ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Round-up for July 14

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domainatlon-mebel.ruRegistry Keys N/A Mutexes N/A IP Addresses N/A Domain Names atlon-mebel[.]ru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com
domainayurvoyage.comMutexes N/A IP Addresses N/A Domain Names atlon-mebel[.]ru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net s
domainenzyma.esddresses N/A Domain Names atlon-mebel[.]ru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net studio80[.]bi
domainfarmona.codresses 52[.]14[.]80[.]76 52[.]173[.]193[.]166 Domain Names farmona[.]co Files and or directories created %TEMP%\CVR668.tmp.cvr %A
domaininormann.itDomain Names atlon-mebel[.]ru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net studio80[.]biz sxmht[.]com
domainkms2017.comatlon-mebel[.]ru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net studio80[.]biz sxmht[.]com test[.]atlon-m
domainpta-babel.netru ayurvoyage[.]com enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net studio80[.]biz sxmht[.]com test[.]atlon-mebel[.]ru tidytr
domainstudio80.bizcom enzyma[.]es inormann[.]it kms2017[.]com pta-babel[.]net studio80[.]biz sxmht[.]com test[.]atlon-mebel[.]ru tidytrend[.]com wests
domainsxmht.cominormann[.]it kms2017[.]com pta-babel[.]net studio80[.]biz sxmht[.]com test[.]atlon-mebel[.]ru tidytrend[.]com westsussexcentre[
sha25601c4f96c8117df219cf9f50723454ace242edcf2d22b09e8e72c5d0c92aad540ies created %TEMP%\CVR668.tmp.cvr %AppData%.exe File Hashes 01c4f96c8117df219cf9f50723454ace242edcf2d22b09e8e72c5d0c92aad540 01ed6302a7ea8d4c54d439b7016b99b6dca275f85d22611811bac8c1353
sha25601ed6302a7ea8d4c54d439b7016b99b6dca275f85d22611811bac8c135309d4196c8117df219cf9f50723454ace242edcf2d22b09e8e72c5d0c92aad540 01ed6302a7ea8d4c54d439b7016b99b6dca275f85d22611811bac8c135309d41 0634216b34baf0fdc293002632932312293fc4854701b143c6f4735e8cd
sha256026b944764ec5f0f342b2f532e18093627930a1c9810d235a4893ecbbbe4eaee%\~DFFD1107AB284DD884.TMP %TEMP%\serenade8.TEMP File Hashes 026b944764ec5f0f342b2f532e18093627930a1c9810d235a4893ecbbbe4eaee 04f5160bf3126ad52a819a86cf4807dc83c89a4e5a2643b49b3fe60bf01
sha25604f5160bf3126ad52a819a86cf4807dc83c89a4e5a2643b49b3fe60bf01c841944764ec5f0f342b2f532e18093627930a1c9810d235a4893ecbbbe4eaee 04f5160bf3126ad52a819a86cf4807dc83c89a4e5a2643b49b3fe60bf01c8419 09a43a41f182b0677d28b7e9cc685d1217f5c1fca63af4418f0a9ef776f
sha2560634216b34baf0fdc293002632932312293fc4854701b143c6f4735e8cd98b45302a7ea8d4c54d439b7016b99b6dca275f85d22611811bac8c135309d41 0634216b34baf0fdc293002632932312293fc4854701b143c6f4735e8cd98b45 070e56e7170fc63c1c42c3b0b37df5a25f5c7e2e0a5fd454e8e8e63de2b
sha256070e56e7170fc63c1c42c3b0b37df5a25f5c7e2e0a5fd454e8e8e63de2b71bdf16b34baf0fdc293002632932312293fc4854701b143c6f4735e8cd98b45 070e56e7170fc63c1c42c3b0b37df5a25f5c7e2e0a5fd454e8e8e63de2b71bdf 07aa3365d733098e11e91ece1628130217414488d3fce0e2e261bfb29ab
