c3abb41
  • e9a0aabcf4e854ca4b16e9ebd2d228b2e581abc12d27ef34b9f8a5978d224128
  • eba143b8f9ea163949037b683622c1cf9672e9a4e63513ecd20ebe1aff4e3ff5
  • f4282b6fc250485ebd045d3008195a5c3e2b385c5caaada93ea221f53326d3ec

Coverage


Screenshots of Detection

AMP




ThreatGrid



Umbrella



Malware



Win.Malware.Emotet-6933520-0


Indicators of Compromise


Registry Keys Occurrences
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: AutoDetect
16
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value Name: SavedLegacySettings
16
<HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon 16
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\sourcebulk 16
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: Description
16
<HKLM>\SOFTWARE\Microsoft\ESENT\Process\guiddefribbon\DEBUG 16
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadDecisionTime
16
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\A4-E3-E4-11-EC-FD
Value Name: WpadDetectedUrl
1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\2c-28-30-ca-41-e3 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\2c-28-30-ca-41-e3 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\c0-21-36-0e-b0-2b 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\c0-21-36-0e-b0-2b 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\c8-7c-48-93-48-f7 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\c8-7c-48-93-48-f7 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\24-f7-27-10-2d-94 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\24-f7-27-10-2d-94 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\dc-35-3c-bc-55-73 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\dc-35-3c-bc-55-73 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\46-b9-fc-8e-0c-36 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\46-b9-fc-8e-0c-36 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\e2-85-af-73-a1-bc 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\e2-85-af-73-a1-bc 1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\46-B9-FC-8E-0C-36
Value Name: WpadDecisionTime
1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\E2-85-AF-73-A1-BC
Value Name: WpadDecisionTime
1
<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\24-F7-27-10-2D-94
Value Name: WpadDecisionTime
1
Mutexes Occurrences
Global\I98B68E3C 16
Global\M98B68E3C 16
\BaseNamedObjects\Global\M3C28B0E4 16
\BaseNamedObjects\Global\I3C28B0E4 16
Global\Nx534F51BC 1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
43[.]229[.]62[.]186 15
190[.]0[.]32[.]206 15
187[.]189[.]210[.]143 15
201[.]165[.]102[.]49 15
89[.]188[.]124[.]145 15
104[.]2[.]2[.]153 15
190[.]117[.]82[.]103 15
208[.]100[.]26[.]251 1
5[.]196[.]133[.]206 1
198[.]187[.]30[.]249 1
104[.]236[.]135[.]119 1
71[.]78[.]158[.]190 1
190[.]219[.]231[.]69 1
208[.]180[.]217[.]173 1
181[.]31[.]182[.]138 1
201[.]249[.]117[.]123 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Files and or directories created Occurrences
%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 16
%System32%\guiddefribbon.exe (copy) 2
%SystemRoot%\SysWOW64\SBp2VS8N7jU.exe 1
%SystemRoot%\SysWOW64\yXRDTc.exe 1
%SystemRoot%\SysWOW64\LvO5IJ1Sr5t.exe 1
%SystemRoot%\SysWOW64\5kQW.exe 1
%SystemRoot%\SysWOW64\Nsa7bjsedHZNrMyW.exe 1
%SystemRoot%\SysWOW64\MZ5WK.exe 1
%SystemRoot%\SysWOW64\FxiHy64z3NDOiHEgC.exe 1
%SystemRoot%\SysWOW64\hlaVhqNG.exe 1
%SystemRoot%\SysWOW64\Ahfk9lC4PqeGiyhY.exe 1
%SystemRoot%\SysWOW64\xdm5D3NLE.exe 1
%SystemRoot%\SysWOW64\2o75cQI.exe 1
%SystemRoot%\SysWOW64\oxJI2FKrOP.exe 1
%SystemRoot%\SysWOW64\MoSv9WL5Pn2Rd22eN.exe 1
%SystemRoot%\SysWOW64\LQRA42.exe 1
%SystemRoot%\SysWOW64\MVED6NriD.exe 1
File Hashes
  • 07bb6313dc4e4e47fffe542787f7e5f085f7a0b827a3614a666b8ba122895a5b
  • 1317735faa4586cd57e311b7fa5462675b19b6767898bbc9fd1ea438e9b269a1
  • 1cfb22555921bcd42ea2976527cedebe9b0a70a24ca2f4695d61496956a9fb65
  • 34dc74f395344d40e6ce6e08f73ea822d83107c276e230862aa7f20ec24677d9
  • 5bcbb702d1936de97fc26a33767f7d1b1973455d7a783dae80246fae99024b98
  • 6123a5957f13a02e1752a9242f68f2cec27443ea0e4fbea65edde4c05a48ec38
  • 642b1802bb2c429da4521e8fd159498cf814ab43df41d2213ccf4c8e7bf3a58f
  • 67121ec06c244e75ba3c217b6ec7c9ea795f71bb673c87ced115a7bae939b6a2
  • 67b8cdfe8f7b193723a6db03fb8f2246710ba6b4bfd2681134175f98150d307a
  • 7581c79cd28ae473538de22e69f00d8a0642937621a08d6a304e7bae7cc1f467
  • 86630ccb5c7e8d248e28446f27f2faf21d2712e18b3b6fb7749c9dd0d82c2752
  • 87989bca4fcdaf8bde36f1893ce293da2f11c330cdd0f9746956241d6fac63da
  • a8caf1e24c6972c1338eb4cc5d061fe7b6618657720b375e43385c9118b3aad9
  • bdc575561b7b6ccd315cc5aa6c0f05d346201917e05490ff9203ee804b9d4fd7
  • c6f1c07bbf320307ab784db15f0dc7ecc09c2f96150cda7126569a2d77935b2a
  • e1226793b90a2c765d227e365b24271282c85ba9b7b5eb642f9f4b145ba0b932

