Ransomwarecritical
Threat Source newsletter (Feb. 16, 2023) — Recapping what we may have missed so far this year
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-21715 | Actively Exploited Security Feature Bypass in Microsoft Office Publisher | 7.3 | 12% | KEV | KEV |
CVE-2023-23376+1 related CVE | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 11% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 147c7241371d840787f388e202f4fdc1 | db0d45de00cc4f3cf49af7c2d6b5b15ca456d13703b5d366c58431 MD5: 147c7241371d840787f388e202f4fdc1 Typical Filename: EKSPLORASI.EXE Claimed Product: N/A Detec |
| md5 | 2c8ea737a232fd03ab80db672d50a17a | 5689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 MD5: 2c8ea737a232fd03ab80db672d50a17a Typical Filename: LwssPlayer.scr Claimed Product: 梦想之巅幻灯播放器 |
| md5 | 93fefc3e88ffb78abb36365fa5cf857c | 81591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wextract Claimed Product: Internet Explor |
| md5 | a087b2e6ec57b08c0d0750c60f96a74c | e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAct.exe Claimed Product: N/A Detection N |
| md5 | df11b3105df8d7c70e7b501e210e3cc3 | de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa MD5: df11b3105df8d7c70e7b501e210e3cc3 Typical Filename: DOC001.exe Claimed Product: N/A Detection |
| sha256 | 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 | Product: N/A Detection Name: Win32.Generic.497796 SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 MD5: 2c8ea737a232fd03ab80db672d50a17a Typical Filename: Lws |
| sha256 | 36efad0617db0d45de00cc4f3cf49af7c2d6b5b15ca456d13703b5d366c58431 | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: 36efad0617db0d45de00cc4f3cf49af7c2d6b5b15ca456d13703b5d366c58431 MD5: 147c7241371d840787f388e202f4fdc1 Typical Filename: EKS |
| sha256 | 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa | ct: N/A Detection Name: PUA.Win.Tool.Kmsauto::1201 SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa MD5: df11b3105df8d7c70e7b501e210e3cc3 Typical Filename: DOC |
| sha256 | e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c | ion Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAc |
| sha256 | e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 | ware files from Talos telemetry over the past week SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 MD5: 93fefc3e88ffb78abb36365fa5cf857c Typical Filename: Wex |
From the original article
5 min read at blog.talosintelligence.com
Welcome to this week’s edition of the Threat Source newsletter. I am back after more than three months away from Talos on parental leave. Having a baby really resets your expectations for “keeping up” with the world.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.