Cisco Talospublished Apr 14, 20:58 UTC (Apr 14, 2017)ingested Sep 10, 06:19 UTC

Threat Round-up for Apr 7

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,401 words · extracted from blog.talosintelligence.com · click to collapse

Friday, April 14, 2017 16:58

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 7 and April 14. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

Java.Trojan.Adwind-6260775-0
Remote Access Trojan
Also named AlienSpy, Frutas, JRat… Adwind is a java based Remote Access Trojan that is usually distributed by email. Given it is Java based, it is portable across different operating systems and even mobile devices. It allows to capture keystrokes, record video and audio, steal cached password and stored data, etc...
Win.Trojan.VBSinkDropper
Dropper
This sample is written in Visual Basic and its main goal is to drop and execute a second stage payload. The domains are related to the Zeus trojan, indicating this is probably a Zeus variant. The sample is heavily obfuscated and has anti-debugging and anti-VM techniques to hinder the analysis and performs code injection in other processes address spaces. This sample is currently delivered in massive spam campaigns as an attachment.
Win.Trojan.AutoIt-6260345-0
Trojan-Dropper
The initial binary contains an AutoIt script. The script is obfuscated. It creates several in-memory DLL structures with AutoIt’s DllStructCreate and DllStructSetData. The script then executes the shell code injected into these DLL structures.
Win.Ransomware.Cerber-6267996-1
Ransomware family
Cerber is a popular ransomware family that continues to undergo active development to continue being dropped in the wild. It still drops multiple ransom notes, including a desktop wallpaper as a warning post.
Win.Virus.Hematite-6232506-0
File Infector
Hematite is a simple but effective virus that spreads through executables. It scans the victim’s machine for any files with the extension .exe. Hematite appends 3000 bytes of malicious shellcode to the end of each file, then modifies the entrypoint of the original executable to load and execute the shellcode.
Doc.Dropper.Agent-6249585-0
Office VBA/PowerShell downloader/dropper
This sample is a Microsoft Word document that uses a macro to launch a PowerShell script to download and execute a secondary payload.
Win.Virus.Sality-6193004-1
Windows file infector
Sality is a file infector that establishes a peer-to-peer botnet. Although it’s been prevalent for over a decade, we continue to see new samples that require marginal attention in order to remain consistent with detection. Once perimeter security has been bypassed by a Sality client, the end goal is to execute a downloader component capable of executing additional malware.
Doc.Dropper.Dridex-6260340-0
Office Macro-based Downloader
Dridex documents leverage Microsoft Office to deliver a malware payload. They have been used often with banking trojans and ransomware such as CryptXXX and Locky. This week Doc.Dropper.Dridex-6260340-0 has been delivering Cerber as redchip2.exe.
Doc.Macro.CmdC-6249572-0
Office Macro Obfuscation Heuristic
Office macro code is used to further compromise a target system. This heuristics focuses on macro techniques to obfuscate shell commands that will be executed to further compromise the system.
Js.File.MaliciousHeuristic-6260279-2
JavaScript Obfuscation Heuristic
To make javascript harder to signature on, detect or to manually analyze; obfuscation is applied by breaking up functionality into small function.