sha25607aa3365d733098e11e91ece1628130217414488d3fce0e2e261bfb29ab6fed96e7170fc63c1c42c3b0b37df5a25f5c7e2e0a5fd454e8e8e63de2b71bdf 07aa3365d733098e11e91ece1628130217414488d3fce0e2e261bfb29ab6fed9 0be6e5bb277cbe815beced059aa5fb5160954dc8fd3fef918746caf276c
sha25609a43a41f182b0677d28b7e9cc685d1217f5c1fca63af4418f0a9ef776f6dd0a60bf3126ad52a819a86cf4807dc83c89a4e5a2643b49b3fe60bf01c8419 09a43a41f182b0677d28b7e9cc685d1217f5c1fca63af4418f0a9ef776f6dd0a 0a0bf44d664575b194063536138d0b5ea9d3583e956e675462b55decf4a
sha2560a0bf44d664575b194063536138d0b5ea9d3583e956e675462b55decf4ad73a9a41f182b0677d28b7e9cc685d1217f5c1fca63af4418f0a9ef776f6dd0a 0a0bf44d664575b194063536138d0b5ea9d3583e956e675462b55decf4ad73a9 0ea9107334209b304b650ff86854862d4eed68e616aec015618853b1d6a
sha2560be6e5bb277cbe815beced059aa5fb5160954dc8fd3fef918746caf276cc82a3365d733098e11e91ece1628130217414488d3fce0e2e261bfb29ab6fed9 0be6e5bb277cbe815beced059aa5fb5160954dc8fd3fef918746caf276cc82a3 0fc8af1a3deb4d2895b9bb202278299369a16950239288577472bc06fbf
sha2560c27abc4b32cd84d8ed11907d8b47e0caa41af884efbe599e287978ad56cc6d481952c3d07a6f2dd740e6253a6160a37ec3d80d376f742b2f1c9e9fa3a5 0c27abc4b32cd84d8ed11907d8b47e0caa41af884efbe599e287978ad56cc6d4 56fc60eff1ce21bc0662abce0ce74834e530b4baf297f055bdfdc5bb77c
sha2560dd337e3bef51dd39867317b47870076c8bda3efede772fc571b48d59ff79bcf31b22f6b0df892e363d429a666b5a4bb9303a97b30c527fb4f43379a462 0dd337e3bef51dd39867317b47870076c8bda3efede772fc571b48d59ff79bcf ec0aba7dec0510afc007260370f08f166f6aeadbf0e38206aef3b2df96c
sha2560ea9107334209b304b650ff86854862d4eed68e616aec015618853b1d6a3c00144d664575b194063536138d0b5ea9d3583e956e675462b55decf4ad73a9 0ea9107334209b304b650ff86854862d4eed68e616aec015618853b1d6a3c001 1c32493b72d3c3da9b7d4b9022edfdec445a7feaa261e621799c1e45241
sha2560fc8af1a3deb4d2895b9bb202278299369a16950239288577472bc06fbf07e4b5bb277cbe815beced059aa5fb5160954dc8fd3fef918746caf276cc82a3 0fc8af1a3deb4d2895b9bb202278299369a16950239288577472bc06fbf07e4b 13fd575d1474ae579f55615733f75fa50231447b8653e6eb58678103ee8
sha2561259e834561574787f5e8c6f0fd7e3af62ce566317275ad6e0484b2d2d02904ed08a221749ca7cd1b9526ae4c434457199ac3226236f9e57fdb01b21213 1259e834561574787f5e8c6f0fd7e3af62ce566317275ad6e0484b2d2d02904e 341b86bd427dfca140ef6b3f47c7f269fe3ada974692237cc038f591032
sha25613fd575d1474ae579f55615733f75fa50231447b8653e6eb58678103ee82e99ef1a3deb4d2895b9bb202278299369a16950239288577472bc06fbf07e4b 13fd575d1474ae579f55615733f75fa50231447b8653e6eb58678103ee82e99e 1b01632e1a44445124165ed61592527fe649a32ed889ee75fdb73d07bf3
sha2561b01632e1a44445124165ed61592527fe649a32ed889ee75fdb73d07bf39681275d1474ae579f55615733f75fa50231447b8653e6eb58678103ee82e99e 1b01632e1a44445124165ed61592527fe649a32ed889ee75fdb73d07bf396812 2248f89b848781c0405cc0cead60172ec75e035aca12e8c147818192fde