Coverage


Screenshots of Detection

AMP




ThreatGrid



Win.Worm.Scar-6934835-0


Indicators of Compromise


Registry Keys Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Microsoft
32
Mutexes Occurrences
DSKQUOTA_SIDCACHE_MUTEX 32
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
175[.]126[.]123[.]219 20
67[.]228[.]31[.]225 3
64[.]186[.]131[.]47 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
byvolker[.]co[.]cc 19
canappe[.]co[.]cc 1
getvolkerdns[.]co[.]cc 1
killervolk-dns[.]co[.]cc 1
Files and or directories created Occurrences
\??\E:\autorun.inf 32
\autorun.inf 32
\AUTORUN.INF 32
\??\E:\AUTORUN.INF 32
%System16%\svcrcs.exe 32
\??\E:\UsbDrivers.exe 23
\UsbDrivers.exe 23
\??\E:\Setup.exe 8
\Setup.exe 8
\??\E:\open=Setup.exe 1
\open=Setup.exe 1
File Hashes
  • 0801e6c88de29d1418e3c7e89c72ff0e9147607f1c36ea657f60c557bc2ca91c
  • 08c755993f57b3c2adb4893504683394b81e9dba822ccd6bdad9dc9710155078
  • 096b4a3371120250dbd0c85c19730f92d0beaa3af16d73a44c6c81e81e0371f8
  • 11566d54a186019e24e0fe51ecfcc8a6e954c3ff0ec58e89130c81c2c9fe3652
  • 18bc9b638b1770d6b76de5be46ecc50d2b2a428053b131b02cf76d9feac9566f
  • 22afe3eae9acd98fa25f5e06a7f3fa2716aa6af527d1232e5ba4c95e199b851b
  • 25fb8e7a4039c200fa74246ae62629e6a1db5400e2c8ebe14b041f0dc2bc60f7
  • 391483fc42fa770ae9a6e0bb615536b9c3f1a908931d5222d4f1eab68a50c91f
  • 3b62f8abfdb792b3419ac346fcbc5d004a9b67dc1b5a93b2eda4da53fc27263d
  • 3be4799debfab2081853244700668d7303752272978941b551d21e6cfc476a69
  • 424c3baead90385b2fd8cc6ef98534119ce5ea41f9488c0e64d1829ae61ec957
  • 453b4a1818de6d3e8d67632e31bcca085cd8f5e44e775a7959246eaa4c925d2d
  • 4a800c7c54850630561ffe6d54a3390a93192c7fa6301f5d6ea9368f2c6421bb
  • 4ec4bcca36e92304469192ab25d97cacb192413f4092a37a5f1e76575beaa0de
  • 55562749de33d7cc4f93d0342514467c31b975907d9f0dcd8ec78f735ce6b1d8
  • 5b642baf8e06c96a72ee7e8e55f98bd25a6180fce57fa25c2691782a23c76794
  • 5efacdb03391aa114a6dcac90a6f8f8562c0a2e666185f1f8f63065364993143
  • 6178e5bcda89cd0c4760545b3208cf56ce26fc9fe51551d1389505d30de75830
  • 621bc4bb35821d5a7784bda820acd368d863b2430974952f83a14051693c2fda
  • 75504f094939ab33f14cdf1a6c1be3cad5ae7f89d48d925fca65222062ea27e5
  • 8320a5187226606270a82f0acf50449a11d3bc6bfed10618e7a7d79ea4564401
  • 86ebccdb2f90a5b5ca49911155eac4d05769138d8f72856d4cd9be2323037b29
  • 871aaaf9a80009c78539d2a8b1bbfee432c1afc08511d25e057373731f06a061
  • 8fd6c4a70953f044073299ad6ba883d94d7be1a723d8aaa908435318509cda05
  • 915c2d8d8bf3391aee7ee8a4d732cd861aa30eba8219b240b66041a860a32cc0
  • See JSON for more IOCs

