Threat Roundup for April 19 to April 26

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 19 and April 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Win.Malware.Gandcrab-6954107-0
Malware
GandCrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB", ".CRAB" or ".KRAB". GandCrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and GrandSoft.
Win.Malware.Kovter-6953553-0
Malware
Kovter is known for it's fileless persistence mechanism. This family of malware creates several malicious registry entries which store it's malicious code. Kovter is capable of reinfecting a system even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
Win.Packed.Scar-6952917-0
Packed
Scar will download and execute files to the system while attempting to spread to other machines by copying itself to removable media.
Win.Dropper.Lydra-6952708-0
Dropper
Lydra will monitor user activity to steal sensitive information like passwords and setups various persist mechanisms to ensure execution at startup.
Win.Trojan.Zeroaccess-6952579-0
Trojan
ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click fraud campaigns.
Doc.Downloader.Powload-6952235-0
Downloader
Powload is a malicious document that uses PowerShell to download malware. This campaign is currently distributing Emotet malware.
Win.Ransomware.Cerber-6952131-0
Ransomware
Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."
Win.Packed.Tofsee-6952124-0
Packed
Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages in an effort to infect additional systems and increase the overall size of the botnet under the operator’s control.
Win.Malware.Emotet-6947486-0
Malware
Emotet is a banking trojan that has remained relevant due to its continual evolution to better avoid detection. It is commonly spread via malicious emails.
Win.Malware.Mikey-6953803-0
Malware
Mikey is a trojan that installs itself on the system, collects information and communicates with a C2 server, potentially exfiltrating sensitive information. This threats can also receive additional commands and perform other malicious actions on the system such as installing additional malware upon request.

Threats

Win.Malware.Gandcrab-6954107-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: mrtauqkjwnb`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: taiqbyxzlxk`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: kgdxylqkehn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: wthkafbhnnz`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: csrzoywxadl`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: wyvcshrzmzp`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: htiqstanrob`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: wpxojreokly`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: blyfivnejxn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: lrrnacksfnc`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: kamceprdczy`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: itqfvoapacm`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: ncqtnmbrepx`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: wiuqosifjbq`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: sktkqyirmst`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: bwipaxisell`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: hdcpovptyus`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: jquurrwhzkq`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: ysblnuivkrs`	1

Mutexes	Occurrences
`Global\pc_group=WORKGROUP&ransom_id=4a6a799098b68e3c`	19
`\BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=ab8e4b3e3c28b0e4`	19

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`66[.]171[.]248[.]178`	19

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`1[.]1[.]168[.]192[.]in-addr[.]arpa`	19
`ipv4bot[.]whatismyipaddress[.]com`	19
`1[.]0[.]168[.]192[.]in-addr[.]arpa`	19
`malwarehunterteam[.]bit`	19
`ns1[.]virmach[.]ru`	19
`politiaromana[.]bit`	19
`gdcb[.]bit`	19
`ns2[.]virmach[.]ru`	19

Files and or directories created	Occurrences
`%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c5`	19
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\O1OD133V.htm`	19
`%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\desktop.ini`	15
`%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\ipv4bot_whatismyipaddress_com[1].htm`	15
`%APPDATA%\Microsoft\hghbta.exe`	1
`%APPDATA%\Microsoft\gknrwh.exe`	1
`%APPDATA%\Microsoft\fpimav.exe`	1
`%APPDATA%\Microsoft\menqqw.exe`	1
`%APPDATA%\Microsoft\yajjhk.exe`	1
`%APPDATA%\Microsoft\fttqrq.exe`	1
`%APPDATA%\Microsoft\ggxike.exe`	1
`%APPDATA%\Microsoft\lxhknn.exe`	1
`%APPDATA%\Microsoft\aojsiy.exe`	1
`%APPDATA%\Microsoft\nsxpnb.exe`	1
`%APPDATA%\Microsoft\tywgei.exe`	1
`%APPDATA%\Microsoft\ucihie.exe`	1
`%APPDATA%\Microsoft\odrxqe.exe`	1
`%APPDATA%\Microsoft\clhbpq.exe`	1
`%APPDATA%\Microsoft\vacwir.exe`	1
`%APPDATA%\Microsoft\pzgooz.exe`	1
`%APPDATA%\Microsoft\ivnaov.exe`	1
`%APPDATA%\Microsoft\yvudxg.exe`	1
`%APPDATA%\Microsoft\lfkjbm.exe`	1
`\Win32Pipes.0000052c.00000017`	1
`\Win32Pipes.0000052c.00000019`	1
See JSON for more IOCs

File Hashes

1156e142aafbd439ee6bd2a9d0e8cd9fd4719ee9d9242b9c1916bfe1b45db99a
14f1688ab3d4c0866797ad43dc7df51d913a5df763fb12c7b72391075945cd8d
194966a4700fbad5d329b75df3794730255ec8afe5c2f385e45c79337f1cbb39
1f2a5163a9b3206f45a03c23bb05ad6c71d22add96374d9c127db58fe72289a2
3c8cdaf3626ede0754ea0f16a67c079ef4670cba8d0e1c4a88bd47856dbd49cb
45376d6ccfe68d1b2b82ad50f59f376917e17a09e2be48da015770f6a549f7af
468ea3dc192ff158b09e6cc09c8d4a190d5744dff6225edb93ae2385a75d9120
4cd88fe74eabf6fff9bcf700cae21da6021a1b45ad2c759b873f00031ec2f60d
5783f8f86692861ff73c02a84860086940a1dc31aa9c821804188f0e8e8ff1d0
5e0171a3a7832430d85b4681a247bb0f82aa3f07f024fa8605d3e9f7836ca6ec
7db58ac99c57662954d7f4183a5945bd352e7db6a0e3aebf31c19c29bc78a7d9
8745527a3c123b9155ae7d470cc549fcecbd97be2c515b8711412e93071c1bab
b1a195b1dc49ec6adaed3f6a9eb1e3a1089106ab8503f5e541897230c9c2fd5e
c6a7fa1f1f89d235957ce7fd38051a7e9a921847a30c6309da1c5e8cffb71e5e
d3cd9d746c796dc68b4dfae7657fcec9bad4c00cf2addb4f90ac1480beb8e0b2
d8752dbe07dd9642d6bb7f65701338d99ce8fb718ae803eb12ea41ff5ca15671
e1f314bc382f2163df72cd7aa083a2d3a4a78b0e6315689359bb543b5ee872ae
f1f63b367f7731f515f3076835426af9086e950b218b5371bc23d8c51e3a7c02
f8fd3c82782868205270cdc0b2edfd8c51a5da900bede625a16c1943b4ccd1e3

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Kovter-6953553-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WindowsUpdate`	29
`<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUpgrade`	29
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: internat.exe`	28
`<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE Value Name: DisableOSUpgrade`	28
`<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE Value Name: ReservationsAllowed`	28
`<HKLM>\SOFTWARE\WOW6432NODE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run`	28
`<HKCU>\SOFTWARE\3a91c13ab1`	28
`<HKLM>\SOFTWARE\WOW6432NODE\3a91c13ab1`	28
`<HKLM>\SOFTWARE\WOW6432NODE\3A91C13AB1 Value Name: 656f27d6`	28
`<HKCU>\SOFTWARE\3A91C13AB1 Value Name: 656f27d6`	28
`<HKLM>\SOFTWARE\WOW6432NODE\3A91C13AB1 Value Name: 96f717b3`	28
`<HKCU>\SOFTWARE\3A91C13AB1 Value Name: 96f717b3`	28
`<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION`	27
`<HKLM>\SOFTWARE\WOW6432NODE\3A91C13AB1 Value Name: 01b2a448`	25
`<HKCU>\SOFTWARE\3A91C13AB1 Value Name: 01b2a448`	25
`<HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel`	2
`<HKLM>\SYSTEM\LastKnownGoodRecovery\LastGood`	2
`<HKLM>\SOFTWARE\WOW6432NODE\8A6FD29F760019C2A`	1
`<HKLM>\SOFTWARE\WOW6432NODE\S191vn`	1
`<HKLM>\SOFTWARE\WOW6432NODE\8A6FD29F760019C2A Value Name: 22F2A9371858821393B`	1
`<HKLM>\SOFTWARE\WOW6432NODE\3E4A82EF50861857D`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LM7zAclcB`	1
`<HKLM>\SOFTWARE\WOW6432NODE\S191VN Value Name: noVD3r8i`	1
`<HKLM>\SOFTWARE\WOW6432NODE\S191VN Value Name: Ja8WDQ2COI`	1
`<HKLM>\SOFTWARE\WOW6432NODE\3E4A82EF50861857D Value Name: B6FAE5718727427E545`	1