sha2561c32493b72d3c3da9b7d4b9022edfdec445a7feaa261e621799c1e45241b5b2f07334209b304b650ff86854862d4eed68e616aec015618853b1d6a3c001 1c32493b72d3c3da9b7d4b9022edfdec445a7feaa261e621799c1e45241b5b2f 1dd941235ba3aae55c0f876131d6381ef47c4c37f6be0116b61a5ff0ddf
sha2561dd941235ba3aae55c0f876131d6381ef47c4c37f6be0116b61a5ff0ddf4da6a93b72d3c3da9b7d4b9022edfdec445a7feaa261e621799c1e45241b5b2f 1dd941235ba3aae55c0f876131d6381ef47c4c37f6be0116b61a5ff0ddf4da6a 201a567836576380edc8d7a1b7f2e70c4127faa7ea541da4d7e0457401b
sha256201a567836576380edc8d7a1b7f2e70c4127faa7ea541da4d7e0457401b2b4921235ba3aae55c0f876131d6381ef47c4c37f6be0116b61a5ff0ddf4da6a 201a567836576380edc8d7a1b7f2e70c4127faa7ea541da4d7e0457401b2b492 2debe28ebdeea8789a136170782018789d7ba6e8d07b8289231c8b6aa50
sha256204ecc72a94c1d1ef60a08ccb132a5123d2e8dcfc16ef1cacebb20887049ec2d89b848781c0405cc0cead60172ec75e035aca12e8c147818192fde2266d 204ecc72a94c1d1ef60a08ccb132a5123d2e8dcfc16ef1cacebb20887049ec2d Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha2562248f89b848781c0405cc0cead60172ec75e035aca12e8c147818192fde2266d32e1a44445124165ed61592527fe649a32ed889ee75fdb73d07bf396812 2248f89b848781c0405cc0cead60172ec75e035aca12e8c147818192fde2266d 204ecc72a94c1d1ef60a08ccb132a5123d2e8dcfc16ef1cacebb2088704
sha2562611831b22f6b0df892e363d429a666b5a4bb9303a97b30c527fb4f43379a462137cd4eeff2528c749bc80fa8c05be279fbadf54fd48eb433a63ba9ebaf 2611831b22f6b0df892e363d429a666b5a4bb9303a97b30c527fb4f43379a462 0dd337e3bef51dd39867317b47870076c8bda3efede772fc571b48d59ff
sha25629015d08a221749ca7cd1b9526ae4c434457199ac3226236f9e57fdb01b212137693119e8e07ee9ab0979a219f99763deb2b4134e8a6c18cec7aba1a76a 29015d08a221749ca7cd1b9526ae4c434457199ac3226236f9e57fdb01b21213 1259e834561574787f5e8c6f0fd7e3af62ce566317275ad6e0484b2d2d0
sha2562cd44a3204106c4fa3e11c310f21a3d0a89795ae90cad00117c779386ea619fd0200e84137fb1c07e39fbd7f0ded1eda78d3c95cfa1e16887f0762ab665 2cd44a3204106c4fa3e11c310f21a3d0a89795ae90cad00117c779386ea619fd 83a482b1771474915838db7251d00cf12ae5171c04966621bba82c5829e
sha2562debe28ebdeea8789a136170782018789d7ba6e8d07b8289231c8b6aa509a83967836576380edc8d7a1b7f2e70c4127faa7ea541da4d7e0457401b2b492 2debe28ebdeea8789a136170782018789d7ba6e8d07b8289231c8b6aa509a839 351376c7a04ab7bf3f4a22b124165c4817d7fefe35dd2d0834cd3fcf3c5
sha256341b86bd427dfca140ef6b3f47c7f269fe3ada974692237cc038f5910326d806834561574787f5e8c6f0fd7e3af62ce566317275ad6e0484b2d2d02904e 341b86bd427dfca140ef6b3f47c7f269fe3ada974692237cc038f5910326d806 5d91e7426fb87e5f2c9a5aa575d8bc0e98b7e1a09947dcb4e4943c5c047
sha256351376c7a04ab7bf3f4a22b124165c4817d7fefe35dd2d0834cd3fcf3c58004328ebdeea8789a136170782018789d7ba6e8d07b8289231c8b6aa509a839 351376c7a04ab7bf3f4a22b124165c4817d7fefe35dd2d0834cd3fcf3c580043 36ac209d2115d4b64b3b2b41b8731235168ac71d744740dbbc73f6c13cc
sha25636ac209d2115d4b64b3b2b41b8731235168ac71d744740dbbc73f6c13cc85bab6c7a04ab7bf3f4a22b124165c4817d7fefe35dd2d0834cd3fcf3c580043 36ac209d2115d4b64b3b2b41b8731235168ac71d744740dbbc73f6c13cc85bab 3ceb74963648d8adf4b47303d74d344628257dc36cf87a4330099fc264f