Coverage


Screenshots of Detection

AMP



ThreatGrid



Malware



Win.Worm.Aspxor-6935052-0


Indicators of Compromise


Registry Keys Occurrences
N/A -
Mutexes Occurrences
2GVWNQJz1 25
Djjwy&22bsqobnaHhdGwemvt(&11839) 25
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
217[.]115[.]50[.]228 17
93[.]186[.]181[.]62 15
194[.]85[.]183[.]2 14
46[.]55[.]222[.]24 12
222[.]124[.]166[.]12 10
82[.]116[.]211[.]16 10
209[.]170[.]120[.]163 9
186[.]115[.]122[.]67 8
216[.]218[.]206[.]69 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Files and or directories created Occurrences
%SystemRoot%\SoftwareDistribution\DataStore\Logs\tmp.edb 1
%HOMEPATH%\Local Settings\Application Data\ksgxpasi.exe 1
%HOMEPATH%\Local Settings\Application Data\joorwdum.exe 1
%HOMEPATH%\Local Settings\Application Data\unfdefqq.exe 1
%HOMEPATH%\Local Settings\Application Data\ahnatfuo.exe 1
%LOCALAPPDATA%\ffueegqn.exe 1
%LOCALAPPDATA%\hahxwkrq.exe 1
%LOCALAPPDATA%\erhipkjf.exe 1
%LOCALAPPDATA%\qrfcduvn.exe 1
%LOCALAPPDATA%\bbpikrlh.exe 1
%LOCALAPPDATA%\gbmscrrf.exe 1
%LOCALAPPDATA%\uhotvrfs.exe 1
%LOCALAPPDATA%\vwaffned.exe 1
%LOCALAPPDATA%\wscftndd.exe 1
%LOCALAPPDATA%\fapgaxbx.exe 1
%LOCALAPPDATA%\kselhlpe.exe 1
%LOCALAPPDATA%\lupjoaow.exe 1
%LOCALAPPDATA%\oxhojtxr.exe 1
%LOCALAPPDATA%\bgnifxtm.exe 1
%LOCALAPPDATA%\annimrmg.exe 1
%LOCALAPPDATA%\teconvea.exe 1
%LOCALAPPDATA%\jwclsdrd.exe 1
%LOCALAPPDATA%\txfqjufq.exe 1
%LOCALAPPDATA%\ridhufao.exe 1
%LOCALAPPDATA%\ndfgutar.exe 1
See JSON for more IOCs
File Hashes
  • 0212de9641f40da0e6bdad747f807eca71356ddc298263c20676321863326f70
  • 098631c475084bd57815d245af1252c70bb4b918df059844aa167ec189bc955b
  • 0c5634fd44849ef51ac6f7133cdea66da960a64a6c165bf038f17d97610ce5d9
  • 195b4c47c63c9d6fbd745da31721b086e931c0d60c1759e414c564cea4e1d6c2
  • 1ccb17748bc70035a00a5ea94d223e1e425163e191bfb92271d191d7ced3347d
  • 1f5286c16b783ebbcf24cd92cae2f1eb50d69e6f4cc0d0c97408f03abe1de161
  • 29614ffd96412f26a5cf2fee3648e4954c2ac095543b3633e03dfaab12d1ff60
  • 29de1a963a1f1bf15435da9020a2eadfa9d3054160e545b49b89135a6eaac2a9
  • 2c85e5a8a1c3e5c0e6fcf4902780824c9014298ff01f823ae8f4d2633f64c0b4
  • 2ebd4a5e0954ef8cfa8f338caf6bc6763e6519c9be2b71e31186f91b29312e13
  • 37d5963a73acccd5b60d59e27c19fc30c1806679724338e1d4962d04748934f9
  • 386ecf6b47b1f1d71b3797adb0335a806452d3346e108b758594f07dfcb49f97
  • 3b03b188ac995d7fcab65e70b9ada8d2b126313318a981ec396a2111a34bfd64
  • 40ebfa0f7b15bd9a0827c9c597340b1ab91a0b352232052094dbbf6e951617b9
  • 4ad58e6014e62529af11bdc456bd4fec94ee3138f6e8c679a963512709a72452
  • 5147b90fa72506bd6c47bed8b03f82f8eab5e6ab6f6216289680429ed915422e
  • 543cb5dba99c251147551c65e8db498b1b16f2084933596159006482ce1be633
  • 5d19478d27e1697220d54e158ecbe4190287c34f507d46717f06195acee8507d
  • 601d8a181beb7451b6d45b6938a398b8c09bfba4d858b5de52d79ad55ff733fc
  • 64816d8573edd50f3ba63d0c1b9e491e461dea9f4dab78b85986959346d7769c
  • 65f8b7cf030977bb60ae0e21b3514d4407090de968c505ccdaed0ea73d2b882d
  • 66bff41b7bad9cd835e0e698cfc574a576caf819a3c9abecc473eb8ec31a53a2
  • 68e6f59b6c52c804dcebebbc2eb54ad7a00c9e0302f429bfef2300d33abdc4a3
  • 6d610fd8891c60bd39978d90f76e803a878fd1bb36061e7a970ad79af20accd2
  • 70d71ecfbb763f5e97379bc3d75412e56aec4574affadc1d4bcb09a2fc70d923
  • See JSON for more IOCs