Mutexes	Occurrences
`B3E8F6F86CDD9D8B`	28
`A83BAA13F950654C`	28
`EA4EC370D1E573DA`	28
`Global\7A7146875A8CDE1E`	28
`\BaseNamedObjects\408D8D94EC4F66FC`	24
`\BaseNamedObjects\Global\350160F4882D1C98`	23
`\BaseNamedObjects\053C7D611BC8DF3A`	23
`\BaseNamedObjects\Global\ServicePackOrHotfix`	2
`\BaseNamedObjects\Global\F7E10F769B0682E7`	1
`\BaseNamedObjects\2594BA9F8AA549A0`	1
`\BaseNamedObjects\95780D7FD6724D3D`	1
`\BaseNamedObjects\93444A15B4316C7F`	1
`\BaseNamedObjects\8AD0B80D27B7A6E8`	1
`\BaseNamedObjects\Global\CE758B9A90197724`	1
`\BaseNamedObjects\3E54017756DC8D88`	1
`\BaseNamedObjects\Global\E04DD8EC68AC932B`	1
`\BaseNamedObjects\254092C2E3B50CC1`	1
`\BaseNamedObjects\1AF828CB730214EA`	1
`\BaseNamedObjects\6CF52592B2A80076`	1
`\BaseNamedObjects\Global\15907BF02B9082CF`	1
`Global\ebcd2841-665f-11e9-a007-00501e3ae7b5`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`23[.]10[.]207[.]183`	2
`96[.]16[.]151[.]89`	2
`23[.]96[.]52[.]53`	2
`23[.]196[.]183[.]170`	2
`126[.]51[.]184[.]10`	1
`104[.]119[.]186[.]70`	1
`55[.]20[.]15[.]80`	1
`27[.]121[.]99[.]80`	1
`166[.]57[.]220[.]214`	1
`24[.]210[.]219[.]136`	1
`103[.]83[.]13[.]134`	1
`192[.]201[.]48[.]88`	1
`94[.]105[.]89[.]64`	1
`49[.]27[.]243[.]48`	1
`31[.]109[.]216[.]73`	1
`122[.]210[.]74[.]190`	1
`97[.]158[.]71[.]252`	1
`177[.]96[.]54[.]160`	1
`207[.]4[.]93[.]221`	1
`73[.]58[.]236[.]14`	1
`51[.]103[.]86[.]160`	1
`157[.]32[.]43[.]20`	1
`174[.]135[.]47[.]97`	1
`59[.]76[.]122[.]178`	1
`212[.]180[.]197[.]146`	1
See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`e10088[.]dspb[.]akamaiedge[.]net`	4
`e3673[.]dspg[.]akamaiedge[.]net`	4
`www[.]cloudflare[.]com`	1
`cpanel[.]com`	1
`cp[.]aliyun[.]com`	1
`netcn[.]console[.]aliyun[.]com`	1
`www[.]timo-ex[.]com`	1

Files and or directories created	Occurrences
`%TEMP%\WindowsXP-KB968930-x86-ENG.exe`	4
`%HOMEPATH%\Cookies\administrator@microsoft[1].txt`	4
`%HOMEPATH%\Cookies\administrator@microsoft[2].txt`	4
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\55F5KQ7B.htm`	2
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\BY8YMTTN.htm`	2
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\DRMICMKU.htm`	2
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\DU14067I.htm`	2
`%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KACXHDUX\desktop.ini`	2
`%SystemRoot%\inf\oem13.PNF`	2
`%SystemRoot%\inf\oem13.inf`	2
`%System32%\CatRoot2\dberr.txt`	2
`%SystemRoot%\KB968930.log`	2
`%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KACXHDUX\WindowsXP-KB968930-x86-ENG[1].exe`	2
`%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KACXHDUX\en-us[1].htm`	2
`%APPDATA%\Microsoft\Windows\Cookies\DU14067I.txt`	1
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\index[1].htm`	1
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\00A87HPC.htm`	1
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\9UBKMUJA.htm`	1
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\FQVQQJXR.htm`	1
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\V69XW46D.htm`	1
`\5965c0b5c4bb27a5399e\wsmwmipl.dll`	1
`\5965c0b5c4bb27a5399e\wtrinstaller.ico`	1
`%HOMEPATH%\Local Settings\Application Data\cacipe\cacipe.exe`	1
`%HOMEPATH%\Cookies\administrator@104.31.137[1].txt`	1

File Hashes

03dae55b56d3cf11136529cd2be296e4d6aa1a017f44a898d11ecc0b1b43e16e
06f1a2cffda751ae87026e4d5f54c2767a474b3aca7c9ddd2b1f7247a3ff75f6
0b01f3a59fcaa6520b12f9e3bdda2615e25b41e1d5c9e23e36a5f61c75e960ba
19c78081714b6154ce25bb431959dc537618338038ae30c866afb3d6d0094996
1f3a83a9744812c5b094691b4a87c4475fd8cbb85e69bf298edf917589261d4a
296af0b5e6f6e033108a2a7109f40e1152f1c4ead15db644dc5d0d0973de21f4
2a5c411fd65bb32f8f72b06ad17d8cb20258fc92dd1a7051e44550c314cc77f5
3b94d3a36980ad21baaf5c62d669160988880e9aac3c2db29c3f23609a4eaa53
3cbcc6671e6a7092a8a3f52d3cf93ff3d7c420fe6b0a34ec8bd0071a7d685217
3eab679b54cca6b0352b05c821b65dbc34e16f323d60986d728ea955897a55ee
44c5491ef99c542e06b1e166e5313dfb0007dd248bd08c6edaf72ce32f45232b
4b21ddc1d7e40802368f07299c0634f96323285c829aacea603aefc8f8f97e28
4f586d783cbd24a2cddee826f172ffeffbb953913721b87090f73cdc20e5da1b
5423ba59c1ae44dcd47385f0820c020657f56e2511453937adeb1eb73dcb5b2c
54d941b8f77a638074bc1a7f59f8f1650ca7e4e3077b7af6c79ebb9448656d15
552d1a03140e12a901753649a8eb234a337ee08dd57c1892f3a641bd7c1e332c
613d13d8759215714c4af6dc6f7af9e8984816d10265fc4203e3b87dddc784d7
7c54f727e0a21feecd3f1f4757050ff27722b0097db4781b25a157376c7e3693
83779e88704948dc02873d609db5d3efb4a47f968b5ce9d0e5edf02a7b7e56e7
91441e8775ea05faace24c054d0d913459d9e2d61d9cb2edec9692d2dc099e78
a5d9ccde01ee0baee4d86ae8bedce0bee0e6637f818e9707582481fa3459b87c
a606074562594ed99706376dec2e0991de42f98dd5c2718253e796b75b7d748c
b15ffdd820f05d45e29a1a58a15a0ac04e2c694e0507146de04f2038e52e5187
cafc5428cde0b46cc3472becf2a7360c309b6e7fd6b87243238eff0684215b84
cb5be428b5adeb1cfd372ea525bc8ee0e6244f05e4a25779e9ba5d1da57b2f12
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Packed.Scar-6952917-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\localNETService`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: Type`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: Start`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: ErrorControl`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: ImagePath`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: DisplayName`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: WOW64`	27
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LOCALNETSERVICE Value Name: ObjectName`	27
`<HKLM>\Software\Wow6432Node\localNETService`	17
`<HKLM>\SOFTWARE\localNETService`	15
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_8350`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_31696`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_12733`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_33107`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_24485`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_29347`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_48270`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_58951`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_3373`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_25588`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_8958`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_16087`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_3445`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_2899`	1
`<HKLM>\SOFTWARE\WOW6432NODE\LOCALNETSERVICE Value Name: Value_24818`	1

Mutexes	Occurrences
N/A	-

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
N/A	-

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
N/A	-

Files and or directories created	Occurrences
`%ProgramData%\localNETService`	27
`%TEMP%\jzq100219.dat`	27
`%ProgramData%\localNETService\localNETService.exe`	27