sha2563743bc035609dc41608e2580bd9ee1555bbd8e9311dcf879e12821ce40727db592cb9f190f8c06d444ac5431f637b6ea8ba864201a549903e3115968403 3743bc035609dc41608e2580bd9ee1555bbd8e9311dcf879e12821ce40727db5 ab004137cd4eeff2528c749bc80fa8c05be279fbadf54fd48eb433a63ba
sha25638dfdc80844d6f6b0d1a73843f1a4704d7bb12cf2ca61d98a54d1cdb5722ac66450c470bd01096766ac25e8b6ca4edb79683c2ee5b2cc89ec2234983c44 38dfdc80844d6f6b0d1a73843f1a4704d7bb12cf2ca61d98a54d1cdb5722ac66 f81a37d816c639fd977d7781f7fe54cc51e2e34aa3bb8bc877c74ae1400
sha2563ceb74963648d8adf4b47303d74d344628257dc36cf87a4330099fc264fe6ae509d2115d4b64b3b2b41b8731235168ac71d744740dbbc73f6c13cc85bab 3ceb74963648d8adf4b47303d74d344628257dc36cf87a4330099fc264fe6ae5 46bdd38ab49faaed1aa40c17d17e2a45ba87236dee0802c6e9e1385bfc1
sha256404de9c0ea3f8061c69e0dac80c6706e9ad263059ed845f1d69fc77b367a51aa6bdea2bdc1028d232079b0bcf42a9b4997fb43e78fbda745f6bb047612c 404de9c0ea3f8061c69e0dac80c6706e9ad263059ed845f1d69fc77b367a51aa 7ac2d7693119e8e07ee9ab0979a219f99763deb2b4134e8a6c18cec7aba
sha25641b9c93fed52bffe68d03abbcbe42086a9baf743d56f9262abd5b4c7fcbff951d or directories created %TEMP%\CVR65CC.tmp.cvr File Hashes 41b9c93fed52bffe68d03abbcbe42086a9baf743d56f9262abd5b4c7fcbff951 4c5f92378c3fe002163abb763ab30de3b167512255af8f90c0ab7ca85e1
sha25646bdd38ab49faaed1aa40c17d17e2a45ba87236dee0802c6e9e1385bfc1fe2614963648d8adf4b47303d74d344628257dc36cf87a4330099fc264fe6ae5 46bdd38ab49faaed1aa40c17d17e2a45ba87236dee0802c6e9e1385bfc1fe261 4aca7a72441a2100f4d40348e813ce0bcdb87e7d311e4e2e3b1dc53eecd
sha2564aca7a72441a2100f4d40348e813ce0bcdb87e7d311e4e2e3b1dc53eecd9f14938ab49faaed1aa40c17d17e2a45ba87236dee0802c6e9e1385bfc1fe261 4aca7a72441a2100f4d40348e813ce0bcdb87e7d311e4e2e3b1dc53eecd9f149 4b62feae568e3aaf8510897ab6c674283a7d133d4e72b4aaa4864a465bd
sha2564b62feae568e3aaf8510897ab6c674283a7d133d4e72b4aaa4864a465bd88807a72441a2100f4d40348e813ce0bcdb87e7d311e4e2e3b1dc53eecd9f149 4b62feae568e3aaf8510897ab6c674283a7d133d4e72b4aaa4864a465bd88807 4d4906439c50c3c8e80b40e0f1135f3c6df31b1fa596f668d4f8c48ead9
sha2564c5f92378c3fe002163abb763ab30de3b167512255af8f90c0ab7ca85e15fe7f93fed52bffe68d03abbcbe42086a9baf743d56f9262abd5b4c7fcbff951 4c5f92378c3fe002163abb763ab30de3b167512255af8f90c0ab7ca85e15fe7f 8c0559c86e7879ecf25442bc0a8105193d44e9641ac939077d43f6c4dcf
sha2564d4906439c50c3c8e80b40e0f1135f3c6df31b1fa596f668d4f8c48ead902dc3eae568e3aaf8510897ab6c674283a7d133d4e72b4aaa4864a465bd88807 4d4906439c50c3c8e80b40e0f1135f3c6df31b1fa596f668d4f8c48ead902dc3 5e7442c9c6b95f9a7af5ce9a08b1d61852e1da901ddf96e1604374be36d
sha256513a70f9692100bab9aee761125a446c7a7fb2ddd8395810f64c73cedd664f8e4d903c19da7f9b951419fb31fc8027c27f7ed7e3fdb89a923004a838ca1 513a70f9692100bab9aee761125a446c7a7fb2ddd8395810f64c73cedd664f8e f2fee82c08af4579275a7bfd7859bd9031c43a4c871ab6bb1d3fe1d699c