Coverage


Screenshots of Detection

AMP




ThreatGrid



Win.Malware.Vbkeylog-6935273-0


Indicators of Compromise


Registry Keys Occurrences
<HKCU>\SOFTWARE\MICROSOFT\DIRECT3D\MOSTRECENTAPPLICATION
Value Name: Name
5
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
Value Name: {FFE2A43C-56B9-4BF5-9A79-CC6D4285608A} {00000122-0000-0000-C000-000000000046} 0xFFFF
5
Mutexes Occurrences
N/A -
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Files and or directories created Occurrences
\TEMP\NewBitmapImage.bmp 2
\TEMP\taximg.bmp 1
\TEMP\tooooos.txt 1
\TEMP\jon.bmp 1
\TEMP\SureTools.txt 1
\TEMP\rum.txt 1
\TEMP\SLIPUSD124.985,67(1).jpg 1
\TEMP\TAXFILE.bmp 1
\SureTools.txt 1
\rum.txt 1
\tooooos.txt 1
File Hashes
  • 44414ef55e3f6368f1df92f06a5f29f4dda15554720b7cb4a7ad22ef73023ce6
  • 5164b6fd11a2fb210d88ee920b95a62e8ba0904797c015f2edf20fe519678777
  • 64ab1d27afd0c17215e56c0c97b2de6e8862573cf8663e60832d5d14ab9f635c
  • 940f6e0c84f2ea9db97ce376fdfd8b111f3fd50ddcac3d303b5b9d69a7a89dd5
  • 98408e5c6a013289ce93486234965b89f164c568f5f772d9082d6ddbfab7c506
  • 99773cfde40fbf0a2e681cbb27b64616c4e401b47ad88255be843c3084e41e29
  • b698ccf0db3ef9d598333cdb998beabbc0e59ba6a528e02a2870687b863ff0a3
  • dce28ef0578d3d8d14159a098ef4f8f15995996c2c2e512caa456d8c0f5114dd
  • f0b0138e46957c77c6b40f7c2ed6b16bf7aea25cd02ac62e4298b559de2b385b
  • f1632ccc48b023eeab044ed42093e748e501c0afdde9b97d22d27ad09b01dbea
  • f51e016793c920faad2abe8da9d14a6d6ecd1f73b8ccd68d583b4ddcbf9341fa