File Hashes

042b5f70f7211b31877525378d4e96bfe446f8f0e180962446a65c5e8a17eb08
08729005569c47f4d36611ac6f04e476e365e17578e6275c71b09b1007162907
0da7373b6529e881f8de9d33bbe4717b934d3f9eb1159166537ae93f58b02a29
0e7cccc382e99f10ef64bee8ec7be4c61e5dd2a2b41402e1c824912158e9d097
0ec741d2518772fc28534da4da8fbc7581d1cbe14864022412b971ae9fb8febb
25782acb55d3cd762558994ac725e31083cb8f10eb483877b3b9c3a178cba927
299325258ce603f5cbc78002e165f7b988596b2a626d5e5632c8f7c0b97d9fd0
2a13a36bc24d110399adde37adcbe1128d66ddf33bdccd3c90e37a5353eb1dcd
316803348e02989f019715f85e1f479506a3e74a67744f6dbe589380d8b9ab3d
514c836caccb6cf621230443278632465b7b10c4170b8a20109f0fb067444a65
572b94765953cd7d0d8a9bc4128b3805327104207af71bccc32f8f0cd580b4ff
5c7283a449024ccf30840ebedd11134742695875568e9619cda06b39bec6ec67
65d6f8a3358165bdbff21a025d43f182efbe9ea87feead320d5e10eea961fbd2
65dcb37789486112ef98cd5ce423b36beaa1b7fd1f854348b62d3f76b0f20540
694f63471c9fa8220b0312b71a1a268eaf6fc3a9e1c2c2be17c79a000ef0f1ca
789b97d71b0ad420bdba65d5da91a82cd3e6a4c5a5f6ed3f2f440e5e3bfed327
845f60e36148fd53502baea5c223f8103c1e214fe8fbfaba15c1b57b3ce100c7
8884ba2c677a3f6280211683ff0c28fd6522044d59f86662fd630ad8311d7353
8c0a5bdae921786a11fbfe67389a04caffc271fcb67633776cff4fe16d1a47a7
8d2d5b172a07beee3b67ac16076b89a140f98d189d8ae0873dd110bdc6b28692
8d34f3d96b6f7eb3f99b865cb449735fe2ec411d44498a5a61e148ffe166a714
8e684a3f609ac8e4e47ceabcda4abd75d80f699b313de65fba2e5adedee1f874
9161e4bf4085fe4f6256178832565a787e6853b0003dbcbdce3e3777b614cf71
990851a27f622a2a4f8d3d818b9383a4551fd29c00ee327dc509fb088bbdc03b
9f522963850cbc45dac570eea66a46822c21ea3aed095eb8aa8ec8381eb15bf5
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Lydra-6952708-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: internat.exe`	42
`<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List`	42
`<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\Run`	42
`<HKLM>\SOFTWARE\Classes\Wow6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}`	42
`<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run`	42
`<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices`	42
`<HKCU>\SOFTWARE\WinRAR\General`	42
`<HKCU>\SOFTWARE\WinRAR`	42
`<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} Value Name: ThisEXE`	42
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: lsassv`	42
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: msrpc`	42
`<HKCU>\SOFTWARE\WINRAR\GENERAL Value Name: Sound`	42
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST Value Name: c:\windows\servicew.exe`	42
`<HKLM>\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}`	41
`<HKU>\Software\Microsoft\Windows\ShellNoRoam\MUICache`	41
`<HKLM>\SYSTEM\CurrentControlSet\Services\winsys`	38
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: winsys`	38
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: winsys`	38
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES Value Name: winsys`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: DependOnGroup`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: DependOnService`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: Description`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: DisplayName`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: Group`	38
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSYS Value Name: ObjectName`	38

Mutexes	Occurrences
N/A	-

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
N/A	-

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
N/A	-

Files and or directories created	Occurrences
`\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGammaLoader.scr`	42
`%SystemRoot%\mui`	42
`%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\AdobeGammaLoader.scr`	42
`%SystemRoot%\calc.exe`	42
`%SystemRoot%\lsassv.exe`	42
`%SystemRoot%\msrpc.exe`	42
`%SystemRoot%\mui\rctfd.sys`	42
`%SystemRoot%\ole32w.dll`	42
`%SystemRoot%\pool32.dll`	42
`%SystemRoot%\regedit2.exe`	42
`%SystemRoot%\servicew.exe`	42
`%SystemRoot%\setupiwz.dll`	42
`%SystemRoot%\unrar.dll`	42
`%SystemRoot%\winsys.exe`	38
`%SystemRoot%\ieks32.dll`	38
`%SystemRoot%\viaud.dll`	38
`%SystemRoot%\woron_scan_1.09_eng.exe`	29
`%SystemRoot%\smart_scan_eng.exe`	13
`%SystemRoot%\syswin.exe`	4
`%SystemRoot%\ikf32.dll`	4
`%SystemRoot%\iksec.dll`	4

File Hashes

0b0700bab86aadc28b8216e487747e1f248b64db255972efd82b8a0b0e9fbaf0
134610cf4c7463abd435a7e9e5c3957e1b013d74b73248129f77eda2023bf341
149aa87d3b637af6bc98b1b317c88c0faf1aac59d3ae0228f82375dc63668e27
16877fdf6baa760ff501d6ffac2d827175debe7d1788bb1d9ebf96359d3ea8ed
181fb91a7a3ea5d60862a240abe074d704385a41a4fd2a7c343171452ab207a3
19ed54738b7eacd638cb8f6c7f41bebce61c596071ff8048c85c2c94ceb9b59d
1be2192207e35f4d286154428882707f8fbc947073f87de650e3cae25aac6a53
1bf0f79aa7076f8e0499646d892b1c883a12b76720ec1ee95583e4f0bd1e2548
209c3027ee89df1f9c43caa49f33d2ae796a6e4f75f41fa3d29a6c618236aeb5
23e8478e532060223d05a4172626d3ce7280d0a50a3c98e55a20f3b67527d598
3448fc8f0ba01e5e3f1c2200e09cb8ae7cdd0fb683a078520a8980b7cd8dbfd1
385aba59012ba5552914fa5fa5c000d4327631b33eae8173c4c0ed39fdaf86e8
39b0887601c58b9fa9703611d4a41790db3f5c42eeac30320796005d7cd3149a
3ec22bdc7999fdfee532c1f83f3026dd2935b4210325664024c3de0ce60cbd92
3f927933cb408dc994ce17f3afab04a2b0d6c6f63f13622c92b3466e3502e20f
462b020edeec013d02f371189b6e26b868c9058f870de778f3bef56a3dd033ca
48c62b14b624255d0887c3c7dcd7d2863b82ece90129b1214abb9a829eeb39a3
490204655d5f6a89ee33f2b70efd100edbcc564ea27083cd30ae5bddda319e7e
4b2c8b21a1c0350c52740a0e21151dec03786f2a1c2280315dac70815fb6ca23
503e790a64d6232628252bb99642e3dbe0da13d6ee748a60ce5ee9bf0b91758d
5619dc4d1f452579077dc95c069e9b9a059fc93285f734925133906e1d2bca1b
5b2455a6d058652270681d6d7040111e74f468fe771f41588ad8038fe3d59803
5dfa493f6d6b13c44867ed1e60a90462629383a7330f9fb0ffd1f43c017362e9
795f0d8204993cd7c79551555b8b8d37a2d0cbe18ff1d01fc5cb3131c95ee958
8267bc6bb334a0f103bc55df5d8a231dc485b76588eb664639cbb16972fef4d6
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Malware

Win.Trojan.Zeroaccess-6952579-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSASCUI.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WERFAULT.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UI0DETECT.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CTFMON.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WUAUCLT.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HIJACKTHIS.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MBAM.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MBAMGUI.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MBAMSERVICE.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SBIESVC.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SANDBOXIEWUAU.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SANDBOXIEBITS.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SANDBOXIECRYPTO.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SANDBOXIEDCOMLAUNCH.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SANDBOXIERPCSS.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SBIECTRL.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\COMBOFIX.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PEV.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HIDEC.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SWREG.EXE Value Name: Debugger`	28
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HELPPANE.EXE Value Name: Debugger`	28
`<HKCU>\CONTROL PANEL\SOUND Value Name: Beep`	28
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: NoFile`	28
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SR Value Name: Start`	28
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: NoFolderOptions`	28

