Ransomwarehigh
Talos IR ransomware engagements and the significance of timeliness in incident response
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-57727 | Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier | 7.5 | 97% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.21.44.57 | licious reputation and signs of potential data exfiltration 104.21.44[.]57’ IP for malicious domain civicoscolombia [.]com Medusa Fi |
| ipv4 | 144.172.103.42 | plashtop Domain, URI Path, or IP Address Status/Description 144.172.103[.]42 Adversary controlled IP address used to establish a rever |
| ipv4 | 45.61.134.36 | IP address used to establish a reverse proxy SSH connection 45.61.134[.]36 Adversary controlled IP address used to establish a rever |
| md5 | 27a094d718378410d2002ae3023d3731 | \msiexec.exe /V, C:\Windows\syswow64\MsiExec.exe -Embedding 27A094D718378410D2002AE3023D3731 E Global\MSI0000 Analysis Talos IR assesses that victim res |
| sha256 | 03a613c62ae7470e70e0197ea5133625308dc2ac2c5574608d2b6e20c8f94015 | nt zero” was socially engineered into running splashtop.exe 03a613c62ae7470e70e0197ea5133625308dc2ac2c5574608d2b6e20c8f94015 Splashtop splashtop_sos.exe 61f281c24846d311031521d13c933c4 |
| sha256 | 05016485b683ef6d40bfd805702924909197ee2483a66ffc8a22dc03e4891045 | 6df611bf89ac4df2e D ata exfiltration tool screenconnect.exe 05016485b683ef6d40bfd805702924909197ee2483a66ffc8a22dc03e4891045 Unknown executable placed on host ‘PKIWEBSVR ’. syncro.inst |
| sha256 | 10a87144386b2869d1bbc40e50f6960d4eb4316d1fd1c1df8708361a7b837b98 | bee4 OptiTune RMM Bravura Script Host tool otpowershell.exe 10a87144386b2869d1bbc40e50f6960d4eb4316d1fd1c1df8708361a7b837b98 OptiTune PowerShell tool remoteservice.exe 4b6ff966ec6509e8 |
| sha256 | 11e7f8b671ed39497c8561b0ecd13496080681c21a457d6079817a90de553bf1 | 56 Status/Description windowslauncher.exe remote access.exe 11e7f8b671ed39497c8561b0ecd13496080681c21a457d6079817a90de553bf1’ SimpleHelp Remote Access Client storm.exe ee6d24410a8cf31d |
| sha256 | 1837087e75de428c18acec7f2ef7576752396a3a1ef15450230734e9ee194b28 | d3ead5f824242bb841d53c8e Syncro RMM installer setuputil.exe 1837087e75de428c18acec7f2ef7576752396a3a1ef15450230734e9ee194b28 Splashtop Streamer installer any desk .exe 6ccea6a959128112 |
| sha256 | 19ab3c8645d6806ae8a1dad707a86aba344a48d1612aeb5aa145f96ac0e24a03 | (IOCs) Chaos Filename SHA256 Status/Description Wavesor.exe 19ab3c8645d6806ae8a1dad707a86aba344a48d1612aeb5aa145f96ac0e24a03 Malware that can be used to capture critical info rmation w |
| sha256 | 1e43e202a6e5d3059c3901a63fd69b32a7c0719c9f4c4f592a71c85e08e5d188 | 78e Microsoft Sysinternals PsExec Remote AccessLauncher.exe 1e43e202a6e5d3059c3901a63fd69b32a7c0719c9f4c4f592a71c85e08e5d188 SimpleHelp Remote Access… |
| sha256 | 1ede8d91db625a605535488d1c36a5ea7ba3950194cabe7664ffa7ed6a9aab45 | OptiTune RMM used to deploy ScreenConnect supportcenter.exe 1ede8d91db625a605535488d1c36a5ea7ba3950194cabe7664ffa7ed6a9aab45 OptiTune RMM bvscript.exe 9d2fe8a4a229ed2990e33a0330a00c03a |
| sha256 | 4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5 | 90477 OptiTune Real Time Agent tool advanced_ip_scanner.exe 4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5 IP scanner used for discovery goodsync.exe 8127614d1906befc |
| sha256 | 4b6ff966ec6509e86c4a1cbf71d71bf434e08e0aae097a57015ad493db4a3912 | 8708361a7b837b98 OptiTune PowerShell tool remoteservice.exe 4b6ff966ec6509e86c4a1cbf71d71bf434e08e0aae097a57015ad493db4a3912 OptiTune Remote Service tool realtimeagent.exe 6a3072a23673 |