Coverage


Screenshots of Detection

AMP



ThreatGrid



Malware



Win.Malware.Zbot-6935412-0


Indicators of Compromise


Registry Keys Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: LoadAppInit_DLLs
25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
Value Name: aybbmte.job.fp
25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\AYBBMTE
Value Name: Index
25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{FF46FC7D-1E0D-46F8-87EC-94D0FDA83668}
Value Name: DynamicInfo
14
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{F2B28AC6-1443-43F4-9832-8315397F35E8}
Value Name: data
14
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{088B2EE3-A639-491E-B1E6-84AE447D785F}
Value Name: DynamicInfo
7
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{94669170-5F40-43E0-9D77-69BC9146DF72}
Value Name: data
7
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9C9693B0-E894-414D-8675-6B58133E665B}
Value Name: DynamicInfo
2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{6E1FF505-4705-412B-825D-ECE026885614}
Value Name: data
2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{48716312-C151-484D-9EC0-E5B4883DF1B7}
Value Name: DynamicInfo
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{90EA3D0B-BA3B-4356-A2CD-915E5BB4CF7B}
Value Name: data
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{65579417-B766-4127-BD16-88A7D90F9ADD}
Value Name: DynamicInfo
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{E4AA06C0-45E2-4E4D-B133-96D82B197EA1}
Value Name: data
1
Mutexes Occurrences
N/A -
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Files and or directories created Occurrences
%ProgramData%\Mozilla\thfirxd.exe 25
%System32%\Tasks\aybbmte 25
%ProgramData%\Mozilla\lygbwac.dll 25
%HOMEPATH%\APPLIC~1\Mozilla\kvlcuie.dll 25
%HOMEPATH%\APPLIC~1\Mozilla\tfbkpde.exe 25
%SystemRoot%\Tasks\kylaxsk.job 25
File Hashes
  • 038925296d4fdaa55efcfa1ad8c02ce08d6f3673bc042fed1bd20d9f29fad5d3
  • 0ca97f5d0c9e6de090568cb7285db362d7210c45e2213be617fdd4ba2ae8dc7d
  • 109de4dba47129449293624f674a90a8d6381d5f827e4192f1efc97e4b08748e
  • 4155d902b22a775b172e7d86d4958e9088d571bfda7810fd6eceaa5bfb44e847
  • 56d02ae6de618c67968b5c6ca583372e1388c89424f2c2118aac6a8548b909ce
  • 5880016db066b6d864c72234d1404cb0ac8953a0ca35b1edae8fc1c8c6c8a7b2
  • 591e2322c4e4a65b02694f0066ef6c18ceff25c50ea0c118591170af3e4e9cce
  • 5a48b66eb3c6581073bd8b85f9a8151364f089dd91997d82ec42709f3f813def
  • 697000ba4047468f1005194dcbd2ae90e444a7e1a8b52c3904a3001358387af9
  • 89a3ecc59f1bd6d62f71b2dccbf03e433d99cee9f9e8d961e19d5e3ca7bb3f15
  • 95ce736766aa931ba16df831dabc530f64e9e9a6d1a134e6931987fa1c8fd544
  • a3309cb7bf90a6f6220bbf9a6b018d5f41334407a431b5101874e4d3436382ff
  • b28ca331d6466f83028b9e8c4e9fd6511dad0a599859ea21f8dd02618eabc1d4
  • c27265eca8f4f1d0606e3e6acc971721410f7430d3b8c487b128fee5a910f8cd
  • c6b0d5b496baca826833a12e9863292ecdd92931ce682d61a74ee62e97c39382
  • cf9e75a01b1ee5093c7ca244f5568becd535c6e9f56885a11a25dc1e9621d502
  • d5587aef2b6a77a22904f8cff993d6e35a832f7552f8f3124c772b1700077622
  • d7fb034de95b8ef46570d15391cb1c8181e2145076831813563a947d8d1616db
  • dc68ea18ef5b981d2fefd632a9e7fe51bc03c5058dcff708b9aa255e9ebbfe06
  • e1c784eada950c0b8a9ff1a533d95252bf4cf36314b8b52aaef1ce51c3fe3704
  • eb84091df0b6ea62d38e2240201dc93fbb5db4b878c595937cd9ff77508dacc1
  • ec5dd84f2cd6083165187eff18bb55f382719977092eaeea642868d062926970
  • ed8887e64560574df7491a6ba7feff32433fed157e02f39ce86fb8689d5a2207
  • f443021ba52b571fa16f440f171e85430eb6d925882bdffc339de6917b6e13b6
  • f4fd6c5f9fdeb3196e09b5ee9854f0c06d320c8cfe8c7fc04e234c35cfcc26b7
  • See JSON for more IOCs