Mutexes	Occurrences
`!PrivacIE!SharedMem!Mutex`	28
`Local\VERMGMTBlockListFileMutex`	28
`Local\!BrowserEmulation!SharedMemory!Mutex`	28
`Local\URLBLOCK_DOWNLOAD_MUTEX`	28
`Local\URLBLOCK_HASHFILESWITCH_MUTEX`	28
`UpdatingNewTabPageData`	28
`{5312EE61-79E3-4A24-BFE1-132B85B23C3A}`	28
`{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}`	28
`!IEFileUpdater!Mutex`	28
`Local\InternetExplorerDOMStoreQuota`	28
`©Úü×À»¢Íéõèò©`	28
`Local\https://www.hugedomains.com/`	28
`Local\https://tiny.cc/`	27
`Local\http://mediadiscovery.net/`	20
`Local\http://widgets.outbrain.com/`	13
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1252`	3
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1176`	3
`IsoScope_13c_ConnHashTable<316>_HashTable_Mutex`	2
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_316`	2
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1604`	2
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1876`	2
`IsoScope_1f0_ConnHashTable<496>_HashTable_Mutex`	2
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_496`	2
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1932`	1
`Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1964`	1
See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`204[.]79[.]197[.]200`	28
`172[.]217[.]10[.]4`	28
`172[.]217[.]12[.]206`	28
`72[.]21[.]81[.]200`	28
`216[.]87[.]78[.]25`	28
`172[.]217[.]3[.]106`	27
`172[.]217[.]7[.]3`	27
`23[.]20[.]239[.]12`	27
`192[.]35[.]177[.]64`	27
`192[.]241[.]240[.]89`	27
`72[.]52[.]179[.]175`	27
`107[.]22[.]223[.]163`	27
`23[.]10[.]130[.]155`	26
`172[.]217[.]6[.]194`	25
`104[.]25[.]37[.]108`	25
`199[.]59[.]242[.]151`	25
`172[.]217[.]164[.]132`	25
`107[.]178[.]240[.]89`	25
`172[.]217[.]15[.]74`	25
`96[.]6[.]58[.]4`	25
`67[.]225[.]218[.]50`	25
`104[.]25[.]38[.]108`	22
`173[.]192[.]200[.]70`	22
`199[.]59[.]242[.]168`	21
`104[.]28[.]29[.]32`	21
See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`cdnjs[.]cloudflare[.]com`	28
`www[.]easycaptchas[.]com`	28
`secure[.]statcounter[.]com`	28
`cdn[.]pubguru[.]com`	28
`fonts[.]gstatic[.]com`	27
`ib[.]adnxs[.]com`	27
`www[.]googletagservices[.]com`	27
`bit[.]ly`	27
`HDRedirect-LB5-1afb6e2973825a56[.]elb[.]us-east-1[.]amazonaws[.]com`	27
`static[.]hugedomains[.]com`	27
`www[.]hugedomains[.]com`	27
`apps[.]digsigtrust[.]com`	27
`apps[.]identrust[.]com`	27
`tiny[.]cc`	27
`fastlane[.]rubiconproject[.]com`	27
`m2d[.]m2[.]ai`	27
`cdn[.]convertcart[.]com`	27
`tinyurl[.]com`	27
`directorio-w[.]com`	27
`www[.]qseach[.]com`	27
`www[.]directorio-w[.]com`	27
`bidder[.]komoona[.]com`	27
`c[.]statcounter[.]com`	26
`web[.]hb[.]ad[.]cpe[.]dotomi[.]com`	26
`securepubads[.]g[.]doubleclick[.]net`	25
See JSON for more IOCs

Files and or directories created	Occurrences
`%LOCALAPPDATA%Low\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico`	28
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\favicon[2].ico`	28
`%APPDATA%\Microsoft\Windows\Cookies\A71QDCIP.txt`	28
`%APPDATA%\Microsoft\Windows\Cookies\VF90XW39.txt`	28
`%System32%\drivers\etc\hosts`	28
`%APPDATA%\Microsoft\Windows\Cookies\HW3YF7T7.txt`	28
`%ProgramFiles(x86)%\Mozilla Firefox\searchplugins\google.xml`	28
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\urlblockindex[1].bin`	28
`%HOMEPATH%\27F6471627473796E696D64614\winlogon.exe`	28
`%APPDATA%\Microsoft\Windows\Cookies\SISHQLM4.txt`	28
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\domain_profile[1].htm`	28
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe`	28
`%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe`	28
`%ProgramData%\Microsoft\Windows\Start Menu\Programs\winlogon.exe`	28
`%ProgramData%\Microsoft\Windows\Start Menu\winlogon.exe`	28
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\winlogon.exe`	28
`%APPDATA%\Microsoft\Windows\Start Menu\winlogon.exe`	28
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\domain_profile[1].cfm`	27
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\t[1].gif`	27
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\t[1].gif`	27
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\domain_profile[1].htm`	26
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\domain_profile[1].cfm`	26
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\domain_profile[1].htm`	26
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\px[1].gif`	26
`%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\t[1].gif`	26
See JSON for more IOCs

File Hashes

2e9167886bb73eb0f56b7a64245a5bf4a87b9321cf9c32f2c93c646c32223eef
2f6cdf0428403cbefc3d9b4ac5b906b56f202c952eafa49b1a6d4b4394e7ba9d
4448b12c3707f70823189f20d310846d2b9de24ca3b76f33e345358d14dfd7c0
472fd77b2a880f424513a2b2ec18a1dd6ac8f15f4756787d10818d35c344e8ab
558cebedb7814ef92e02b020a444ed6a0dcb23dec761ccd3270548911f646c2b
686aa9a0dc49bdd733c78b6ff0f180b2887696365a6304069db8a485913c21de
68c892240aee5b55b6b8fb19593b9378fd7f23d42318566d73c4fbc42a77776d
80d68a9698e2f598f7c703d78eaa8a500d5f716cb93009d5cc1bacef47f88e2a
84aaafc52bd192f0bd17ea8e5dd34318c28a6ac87a84fa3efd629e3f9f3bf0b2
9994bd60526b01b3631a7b4ec012f50251966a0cb841b7ec583d12a374df24e8
9abc698de28993cd3f687686e12bca1b185dfb8687c4751b47ce7a265167725a
9b45576ccb59e5b083892fe7d6154cd8c3a0795088db2053f770b589f2769108
a66292bc2d1c99dfb5e8c870444e603798c923ecba4ac633f88d4430b19731a7
aadb0c76ee084384a9acbd3981a5c22e39431a45c82438a8f8b245043b1dc05b
aec1d3b9323fde4b0d192c7e4b4448d517b180f4776a0cbd266b3c0d843c1214
b021e5e867ed34c56aae7007ccdb0965c59d49b621a6aa3f3c4052f69e082b79
b05f01500646b2d52b30d146a39d07047311e200a4215afef7c6ff45f1e8279b
b156f81c67063ebde12bd89572d4f8fce933e725c2d6b2deab80f767bb5e6faf
b322ada9d35b5e884d7c2c63ede85a1e11d1b2ab7d136e0c05b14cdafe8c5423
b871a929a4c5bbeed88387296c7270ec20c76f40361ba87e0aa84a63a16c748b
bbc346b483d913d44549fcff8e6a240fa3e035bbbd468299d72a7a33b447cb6e
bf32e669b25059e41d0f296d183136c796030374a5fc848eb5dcd6b9020283c8
c72efd27ec54698b361fae7dceb14bd6dfe8883ffcc29c0d8e25fecd83249ffe
ca1dbce8a0e3ff901cb022b57267673ee9d1f6f42384189be4eb670c44796e45
d0a2e479604e92ece7d75295260f938091a62b807999a993d7c5377a4fbe3ca1
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Doc.Downloader.Powload-6952235-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCR>\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}`	25
`<HKCR>\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}`	25
`<HKCR>\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}`	25
`<HKCR>\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}`	25
`<HKCR>\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}`	25
`<HKCR>\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}`	25
`<HKCR>\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}`	25
`<HKCR>\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}`	25
`<HKCR>\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}`	25
`<HKCR>\INTERFACE\{5CEF5613-713D-11CE-80C9-00AA00611080}`	25
`<HKCR>\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}`	25
`<HKCR>\INTERFACE\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}`	25
`<HKCR>\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}`	25
`<HKLM>\SOFTWARE\Classes\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}`	25
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\sourcebulk`	25
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: Type`	25
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: Start`	25