| sha256 | 5540f27f12db5a9e954727079665a282f905a0be787b76d798ca79a318d197f5 | at can be used to capture critical info rmation wininit.exe 5540f27f12db5a9e954727079665a282f905a0be787b76d798ca79a318d197f5 Renamed version of rclone Advanced_IP_Scanner_2.5.4594.1.ex |
| sha256 | 61f281c24846d311031521d13c933c42b33c7283d425456f00cf0ef3ffb04863 | 08dc2ac2c5574608d2b6e20c8f94015 Splashtop splashtop_sos.exe 61f281c24846d311031521d13c933c42b33c7283d425456f00cf0ef3ffb04863 Splashtop Domain, URI Path, or IP Address Status/Descriptio |
| sha256 | 6a3072a2367329b564c9bf77302a5fbf66673fb471c22fc56a12e901c4d90477 | d493db4a3912 OptiTune Remote Service tool realtimeagent.exe 6a3072a2367329b564c9bf77302a5fbf66673fb471c22fc56a12e901c4d90477 OptiTune Real Time Agent tool advanced_ip_scanner.exe 4b036 |
| sha256 | 6ccea6a959128112613d7a82c067f8ccc78f05f1f8f47348fc9fecf269f0f21a | 230734e9ee194b28 Splashtop Streamer installer any desk .exe 6ccea6a959128112613d7a82c067f8ccc78f05f1f8f47348fc9fecf269f0f21a Malicious use of Any Desk QuickAssist.exe ms -quick-assist |
| sha256 | 8127614d1906befc82ebc75fc0992e7dbad64ed2233fe316df611bf89ac4df2e | 46748bd2496bd3e5 IP scanner used for discovery goodsync.exe 8127614d1906befc82ebc75fc0992e7dbad64ed2233fe316df611bf89ac4df2e D ata exfiltration tool screenconnect.exe 05016485b683ef6d4 |
| sha256 | 845f4d73a0d96898535593c411d924d8c8c3af1dd3ead5f824242bb841d53c8e | xecutable placed on host ‘PKIWEBSVR ’. syncro.installer.exe 845f4d73a0d96898535593c411d924d8c8c3af1dd3ead5f824242bb841d53c8e Syncro RMM installer setuputil.exe 1837087e75de428c18acec7f |
| sha256 | 87b3e3462263d7d42dea2bac6c3144181bab22092276f527a94a33af473066d5 | 3c083c593c193 IP scanner used for discovery screensaver.exe 87b3e3462263d7d42dea2bac6c3144181bab22092276f527a94a33af473066d5 ScreenConnect otservice.exe b5c63f895d27d0572289cb49058ea83 |
| sha256 | 8f67faad634acf0f2971caf8b7ac96e8f05de795b74feec8b82ea168b7be820b | Malicious use of Any Desk QuickAssist.exe ms -quick-assist 8f67faad634acf0f2971caf8b7ac96e8f05de795b74feec8b82ea168b7be820b Executable that “patient zero” was socially engineered into |
| sha256 | 9d2fe8a4a229ed2990e33a0330a00c03a415435c3cabd9a42dd882673522bee4 | a7ba3950194cabe7664ffa7ed6a9aab45 OptiTune RMM bvscript.exe 9d2fe8a4a229ed2990e33a0330a00c03a415435c3cabd9a42dd882673522bee4 OptiTune RMM Bravura Script Host tool otpowershell.exe 10a8 |
| sha256 | b5c63f895d27d0572289cb49058ea83b1e49c46a62ca51b4ab44d119111594a4 | bab22092276f527a94a33af473066d5 ScreenConnect otservice.exe b5c63f895d27d0572289cb49058ea83b1e49c46a62ca51b4ab44d119111594a4 OptiTune RMM used to deploy ScreenConnect supportcenter.exe |
| sha256 | cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e | 0f607b1dc0be3 SimpleHelp Remote Access Client psexecsvc.exe cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e Microsoft Sysinternals PsExec Remote AccessLauncher.exe 1e4 |
| sha256 | ee6d24410a8cf31d672d2a47466b76ad287c7ba016d3711490f0f607b1dc0be3 | 79817a90de553bf1’ SimpleHelp Remote Access Client storm.exe ee6d24410a8cf31d672d2a47466b76ad287c7ba016d3711490f0f607b1dc0be3 SimpleHelp Remote Access Client psexecsvc.exe cc14df781475e |
From the original article
11 min read at blog.talosintelligence.com
Talos IR ransomware engagements and the significance of timeliness in incident response Cisco Talos routinely responds to ransomware engagements where the impact could have been mitigated or wholly prevented if the victim organization had initiated remediation efforts earlier in the attack lifecycle.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.