Coverage


Screenshots of Detection

AMP




ThreatGrid



Win.Ransomware.Cerber-6935713-0


Indicators of Compromise


Registry Keys Occurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
Value Name: Run
54
<HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
Value Name: AutoRun
54
<HKCU>\CONTROL PANEL\DESKTOP
Value Name: SCRNSAVE.EXE
54
<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D}
Value Name: Component_00
54
<HKU>\Control Panel\Desktop 42
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F95BF9F7-D3F3-4AC5-8A3F-4B59850DD369}
Value Name: DynamicInfo
31
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{99EF6702-6773-48D3-992B-6F4C187FAC71} 17
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
Value Name: {FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214FA-0000-0000-C000-000000000046} 0xFFFF
12
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
Value Name: Blocked
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
Value Name: Blocked
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
Value Name: Blocked
11
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
Value Name: Window_Placement
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CD BURNING\STAGINGINFO\VOLUME{509D0DCA-5840-11E6-A51E-806E6F6E6963}
Value Name: Active
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CD BURNING\DRIVES\VOLUME{509D0DCA-5840-11E6-A51E-806E6F6E6963}\CURRENT MEDIA
Value Name: Set
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
Value Name: LoadTimeArray
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
Value Name: LoadTimeArray
11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: ipconfig
2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: ipconfig
2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
Value Name: ipconfig.job.fp
2
Mutexes Occurrences
shell.{381828AA-8B28-3374-1B67-35680555C5EF} 54
Local\VERMGMTBlockListFileMutex 14
Local\!BrowserEmulation!SharedMemory!Mutex 14
Local\URLBLOCK_DOWNLOAD_MUTEX 14
Local\URLBLOCK_HASHFILESWITCH_MUTEX 14
cversions.1.m 14
GeneratingSchemaGlobalMapping 14
cversions.2.m 14
_SHuassist.mtx 13
{5312EE61-79E3-4A24-BFE1-132B85B23C3A} 13
Local\Shell.CMruPidlList 13
Local\InternetShortcutMutex 13
Local\ExplorerIsShellMutex 13
CDBurnNotify 13
Global\CDBurnExclusive 13
{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3} 12
!PrivacIE!SharedMem!Mutex 11
ALTTAB_RUNNING_MUTEX 11
{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D} 8
_!SHMSFTHISTORY!_ 5
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1388 3
\BaseNamedObjects\shell.{3AFC1C93-3B52-BB89-3222-3835B13B7C57} 3
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1084 2
\BaseNamedObjects\shell.{2DA495A3-711D-597E-268E-77F8D29EB324} 2
\BaseNamedObjects\shell.{37AB6120-3C1B-909E-8A46-BA7ED26D587E} 2
See JSON for more IOCs
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
31[.]184[.]235[.]95 31
31[.]184[.]235[.]94 31
31[.]184[.]235[.]93 31
31[.]184[.]234[.]90 31
31[.]184[.]235[.]92 31
31[.]184[.]234[.]91 31
31[.]184[.]235[.]91 31
31[.]184[.]234[.]92 31
31[.]184[.]235[.]90 31
31[.]184[.]234[.]93 31
31[.]184[.]234[.]94 31
31[.]184[.]234[.]95 31
31[.]184[.]234[.]96 31
31[.]184[.]234[.]97 31
31[.]184[.]234[.]98 31
31[.]184[.]234[.]99 31
31[.]184[.]235[.]99 31
31[.]184[.]235[.]98 31
31[.]184[.]235[.]97 31
31[.]184[.]235[.]96 31
31[.]184[.]235[.]214 31
31[.]184[.]235[.]215 31
31[.]184[.]235[.]212 31
31[.]184[.]235[.]213 31
31[.]184[.]235[.]218 31
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
ipinfo[.]io 54
onion[.]to 23
cerberhhyed5frqa[.]onion[.]to 23
ip-api[.]com 19
freegeoip[.]net 18
en[.]wikipedia[.]org 5
www[.]collectionscanada[.]ca 5
alpha3[.]suffolk[.]lib[.]ny[.]us 5
www[.]archives[.]gov 5
www[.]vitalrec[.]com 5
www[.]cdc[.]gov 5
4kqd3hmqgptupi3p[.]u57u1e[.]top 1
4kqd3hmqgptupi3p[.]hlu8yz[.]top 1
4kqd3hmqgptupi3p[.]58na23[.]top 1
4kqd3hmqgptupi3p[.]132z80[.]top 1
4kqd3hmqgptupi3p[.]asd3r3[.]top 1
4kqd3hmqgptupi3p[.]h9ihx3[.]top 1
4kqd3hmqgptupi3p[.]ep493u[.]top 1
4kqd3hmqgptupi3p[.]h079j8[.]top 1
4kqd3hmqgptupi3p[.]fgkr56[.]top 1
4kqd3hmqgptupi3p[.]azwsxe[.]top 1
Files and or directories created Occurrences
%HOMEPATH%\NTUSER.DAT 54
%HOMEPATH%\ntuser.dat.LOG1 54
%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2} 54
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\json[1].json 54
%HOMEPATH%\ntuser.ini 38
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.html 37
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt 37
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.url 37
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.vbs 37
%HOMEPATH%\# DECRYPT MY FILES #.html 37
%HOMEPATH%\# DECRYPT MY FILES #.txt 37
%HOMEPATH%\# DECRYPT MY FILES #.url 37
%HOMEPATH%\# DECRYPT MY FILES #.vbs 37
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js 36
%APPDATA%\Adobe\Acrobat\9.0\TMGrpPrm.sav 36
%APPDATA%\Microsoft\Outlook\Outlook.xml 36
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.html 36
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.txt 36
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.url 36
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.vbs 36
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\# DECRYPT MY FILES #.html 36
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\# DECRYPT MY FILES #.txt 36
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\# DECRYPT MY FILES #.url 36
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\# DECRYPT MY FILES #.vbs 36
%APPDATA%\Microsoft\Outlook\# DECRYPT MY FILES #.html 36
See JSON for more IOCs
File Hashes
  • 0209aa718b9b606b5cad5f9783ef1eb441ab1b6ff63283855e8b6d74f4649ec5
  • 03050ca0e3c1e6fc7a9782b5791aeccc77a1f07a7a8a675feb6e756226174410
  • 04043499a4936537e774dc6a381ccaeab8bb853d84819b9be12de2931d6646de
  • 0468b2231ea7059a58566e1a77d170f9c3a7e417d0221e8d7ca0747607bba2c3
  • 0680c78425029623806a8fd8f305523564e52bb68779ccffd698b78e218e249e
  • 087fa7d28264fc9c06eb7031891b68794c67b7b571176194e313c227437a1ea8
  • 09b4791e9e2eed217cf3df60f0386b010dccfc12a0b8c67b3cd2007fdbfb8e74
  • 0adb55a70a4c9f9e2bfcd33bb7c7b7b2f5d309b5ad006e7364aca2fbcda6c505
  • 0ca6bf5961f23df78cd48d7cde29d58b7d23e22598f784d04a1ca0676a466c0a
  • 0cf92c126ff4860a912d3e5d9d21c546edf434b46a1ea8bdddaf1eace91bc7ce
  • 0d7b033bd7734735b8e101b820be42c37e6957dd556da8b26f05f50edc3cb96f
  • 0dc0bfebad2716cfc4eb1b6d2853929d110fa2589af4d662d0c35231e9e1e291
  • 0eb148582c01d74361a630671d8c4d7f2577cbf09bea123f16df962e4b7d3df8
  • 0fa00710b9232318f7288b3723436ccc51714089030fabe581a00cd057b71865
  • 0fcb3e096368ecbe9d96c2c88ef721c29b596db298a6790a27ccab7bffe5a12b
  • 103517b74d9bc58c6a54d0a635ef45417540aeb5d8b5809ad110abb4685b0c2b
  • 10de95456a338a6f0edc9cd277ed314380a335dcc8e921e6eb7b40b526bca0fc
  • 130cd09e0e050acf6b75411b57c1146cd6f177f765e8cde272bd45b641e068d8
  • 13f983ebe9787626f1fe2e6615ad9c8cbc997b363ad9c2f91a1295a9a1db65db
  • 1677324000e28746b206c781a6b653f87b69e144c18d5f366aa9f0f2af83a8b7
  • 1768e3f32fe5c938f3baed815000b18020b10dd8ac440aa4bef7258cab863395
  • 177644a4e59f0f0b468e176972895a55b724fc19db205f555e98c06851982084
  • 179f11a15d4a284bf8e10002663f744bee9903bb2c8eae9e22308a49bca9ff03
  • 17f46c0701439f25126d59dd4b3b8c4cb131e260cc199bb8bb61414128fd3aef
  • 18adeddd8205122987da070c640e8eaf72e2e4bc5f2f58491a5e83f7ed6c2c25
  • See JSON for more IOCs