Mutexes	Occurrences
`Global\I98B68E3C`	25
`Global\M98B68E3C`	25
`Global\Nx534F51BC`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`152[.]168[.]82[.]167`	25
`197[.]91[.]152[.]93`	25
`47[.]99[.]85[.]122`	25
`66[.]228[.]45[.]129`	15
`77[.]82[.]85[.]35`	15
`239[.]255[.]255[.]250`	1
`216[.]98[.]148[.]157`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`dudumb[.]com`	25

Files and or directories created	Occurrences
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat`	25
`%HOMEPATH%\778.exe`	25
`\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8`	1
`%System32%\en-US\tzres.dll.mui`	1
`%System32%\WindowsPowerShell\v1.0\FileSystem.format.ps1xml`	1
`%SystemRoot%\SysWOW64\bVjUjfFnlezvN1Uus.exe`	1
`%SystemRoot%\SysWOW64\Iv7bzYqWHO4xGd.exe`	1
`%SystemRoot%\SysWOW64\Kyo1lmFLAsBgZNy.exe`	1
`%SystemRoot%\SysWOW64\AsiXrqyEtbD.exe`	1
`%TEMP%\CVRB4E.tmp`	1
`%SystemRoot%\SysWOW64\4lfjNl8nHPqt1Js4Bp.exe`	1
`%SystemRoot%\SysWOW64\fVyEM3EWs7XQ.exe`	1
`%SystemRoot%\SysWOW64\rwzinD3GMw1HRORxO.exe`	1
`%SystemRoot%\SysWOW64\myqCWvEqggyRaDCYm.exe`	1
`%SystemRoot%\SysWOW64\QrGtyKE.exe`	1
`%SystemRoot%\SysWOW64\EWRwGw7IYRd.exe`	1
`%SystemRoot%\SysWOW64\BDlBrj99pY7wbdknU.exe`	1
`%SystemRoot%\SysWOW64\ti93nsoZWFJbLoZ.exe`	1
`%SystemRoot%\SysWOW64\10czIsyY6Qn52PBJ8.exe`	1
`%SystemRoot%\SysWOW64\gCOkjmOgE39uf7.exe`	1
`%SystemRoot%\SysWOW64\a9xRIWvuM1dZbNKU.exe`	1
`%SystemRoot%\SysWOW64\hsCc2.exe`	1
`%SystemRoot%\splwow64.exe`	1
`%SystemRoot%\SysWOW64\EFTI4zp.exe`	1
`%SystemRoot%\SysWOW64\swlZVw2znOToKUOSMk.exe`	1
See JSON for more IOCs

File Hashes

01664c310c364946846933f45a9db25326db7133275446e38e7eccd56f2b80b4
14c53e5330f82bf1449cda84130abcf0b3ffe2ce29d16a6d7a8b3c17601bffea
185d2c002d778f0fec20cd7a6cb749d19577b95839be3cb7af13916e6870a7ef
1ecfe0e89a380160df4b62d4b56321bfad3624ea07334f4271b9b3a0de323fdf
1f2acd076d0c1aaf5832d9c30ca76cd469562fd79625b308714e87e029379052
2cdc8b8fa281a4b2ab63a8f8098a71dc05d50dc06858cb0ae701487608bda79f
37317c48991a92e9deb17122cc64e572e9dac5402cf89aa47db8866ba9ea93e0
37f9cc3f495f80e03c1454869205d757959c9f46171ae6cb7ded62bb6a4bc37f
3fa5e87f6b8331816fb77091303df6c30a124c8359cdee61127a05353c561961
42c76634b3baf9017b152bfd49863669f3aaa5423f084bc4fde730587e07d8fe
4832624b2bbc3d9a98ecea0d2e9ae0db57f90d6cc314a7fddc86521edd7bd979
500e41605b772679750255bfae4e6c369051ff64ca3aceae7e1d32c859529f1d
748968b90d8f84cec298ea1edb0cf037a4eb580b8c0dbcb10f3252f520a3b5a6
7cbd6f18182bf68d5506a164a42bff14759a2be77b5adc5f35e77a7ba68fbe12
7d5f2a044fc3fff1aa2053a86da81068c53c12ed8b9ad4b2adf7693a73e134b4
8284710f69f25d748299231f7764e53fc963049bd46fd0aed36146868d8e3df3
8f8e289691e3f7a6ad872a72c601d634e825972c9562d8f849bc571026327f62
97ec98bb0661fb192eac75f8e184d56dd2ce8395cf1b7420ed2975f372cca267
a05e3987b94e0dde5d20f902133a5571ee60ecf7e077e4497be5183bbb472d9e
a29afb3beb3244232df4083ba09eac61a60c2f1a23108f60d1205d43a7be59ec
a791c7c95cb9310ab719abebc47c63424ffaab3ea180ff71ea369f33c1c1061c
b0c3ffe7cf0c331ad9a44790ad48c6b57ed7b38d3612aba23e8a02685735531c
bf4f44397b89e0103a1422962049db2e6935ee3b89575131baf195aab69c41ed
c2c3d7e6e279d271edcc78b072b24e0ada5c0f4a83e997a33ed26953bc951f23
c5710bc33402f7e096d1518df37b1e43e7a5de4286863f3a5840543e2bae9e9d
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware

Win.Ransomware.Cerber-6952131-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: internat.exe`	14
`<HKCU>\Software\AppDataLow\Software\Microsoft\D31CC7AF-167C-7D04-B8B7-AA016CDB7EC5`	14
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: api-PQEC`	14
`<HKCU>\SOFTWARE\APPDATALOW\SOFTWARE\MICROSOFT\D31CC7AF-167C-7D04-B8B7-AA016CDB7EC5 Value Name: Client`	14
`<HKCU>\SOFTWARE\APPDATALOW\SOFTWARE\MICROSOFT\D31CC7AF-167C-7D04-B8B7-AA016CDB7EC5 Value Name: {F50EA47E-D053-EF14-82F9-0493D63D7877}`	14

Mutexes	Occurrences
`{A7AAF118-DA27-71D5-1CCB-AE35102FC239}`	14
`Local\{57025AD2-CABB-A1F8-8C7B-9E6580DFB269}`	14
`Local\{7FD07DA6-D223-0971-D423-264D4807BAD1}`	14
`Local\{B1443895-5CF6-0B1E-EE75-506F02798413}`	14
`{8303E239-0653-AD8E-2867-9A31DC8B6EF5}`	4
`{07C292C9-BA97-D1C3-FC2B-8E95F08FA299}`	2
`{FB179D42-1E2D-E531-005F-32E93403862D}`	2
`{6B06C8E1-CEE8-D5D9-30CF-E2D96473361D}`	1
`{97FA9976-0AD7-E1DA-CCBB-DEA5C01FF2A9}`	1
`{AFC31B69-429D-B93B-C453-96FD38372A81}`	1
`{E73AB138-1AFB-B10F-5C0B-EE75506F0279}`	1
`{C352A3DA-46D9-EDDF-68A7-DA711CCBAE35}`	1
`{3FA15864-923D-C93F-94E3-E60D08C77A91}`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`87[.]106[.]18[.]141`	14

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`groupcreatedt[.]at`	14

Files and or directories created	Occurrences
`%APPDATA%\Mozilla\Firefox\Profiles\1lcuq8ab.default\prefs.js`	14
`%APPDATA%\Microsoft\Dmlogpui`	14
`%APPDATA%\Microsoft\Dmlogpui\datat3hc.exe`	14
`%TEMP%\5932\2C99.bat`	1
`%TEMP%\65B0\B2D8.bat`	1
`%TEMP%\C924`	1
`%TEMP%\C924\E492.tmp`	1
`%TEMP%\C924\E492.bat`	1
`\TEMP\670E9F~1.EXE`	1
`%TEMP%\C1A4`	1
`%TEMP%\C1A4\60D2.tmp`	1
`%TEMP%\C1A4\60D2.bat`	1
`\TEMP\708D16~1.EXE`	1
`%TEMP%\F6A8`	1
`%TEMP%\F6A8\30.bat`	1
`\TEMP\AE71FB~1.EXE`	1
`%TEMP%\752A`	1
`%TEMP%\752A\BA95.tmp`	1
`%TEMP%\752A\BA95.bat`	1
`\TEMP\7634AC~1.EXE`	1
`%TEMP%\5FB8`	1
`%TEMP%\5FB8\AFDC.tmp`	1
`%TEMP%\5FB8\AFDC.bat`	1
`\TEMP\B89CC6~1.EXE`	1
`%TEMP%\1724`	1
See JSON for more IOCs