Threats

Java.Trojan.Adwind-6260775-0

Indicators of Compromise Registry Keys

MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[application name].exe
Value: MAXIMUM ALLOWED
USER\[uuid]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: [a-zA-Z]+
Data: "C:\Users\[user]\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\[user]\[a-zA-Z]+\[a-zA-Z]+.[a-zA-Z]+"
USER\[uuid]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ASSOCIATIONS
Value: LowRiskFileTypes
Data: .avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;
MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE
Value: DisableConfig
Data: 1
MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value: EnableLUA
Data: 0 Mutexes
N/A IP Addresses
174.127.99[.]134:2888 Domain Names
N/A Files and or directories created
\Users\[user]\AppData\Local\Temp\Retrive[0-9]+.vbs Others
Kills AV solutions / security tools
taskkill.exe taskkill /IM K7AVScan.exe /T /F
taskkill.exe taskkill /IM V3Proxy.exe /T /F
taskkill.exe taskkill /IM mbam.exe /T /F
taskkill.exe taskkill /IM text2pcap.exe /T /F
taskkill.exe taskkill /IM FPWin.exe /T /F
taskkill.exe taskkill /IM FSM32.EXE /T /F
taskkill.exe taskkill /IM cmdagent.exe /T /F
taskkill.exe taskkill /IM ClamWin.exe /T /F
taskkill.exe taskkill /IM MpCmdRun.exe /T /F
taskkill.exe taskkill /IM V3Svc.exe /T /F
taskkill.exe taskkill /IM GdBgInx64.exe /T /F
taskkill.exe taskkill /IM freshclamwrap.exe /T /F
taskkill.exe taskkill /IM rawshark.exe /T /F
taskkill.exe taskkill /IM MsMpEng.exe /T /F
taskkill.exe taskkill /IM PSANHost.exe /T /F
taskkill.exe taskkill /IM NisSrv.exe /T /F
taskkill.exe taskkill /IM BullGuardUpdate.exe /T /F
taskkill.exe taskkill /IM procexp.exe /T /F
taskkill.exe taskkill /IM nfservice.exe /T /F
taskkill.exe taskkill /IM VIEWTCP.EXE /T /F
taskkill.exe taskkill /IM K7TSecurity.exe /T /F
taskkill.exe taskkill /IM UserAccountControlSettings.exe /T /F
taskkill.exe taskkill /IM QUHLPSVC.EXE /T /F
taskkill.exe taskkill /IM V3Up.exe /T /F
taskkill.exe taskkill /IM CONSCTLX.EXE /T /F
taskkill.exe taskkill /IM K7AVScan.exe /T /F
taskkill.exe taskkill /IM MWASER.EXE /T /F
taskkill.exe taskkill /IM K7CrvSvc.exe /T /F
taskkill.exe taskkill /IM editcap.exe /T /F
taskkill.exe taskkill /IM LittleHook.exe /T /F
taskkill.exe taskkill /IM ProcessHacker.exe /T /F
taskkill.exe taskkill /IM cis.exe /T /F
taskkill.exe taskkill /IM MSASCui.exe /T /F
taskkill.exe taskkill /IM SSUpdate64.exe /T /F
taskkill.exe taskkill /IM mergecap.exe /T /F
taskkill.exe taskkill /IM FSHDLL64.exe /T /F
taskkill.exe taskkill /IM AdAwareTray.exe /T /F
taskkill.exe taskkill /IM guardxkickoff_x64.exe /T /F
taskkill.exe taskkill /IM econceal.exe /T /F
Hides files in the filesystem
attrib.exe attrib +h "C:\Users\[user]\[a-zA-Z]+\*.*"
File Hashes
e084341b5149d62ebd26f311e51725d3e630f5d1c154568b717d79aa0b72c441

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Trojan.VBSinkDropper

Indicators of Compromise
Registry Keys

HKEY_USERS\Software\Microsoft\[a-z]{5}
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache
HKEY_USERS\Software\Microsoft\Visual Basic Mutexes
N/A IP Addresses
191.96.15[.]154
154.66.197[.]59
191.101.243[.]203
108.170.51[.]58 Domain Names
afrirent[.]net
ogb.mmosolicllp[.]sk
norlcangroup[.]com Files and or directories created
C:\Documents and Settings\Administrator\Application Data\Xoabhaul\[a-z]{8}.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\subfolder\[a-z]{3}.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\Purchase Order.doc File Hashes

Please note this is an non-exhaustive list.

00062f3d06aad63d025c8097e0bc024f23ede453751afdae0e1cc5b40f987bf6
0094bcc3a70b00b2b61701a90ac2c15f3d39551adcf18b33cafb6ad8a732825c
029a6ba06418d2cc2ee9e7dbbcca622b206df8a1855fa6e551c6126f07302030
03580fcc6fa4d72a39b876067ae9a7c9b9c62b1a53175df0f54a2a47deee6691

Coverage

Screenshots of Detection
AMP

ThreatGrid

Umbrella