Coverage


Screenshots of Detection

AMP




ThreatGrid



Umbrella




Malware



Win.Trojan.Winwebsec-6935682-0


Indicators of Compromise


Registry Keys Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: UpdatesDisableNotify
10
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 10
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name: Start
10
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: Start
10
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System 10
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: ConsentPromptBehaviorAdmin
10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
Value Name: HideSCAHealth
10
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WUAUSERV
Value Name: Start
10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\svc 10
<HKLM>\System\CurrentControlSet\Services\luafv 10
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LUAFV
Value Name: Start
10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SYSTEMRESTORE
Value Name: RPSessionInterval
10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS DEFENDER
Value Name: DisableAntiSpyware
10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: 98BE0FA9BB7E8E3C000098BD76F2948C
10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: 98BE0FA9BB7E8E3C000098BD76F2948C
10
<HKLM>\SYSTEM\CONTROLSET001\ENUM\WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_HARDDISK&REV_2.5+#1-0000:00:1D.7-2&0#
Value Name: CustomPropertyHwIdKey
3
<HKCU>\Software\Microsoft\Installer\Products\98BE0FA9BD7E903C000098BD76F2968C 3
<HKCU>\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\98BE0FA9BD7E903C000098BD76F2968C 3
Mutexes Occurrences
98BE0FA9BB7E8E3C000098BD76F2948C 10
98BE0FA9BC7E8F3C000098BD76F2958C 3
98BE0FA9BCBE8F7C000098BD76F295CC 3
98BE0FA9BD7E903C000098BD76F2968C 3
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
123[.]108[.]108[.]42 10
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
N/A -
Files and or directories created Occurrences
%ProgramData%\98BE0FA9BB7E8E3C000098BD76F2948C 10
%ProgramData%\98BE0FA9BB7E8E3C000098BD76F2948C\98BE0FA9BB7E8E3C000098BD76F2948C.exe 10
%ProgramData%\98BE0FA9BB7E8E3C000098BD76F2948C\98BE0FA9BB7E8E3C000098BD76F2948C.ico 10
%ProgramData%\98BE0FA9BB7E8E3C000098BD76F2948C\98BE0FA9BB7E8E3C000098BD76F2948C 3
%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Care Antivirus\System Care Antivirus.lnk 3
%HOMEPATH%\Desktop\System Care Antivirus.lnk 3
%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Care Antivirus 3
File Hashes
  • 10b34c1a0b739cd6c12e2926372afcd0cbf6f95be9d1b45038144bd3efb5eb79
  • 1a448e78d2668f4dad016aca5092107f4d1ee19dadf8886e8a0ec4e2b550b317
  • 26a08a46deffe995ba67d9aaf547b55a265fe513a8293d51f3f9f0b3d944808c
  • 72f94e87b1fa1393360d9cacbdebb1ffebd5754c7d93121e0e887eacb8529c87
  • 8725d076eb421b4e4737792ad07647db9a263e4da2f0436bccd6c8ff9f752d39
  • b18e5830f0e557d72ba6ba2dbb59da23cf8e2539148efc51ed01a0364210b06d
  • b4b5fdc7fcf6f86a9ffba97a9d2e159f0078e9ffc090deb948660a3c8e5cdd07
  • d45ba937d7d532907d5da3fc979a96b1efa5e9c9a4c6b5c45f683925a9524ac2
  • d54730e93be5c4d17de56a904aa56610c06fdf425083277343c9ece4ecc922df
  • e165145377ae247117657cb0172fd7767907dd1ee5d4a698cbf58a6f4af03624