File Hashes

55c79a0a7d5bc93ae1e0edcbd6c838fa361e67d404f8f38089939a01d5cc27c5
670e9fc88468a253b00e9ca9783baccebcc6effa0c5902026b649da6b72f3249
708d163c05a5986c1691f48bbff37ccfda13cda6704d6a1a9ac0e295dc6739ae
7634ace88199348cc6bff675c216b9d26c13803d59bc112eae19188cd535a565
77517b420d96ac130c586d567b3ce4f12ef34918e268339758cd663a54296806
ae71fb978b5abbff24740db3a7e083392f3301e46ad2b904064e9f48825bc52e
b36d27dd1a266aa0e29131e78835a4b00ff337bc4ccd72af1cc16af93d252cc7
b89cc647d71b28c7bd382299e7b574ad6dfd7ecbcf6dae011513874c5a5ddab6
ba0bbae843fd8675f57e7cf62b1f48781de38c25adb33e64083cd1af1b2b2f69
c7f6fb53efdb5080fdb1fa29c84c66eb7e63369a1525dc84586eaee5ec942589
c8e133e78982e35707b339263fdbb89e41c8b02e9eb80a89255c982fe07374ba
cd16db51872581108c2e9beb6a2ba93153c67f85db299f10b4fe11f6e7a8a19d
d9891ebd33d5b507598c11c6855c5dae0c10e4c8a41069020ca9c786960b30d4
ee85ff6ee5b001904f3ba1be01d3e7f67e7fdcf222a39f5a1e451be999b8e18c

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Packed.Tofsee-6952124-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\System\CurrentControlSet\Services\NapAgent\Shas`	17
`<HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs`	17
`<HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig`	17
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups`	17
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI`	17
`<HKU>\.DEFAULT\Control Panel\Buses`	17
`<HKU>\Software\Microsoft\Windows\ShellNoRoam\MUICache`	17
`<HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon`	17
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config0`	17
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config1`	17
`<HKU>\Control Panel\Buses`	17
`<HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel`	16
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config3`	16
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config2`	16
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\yrflksyn`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\yrflksyn`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: Type`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: Start`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: ErrorControl`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: DisplayName`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: WOW64`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: ObjectName`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: Description`	6
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\YRFLKSYN Value Name: ImagePath`	6
`<HKLM>\SYSTEM\ControlSet001\Services\ylrseput`	3

Mutexes	Occurrences
`Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7`	17
`liqbftsowkinegql`	17

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`69[.]55[.]5[.]250`	17
`144[.]76[.]199[.]43`	17
`98[.]136[.]96[.]73`	17
`98[.]136[.]101[.]116`	17
`176[.]111[.]49[.]43`	17
`46[.]4[.]52[.]109`	17
`144[.]76[.]199[.]2`	17
`85[.]25[.]119[.]25`	17
`117[.]53[.]114[.]15`	17
`67[.]195[.]228[.]87`	17
`66[.]218[.]85[.]151`	17
`64[.]98[.]36[.]4`	17
`43[.]231[.]4[.]7`	17
`98[.]137[.]157[.]43`	17
`52[.]73[.]137[.]222`	17
`167[.]206[.]4[.]79`	17
`34[.]212[.]80[.]54`	17
`18[.]209[.]118[.]139`	17
`172[.]217[.]164[.]132`	17
`94[.]23[.]27[.]38`	17
`65[.]20[.]0[.]49`	16
`35[.]162[.]106[.]154`	16
`167[.]206[.]4[.]77`	16
`74[.]208[.]5[.]4`	16
`208[.]89[.]132[.]27`	16
See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`smtp[.]secureserver[.]net`	17
`mx-aol[.]mail[.]gm0[.]yahoodns[.]net`	17
`mx[.]lycos[.]com[.]cust[.]b[.]hostedemail[.]com`	17
`hotmail-com[.]olc[.]protection[.]outlook[.]com`	17
`cxr[.]mx[.]a[.]cloudfilter[.]net`	17
`aol[.]com`	17
`mx[.]optimum[.]net`	17
`comcast[.]net`	17
`mail[.]com`	17
`ntlworld[.]com`	17
`naver[.]com`	17
`earthlink[.]net`	17
`cox[.]net`	17
`optonline[.]net`	17
`netzero[.]com`	17
`gmx[.]net`	17
`lycos[.]com`	17
`netscape[.]net`	17
`doctor[.]com`	17
`mx[.]bt[.]lon5[.]cpcloud[.]co[.]uk`	16
`btinternet[.]com`	16
`mx0[.]charter[.]net`	16
`tiscalinet[.]it`	16
`mx0[.]gmx[.]com`	16
`peoplepc[.]com`	16
See JSON for more IOCs

Files and or directories created	Occurrences
`\net\NtControlPipe10`	17
`%HOMEPATH%`	17
`%SystemRoot%\SysWOW64\config\systemprofile:.repos`	17
`%SystemRoot%\SysWOW64\config\systemprofile`	17
`%SystemRoot%\SysWOW64\yrflksyn`	6
`%SystemRoot%\SysWOW64\IPHLPAPI.DLL`	3
`%TEMP%\wdqqtewr.exe`	1
`%TEMP%\nmyuzjtg.exe`	1
`%TEMP%\vmfipcon.exe`	1
`%TEMP%\awqwcewn.exe`	1
`%TEMP%\vrlrxzri.exe`	1
`%TEMP%\euatucsb.exe`	1
`%TEMP%\mmlrcqxa.exe`	1
`%TEMP%\mkrnmvtk.exe`	1
`%TEMP%\cahdclja.exe`	1
`%TEMP%\nuhhkvni.exe`	1
`%TEMP%\vlrkltjs.exe`	1
`%System32%\huabnydc\younowmv.exe (copy)`	1
`%TEMP%\mreehgwb.exe`	1
`%TEMP%\wwvbmahk.exe`	1
`%TEMP%\lkwsxhre.exe`	1
`%TEMP%\tfgavrsp.exe`	1
`%TEMP%\sefzuqro.exe`	1
`%TEMP%\amnhcyzw.exe`	1
`%System32%\sflmyjon\amnhcyzw.exe (copy)`	1
See JSON for more IOCs

File Hashes

0cc2e91e71b1e5fef8599413fbc7c8b3fa3a4cdaa92452304bdbb38cdb6d1161
15bf8fc46b91cb25730330dfbefcae2cb478e7ecbc18ac15d13b7b8eec01b697
1d045908a196354bf1c0f0da5c4eeff5e7aaa36a1b5ee7f21764a7133e6ec4c8
32a5d89a77130e01c19a58a0d3ff639d02c05ef2442f4e6b55a2e2b0a886926c
32bce81459bff859b7adff1113f6bda122a804a25e44c0d38951ee3ed39a1557
33e921f8c006374a78ab957ac1ce13183d65b4c633d2c7538c585d902f90ff44
3d97b118c14ce36766873e178c9ef124936767dec5312806213dd295ed0d5448
5c7ef91e7e96515dd59d0a252eca92d0d93a1bd9fa914eaf8c71933fcf7c8077
7509fa7e6294d05e0f25f96ea99fb9ea8b791a08128580ae86dda44fcb6c6d55
77cd1c22bb9099c666721a639bb980c1a5cde86cbc6323bc221f9184f6d9c092
77da1a87f241047d70d54b5a3e85e8bab4e349b32c58818766b9965c9fd40949
a69d1518f15d8d435010727797a40d687be8069de1edc522facb0669ffda324e
cfb237792af9dea590b59278d9ec73c301309d961cb78f15651c7757782c0671
d20e573316508252a71fe9b8c7f32fbbb9daf110a9e7aa13188f713509aedaaa
da359fbb459923a0e385cbd80d5d7c7505d8596a32f777e280b5784c4ba9a382
df134bd359722960fdcd67d79900ff8350616e73f25ab1204e7a7a0232cdafec
f267501b0cd9862743e760e2c0686968019a68bf1a69843cea19b14c51773440

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Emotet-6947486-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyEnable`	40
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyServer`	40
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyOverride`	40
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoConfigURL`	40
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoDetect`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\sourcebulk`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: Type`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: Start`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: ErrorControl`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: ImagePath`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: DisplayName`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: WOW64`	40
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK Value Name: ObjectName`	40
`<HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon`	39
`<HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders`	39
`<HKLM>\SOFTWARE\Microsoft\ESENT\Process\guiddefribbon\DEBUG`	39
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}\9c-aa-fb-e9-56-c8`	2

Mutexes	Occurrences
`Global\I98B68E3C`	40
`Global\M98B68E3C`	40
`\BaseNamedObjects\Global\M3C28B0E4`	39
`\BaseNamedObjects\Global\I3C28B0E4`	39
`Global\Nx534F51BC`	2

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`152[.]168[.]82[.]167`	16
`189[.]166[.]20[.]113`	16
`103[.]11[.]83[.]52`	16
`197[.]91[.]152[.]93`	15
`77[.]82[.]85[.]35`	11
`66[.]228[.]45[.]129`	10
`216[.]98[.]148[.]156`	10
`177[.]231[.]157[.]189`	6
`65[.]49[.]60[.]163`	4
`201[.]248[.]5[.]197`	4
`82[.]0[.]19[.]40`	4
`165[.]255[.]52[.]192`	4
`31[.]172[.]86[.]183`	3
`45[.]33[.]35[.]103`	3
`181[.]37[.]126[.]2`	3
`239[.]255[.]255[.]250`	2
`209[.]85[.]144[.]109`	2
`74[.]6[.]141[.]43`	2
`81[.]169[.]145[.]103`	2
`104[.]236[.]185[.]25`	2
`181[.]30[.]126[.]66`	2
`179[.]62[.]249[.]189`	2
`204[.]232[.]250[.]252`	1
`81[.]19[.]78[.]83`	1
`216[.]128[.]11[.]5`	1
See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`smtpout[.]secureserver[.]net`	2
`imap[.]strato[.]de`	2
`SMTP[.]AMAZON[.]COM`	1
`mail[.]strato[.]de`	1
`mail[.]gmx[.]a`	1
`MAIL[.]CLOVER[.]COM`	1
`mail[.]hotmail[.]de`	1
`mail[.]fsfsc[.]org`	1
`mail[.]pearl[.]ch`	1
`mail[.]hub[.]afsinc[.]org`	1
`smtp[.]gatehousesupplies[.]com`	1
`smtp[.]bonuscard[.]ch`	1
`smtp[.]cranespotters[.]com`	1
`mail[.]securemail[.]us[.]cibc[.]com`	1
`smtp[.]employmentsolutionsinc[.]org`	1
`mail[.]tecnoparaguay[.]com[.]py`	1
`www[.]chetgreen[.]com`	1
`smtp[.]account[.]zopim[.]com`	1
`smtp[.]prodxbm[.]co`	1
`smtp[.]creditkarma[.]com`	1
`smtp[.]my[.]yotpo[.]com`	1
`SMTP[.]PERX[.]COM`	1
`smtp[.]bobjohnson[.]com`	1
`smtp[.]facturacioncapufe[.]com[.]mx`	1
`smtp[.]app[.]intercom[.]io`	1
See JSON for more IOCs

Files and or directories created	Occurrences
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat`	40
`%System32%\guiddefribbon.exe (copy)`	3
`%SystemRoot%\SysWOW64\UtHbYIvdhlNvu.exe`	1
`%SystemRoot%\SysWOW64\R597iayBjMdh.exe`	1
`%SystemRoot%\SysWOW64\C7eHkb20PeU6wpDtjp.exe`	1
`%SystemRoot%\SysWOW64\1MEitC9prK.exe`	1
`%SystemRoot%\SysWOW64\kmnu.exe`	1
`%SystemRoot%\SysWOW64\4I7gXzdy4.exe`	1
`%SystemRoot%\SysWOW64\5x2P.exe`	1
`%System32%\HwVezokkuv.exe`	1
`%SystemRoot%\SysWOW64\ISUH5rlS.exe`	1
`%SystemRoot%\SysWOW64\xFkV4xOuG.exe`	1
`%SystemRoot%\SysWOW64\7tooAA2H.exe`	1
`%SystemRoot%\SysWOW64\dqhwpEfDiqdYk3.exe`	1
`%SystemRoot%\SysWOW64\98SvoQAlyGHCi.exe`	1
`%SystemRoot%\SysWOW64\Y9t7.exe`	1
`%SystemRoot%\SysWOW64\OEkk.exe`	1
`%SystemRoot%\SysWOW64\QEeaZTtWugEn.exe`	1
`%SystemRoot%\SysWOW64\faEA7KV70hn5.exe`	1
`%System32%\hLikoqY.exe`	1
`%SystemRoot%\SysWOW64\oURffFdtgFONll.exe`	1
`%SystemRoot%\SysWOW64\b1zR.exe`	1
`%SystemRoot%\SysWOW64\bEjEWEYxmjgCJVecQcp.exe`	1
`%SystemRoot%\SysWOW64\yVYv57xuqKB.exe`	1
`%SystemRoot%\SysWOW64\oglx98jdm6.exe`	1
See JSON for more IOCs

File Hashes

0106fad7a1ceb64a7d2ebed424ce86d979ac976cb352326c0fca9c7d0ac5330f
0123e3c82d1b40e5b1ec1cb62a30317cb209371dc8fe546f10b96c6113e37229
0911c843ef0b50a6b7359384d774350c43ea81970e47b6390782a3b59619df23
0b5980e79cb0b4565db500cdb5b15970624aa8f3fce0bc14a13a097fc9c098ca
0fe4721f05bcae958a1e294f92832144acd17791a850507bd98572347968eb6e
14e5b08440e75c48bd1ff1486c8b36f32fb0cd4d21dbc138861a0b9af90aba7f
1cd3db53176d88f4b7244429ef03ee120373c066335a8a5b81f94e2597188636
1cda16c8d2e935d3ed762d5c7d18c945ebcfc183898ac5b87846dca084e043cf
1ec9145cc88f7e619398955d6377ea4a6aa2f5fc8d53b87a467468d284352d61
22d4075bf5828ede0c20dbea9023775ebbffb6e867272945a6a69697ea015c8c
2430252f3c13ab866847db4905ff53380375d818085358a6f2d158f5ca6f9847
25806bac5ca5b7b3dc6f1cdcbc4d72ade84828ae4173a858c3e9fe028d51b7e9
270696e681aae3f24c7a3886f75952fd82c2bc94374c7fa1e72c5ae1583efcc0
2d979f92140e9b7ad385cfe47c59e960ef5df19bff9388313908a14464bc0064
3286340a92b48cf2a64c066f4cec1b078d9c23df987dd9aa07f249fffc5a9cbf
377ca271dd3000fe310674488c93822601be7434325661f4158e8e64e83ab247
3e77f7b1c2a160ebd1f6bda9235c9ae43f057cba38f6ef77f50df7dd1bd6d229
448d67c96c008988d24046abb6a7e736db585c79b83c1e831023649133d83dad
45ee3965183c5fecff0268fa7480aad3f4b0364b3e63fbc4259a1669f1cc48f8
478968aeea42221e0c760a811af1560eeaa6489b77cdf69b4ae3763c59e60be0
48900a85a1a4afcf216ea9912176bb20edab059d1bb27d02caa6fbbcc060d35e
4937ac330845c1504e65a3655050ffa5a8cfc3602298ecef627ca8d4114631fe
5ca10a11eb88b1c5e38e0359419fe8d39a321571e89268a578d2a0e272004caf
61ffe36301e722b85088cfceb5d5a703e57eff907119ef305dc92da45c254aaf
65eb33dbb0f1a4e78ffdcc5dbed725ac929c7c917923544af329226ddecf0f14
See JSON for more IOCs

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Mikey-6953803-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\Software\Wow6432Node\Microsoft\Tracing\RASAPI32`	15
`<HKLM>\Software\Wow6432Node\Microsoft\Tracing\RASMANCS`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: EnableFileTracing`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: EnableConsoleTracing`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: FileTracingMask`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: ConsoleTracingMask`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: MaxFileSize`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32 Value Name: FileDirectory`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: EnableFileTracing`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: EnableConsoleTracing`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: FileTracingMask`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: ConsoleTracingMask`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: MaxFileSize`	15
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS Value Name: FileDirectory`	15
`<HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel`	2