Coverage


Screenshots of Detection

AMP




ThreatGrid



Win.Malware.Tovkater-6936213-0


Indicators of Compromise


Registry Keys Occurrences
<HKLM>\System\CurrentControlSet\Control\Session Manager 14
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER
Value Name: PendingFileRenameOperations
14
<HKLM>\SYSTEM\ControlSet001\Control\Session Manager 10
Mutexes Occurrences
N/A -
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences
185[.]53[.]178[.]6 1
185[.]147[.]15[.]5 1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences
MIRRACLEZ[.]CLUB 10
mirraclez[.]club 10
zaltzburgopportunity[.]top 4
binocularhearing[.]top 4
CARIBZ[.]CLUB 2
flowergroup[.]top 1
binoculuz[.]club 1
BINOCULUZ[.]CLUB 1
backverge[.]top 1
gaslight[.]metimes[.]ru 1
BACKVERGE[.]TOP 1
frock[.]encours[.]ru 1
caribz[.]club 1
lurk[.]ecolleague[.]ru 1
simpledrive[.]top 1
Files and or directories created Occurrences
masrra11.exe 8
imasrr13.exe 4
%LocalAppData%\Temp\nsnD405.tmp 2
%LocalAppData%\Temp\nscD4B1.tmp\nsJSON.dll 1
%LocalAppData%\Temp\nsnD010.tmp\INetC.dll 1
%LocalAppData%\Temp\nsnD010.tmp\Y gamemonitor.dll 1
%LocalAppData%\Temp\nsnD010.tmp\cmutil.dll 1
%LocalAppData%\Temp\nsnD010.tmp\colbact.dll 1
%LocalAppData%\Temp\nsnD010.tmp\icrub.exe 1
%LocalAppData%\Temp\nsnD010.tmp\nsJSON.dll 1
%LocalAppData%\Temp\nsiD435.tmp\INetC.dll 1
%LocalAppData%\Temp\nsiD435.tmp\X shmgrate.exe 1
%LocalAppData%\Temp\nsiD435.tmp\Y gamemonitor.dll 1
%LocalAppData%\Temp\nsiD435.tmp\Z shmgrate.exe 1
%LocalAppData%\Temp\nsiD435.tmp\cmutil.dll 1
%LocalAppData%\Temp\nsiD435.tmp\colbact.dll 1
%LocalAppData%\Temp\nsiD435.tmp\msimn.exe 1
%LocalAppData%\Temp\nsiD435.tmp\nsJSON.dll 1
%LocalAppData%\Temp\nsiD435.tmp\shmgrate.exe 1
%LocalAppData%\Temp\nsiD435.tmp\xantacla.exe 1
%LocalAppData%\Temp\nsiDC21.tmp\INetC.dll 1
%LocalAppData%\Temp\nsiDC21.tmp\X shmgrate.exe 1
%LocalAppData%\Temp\nsiDC21.tmp\Y gamemonitor.dll 1
%LocalAppData%\Temp\nsiDC21.tmp\Z shmgrate.exe 1
%LocalAppData%\Temp\nsiDC21.tmp\cmutil.dll 1
See JSON for more IOCs
File Hashes
  • 4f8cf035324575449ee73dcfcc1ecededc5d1f3f8a4cec2f0e85455516207eb0
  • 9fc837165be91f7c7042e1dbcc4db8dd38d002f9214b861db6214c636055bac4
  • a40c7290af61e7f34282faf839982f9fbb33db423751ce59d11a156140e711ef
  • bd9f2de34957bcd509e47fcd7cd7e7f2af01b0e5078c0823680cdcd1d753341a
  • c880d5254c7e1d5723862100c2d57bd3cbcaad6560437ac59bd1071172980197
  • cd69efb3bb139a1675b90690635f8584896fc10c1f85be17f92206f8d856289d
  • d6dc00609f709cc451cb61f1d77fc84e8572494ebc3ba0de80518f7ab234384e
  • e82dd6108b2272e13f6365d75943de81b4196cfa4d885a78a2ac3665249ba2c5
  • f102bc0d0ebe8adf4486b0567c9ab493faa619aa1ae48ac3572ecb23b2de9836
  • f997bc9973d1bac7be25513c9ef80783949069a00732fd630e74876a3019dd3b
  • fcec660083595a7956cc13f9815ce23edcfbfa3e82c150a2f0fe6c0449433ce0
  • fd7696f075bb712bd4d7f14dad9c297d99669d3b1c61e51ee2dae4cfa897b9ff
  • fdac4b0e291a27c91cd3050c4e811d4fe33bb2189e44015d0d5a88f168441815
  • fef0d09e80bce24d232f60977972934eb9b1a984f4b42fac5a9d9ebd93757127

Coverage


Screenshots of Detection

AMP



ThreatGrid




Umbrella



No comments:

Post a Comment