Mutexes	Occurrences
`DSKQUOTA_SIDCACHE_MUTEX`	14
`.NET CLR Data_Perf_Library_Lock_PID_378`	6
`.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_378`	6
`.NET CLR Networking_Perf_Library_Lock_PID_378`	6
`.NET Data Provider for Oracle_Perf_Library_Lock_PID_378`	6
`.NET Data Provider for SqlServer_Perf_Library_Lock_PID_378`	6
`.NET Memory Cache 4.0_Perf_Library_Lock_PID_378`	6
`.NETFramework_Perf_Library_Lock_PID_378`	6
`ASP.NET_1.1.4322_Perf_Library_Lock_PID_378`	6
`ASP.NET_4.0.30319_Perf_Library_Lock_PID_378`	6
`ASP.NET_Perf_Library_Lock_PID_378`	6
`BITS_Perf_Library_Lock_PID_378`	6
`ESENT_Perf_Library_Lock_PID_378`	6
`Lsa_Perf_Library_Lock_PID_378`	6
`MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_378`	6
`MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_378`	6
`MSDTC_Perf_Library_Lock_PID_378`	6
`Outlook_Perf_Library_Lock_PID_378`	6
`PerfDisk_Perf_Library_Lock_PID_378`	6
`PerfNet_Perf_Library_Lock_PID_378`	6
`PerfOS_Perf_Library_Lock_PID_378`	6
`PerfProc_Perf_Library_Lock_PID_378`	6
`RemoteAccess_Perf_Library_Lock_PID_378`	6
`SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_378`	6
`SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_378`	6
See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`64[.]188[.]12[.]182`	3
`185[.]212[.]130[.]14`	2
`185[.]212[.]129[.]184`	2
`46[.]249[.]59[.]122`	2
`185[.]225[.]69[.]101`	2
`52[.]36[.]131[.]229`	1
`54[.]248[.]125[.]247`	1
`104[.]18[.]39[.]18`	1
`103[.]11[.]102[.]48`	1
`104[.]28[.]16[.]149`	1
`202[.]181[.]185[.]162`	1
`43[.]241[.]73[.]221`	1
`202[.]181[.]196[.]26`	1
`202[.]155[.]223[.]18`	1
`103[.]13[.]50[.]180`	1
`54[.]183[.]102[.]22`	1
`116[.]251[.]204[.]136`	1
`206[.]218[.]248[.]173`	1
`203[.]185[.]61[.]196`	1
`101[.]78[.]151[.]172`	1
`192[.]185[.]5[.]69`	1
`103[.]13[.]50[.]28`	1
`115[.]160[.]155[.]94`	1
`118[.]143[.]28[.]56`	1
`103[.]13[.]50[.]62`	1
See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`gangbulk[.]icu`	2
`striblingm[.]pw`	2
`SHOP[.]HPINH[.]HK`	1
`ajqqn[.]hk`	1
`SHOP[.]HPC[.]HK`	1
`SHOP[.]HYHEB[.]HK`	1
`ALODRINK[.]HK`	1
`SHOP[.]ICAN[.]HK`	1
`ALIVECOR[.]HK`	1
`SHOP[.]IAN[.]COM[.]HK`	1
`shop[.]imylv[.]hk`	1
`shop[.]ina[.]hk`	1
`SHOP[.]HY[.]COM[.]HK`	1
`SHOP[.]ICXLB[.]HK`	1
`SHOP[.]HOTFROG[.]HK`	1
`SHOP[.]HYY[.]COM[.]HK`	1
`shop[.]icfp[.]hk`	1
`SHOP[.]HYPOXI[.]HK`	1
`shop[.]htv[.]hk`	1
`AIR[.]HK`	1
`SHOP[.]IHK[.]HK`	1
`shop[.]imore[.]hk`	1
`SHOP[.]HUGOMAX[.]HK`	1
`shop[.]hps[.]com[.]hk`	1
`shop[.]hoops[.]hk`	1
See JSON for more IOCs

Files and or directories created	Occurrences
`%APPDATA%\Mozilla\Firefox\Profiles\1lcuq8ab.default\cookies.sqlite.bak`	10
`%APPDATA%\Mozilla\Firefox\Profiles\1lcuq8ab.default\places.sqlite.bak`	10
`\??\scsi#disk&ven_red_hat&prod_virtio#4&2556063a&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}`	1
`%TEMP%\tmpA4A.tmp`	1
`%TEMP%\tmp2BCD.tmp`	1
`%TEMP%\4a5beb4e303c4a1a9bcd3624dfec7cbe.exe`	1
`%TEMP%\tmp4167.tmp`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe`	1
`%TEMP%\4a5beb4e303c4a1a9bcd3624dfec7cbe.exe.pid`	1
`%TEMP%\s.bat`	1
`%TEMP%\tmpCAF3.tmp`	1
`%TEMP%\tmpB734.tmp`	1
`%TEMP%\tmpB63A.tmp`	1
`%TEMP%\tmp77F3.tmp`	1
`%TEMP%\tmp742C.tmp`	1
`%TEMP%\tmp6695.tmp`	1
`%TEMP%\tmp717E.tmp`	1

File Hashes

0ee1dc48bdc775152554357cbb9190834a58a5ccbc01e27d20f2cf0064211206
0ffa3428f95f2a5c79a169976d3c5d58fa885cc05265c41fa4dcf4e33be17a12
1ee4c1201f038a48a854fd993455142b15acbf44b41a8820af4790f17c31fba5
45945d97bf9f1cb63b1b7a74629bb90567933a981d2cc77f4dc46018c6f8c169
471f646bc59743f27f1bb08ef688a699c3ff268eeab403cea8ec7467f303c2f3
4725b43862585b4e78f06ef7209a32434dcfe809986a19cb9b89bcb673a6a555
49065e33bbdf2b25f4cdd1a8994df53135a9b41b725bd94958682325fb8c237a
58fb3bc46e231b9ad07f5f8210a2acf1d225c25e287eee73553ae280ac9e89d9
6f79069e751211f3077e90bd4e20c7116f8c3c9c41fa1ce7eacbd7710fdecf0e
96667406cc9e8bb5e9da9e418a4b4196900364cc100d965b5d2714c62eb5e402
9ac94b8404ee4300330c56257c66f77662904a2dc7f732125f36365c4a788129
9e87a651befb171f0145718bc52d4d8b1a40f420cbb8d66d3e8b60e4377fa8c7
be140dfc59df6e21eb3b799cfe6511b9b8c5d010be0079b5f64a2b1dc3ab4fcb
f1e262b02e2b357f56225184539e2a3c35623b15397a85f343a368c5999dbd5d
f7f5d6e71a69332960e2025790db65c9bd29037157930a599c28969645bec5c9

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Exprev Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

Madshi injection detected (3400)
Madshi is a code injection framework that uses process injection to start a new thread if other methods to start a thread within a process fail. This framework is used by a number of security solutions. It is also possible for malware to use this technique.
Kovter injection detected (2256)
A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.
PowerShell file-less infection detected (1079)
A PowerShell command was stored in an environment variable and run. The environment variable is commonly set by a previously run script and is used as a means of evasion. This behavior is a known tactic of the Kovter and Poweliks malware families.
Process hollowing detected (503)
Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.
Gamarue malware detected (190)
Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.
Atom Bombing code injection technique detected (107)
A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.
Suspicious PowerShell execution detected (100)
A PowerShell command has attempted to bypass execution policy to run unsigned or untrusted script content. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.
Dealply adware detected (87)
DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.
Excessively long PowerShell command detected (85)
A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.
Trickbot malware detected (75)
Trickbot is a banking Trojan which appeared in late 2016. Due to the similarities between Trickbot and Dyre, it is suspected some of the individuals responsible for Dyre are now responsible for Trickbot. Trickbot has been rapidly evolving over the months since it has appeared. However, Trickbot is still missing some of the capabilities Dyre possessed. Its current modules include DLL injection, system information gathering, and email searching.

Threat Roundup for April 19 to April 26

Threats

Win.Malware.Gandcrab-6954107-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Malware.Kovter-6953553-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Packed.Scar-6952917-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Dropper.Lydra-6952708-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Trojan.Zeroaccess-6952579-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Doc.Downloader.Powload-6952235-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Ransomware.Cerber-6952131-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Packed.Tofsee-6952124-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Malware.Emotet-6947486-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Malware.Mikey-6953803-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Share this post

Related Content

Threat Roundup for November 3 to November 10

Threat Roundup for October 27 to November 3

Threat Roundup for October 13 to October 20

Intelligence Center

Vulnerability Research

Incident Response

Security Resources

Media

Support

Company