sha25656fc60eff1ce21bc0662abce0ce74834e530b4baf297f055bdfdc5bb77c22ec6bc4b32cd84d8ed11907d8b47e0caa41af884efbe599e287978ad56cc6d4 56fc60eff1ce21bc0662abce0ce74834e530b4baf297f055bdfdc5bb77c22ec6 Coverage Screenshots of Detection AMP ThreatGrid Win.Trojan
sha2565702fa93b08399d8f8d7d1ef1eb2902e7f37a9bbaaf5d9aa6b85a2844224662e38a3e7a788700bef153d999c6527975c108176e435a0ca200e15fa08d5a 5702fa93b08399d8f8d7d1ef1eb2902e7f37a9bbaaf5d9aa6b85a2844224662e Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256588d681952c3d07a6f2dd740e6253a6160a37ec3d80d376f742b2f1c9e9fa3a5684a7ce4e263d0018310e03f4c81df776cd2ad1fdb26e0cb46ee5a9d899 588d681952c3d07a6f2dd740e6253a6160a37ec3d80d376f742b2f1c9e9fa3a5 0c27abc4b32cd84d8ed11907d8b47e0caa41af884efbe599e287978ad56
sha25658bcd393831d35adf5343ddeaedc3de4f9b4c11565cbcb21e220ef20d34061d6a7dec0510afc007260370f08f166f6aeadbf0e38206aef3b2df96c6fddb 58bcd393831d35adf5343ddeaedc3de4f9b4c11565cbcb21e220ef20d34061d6 7531238a3e7a788700bef153d999c6527975c108176e435a0ca200e15fa
sha2565d91e7426fb87e5f2c9a5aa575d8bc0e98b7e1a09947dcb4e4943c5c047933d96bd427dfca140ef6b3f47c7f269fe3ada974692237cc038f5910326d806 5d91e7426fb87e5f2c9a5aa575d8bc0e98b7e1a09947dcb4e4943c5c047933d9 f11534d903c19da7f9b951419fb31fc8027c27f7ed7e3fdb89a923004a8
sha2565e7442c9c6b95f9a7af5ce9a08b1d61852e1da901ddf96e1604374be36d823c16439c50c3c8e80b40e0f1135f3c6df31b1fa596f668d4f8c48ead902dc3 5e7442c9c6b95f9a7af5ce9a08b1d61852e1da901ddf96e1604374be36d823c1 6274606653a2bb4470d3acdd72f11af37827253f5a728d539da9be0a6fb
sha25661012a5ae49bcfc6c31110b0117c9ed3d3f810cb8053857ef3017b403aeb4ad0c34887ea6213f18347720d7b1d257969f821bc78f6ad128f55ff137096c 61012a5ae49bcfc6c31110b0117c9ed3d3f810cb8053857ef3017b403aeb4ad0 6161ca5b2cd218ae1c277e6fcc509f571cc409ae4b2aba007d0e1ef2805
sha2566161ca5b2cd218ae1c277e6fcc509f571cc409ae4b2aba007d0e1ef28057fd7da5ae49bcfc6c31110b0117c9ed3d3f810cb8053857ef3017b403aeb4ad0 6161ca5b2cd218ae1c277e6fcc509f571cc409ae4b2aba007d0e1ef28057fd7d cacc1b16c233ad74c95b051edb5542a2824441314aba3f12e0397b85722
sha2566274606653a2bb4470d3acdd72f11af37827253f5a728d539da9be0a6fb12db32c9c6b95f9a7af5ce9a08b1d61852e1da901ddf96e1604374be36d823c1 6274606653a2bb4470d3acdd72f11af37827253f5a728d539da9be0a6fb12db3 631e4b651c157a1179bd28fc71cc072a933ec7a9be962fa4e758963c4f4
sha25662f72450c470bd01096766ac25e8b6ca4edb79683c2ee5b2cc89ec2234983c44fca20938acaeaf82d7753a86bdf9c6ed1bcb6573634d8f515d15b6ddd13 62f72450c470bd01096766ac25e8b6ca4edb79683c2ee5b2cc89ec2234983c44 38dfdc80844d6f6b0d1a73843f1a4704d7bb12cf2ca61d98a54d1cdb572
sha256631e4b651c157a1179bd28fc71cc072a933ec7a9be962fa4e758963c4f45067306653a2bb4470d3acdd72f11af37827253f5a728d539da9be0a6fb12db3 631e4b651c157a1179bd28fc71cc072a933ec7a9be962fa4e758963c4f450673 6994c078ad88915221a6679dcab25f942a6799c998bfffd36004f500faf
sha2566994c078ad88915221a6679dcab25f942a6799c998bfffd36004f500faf1d2aab651c157a1179bd28fc71cc072a933ec7a9be962fa4e758963c4f450673 6994c078ad88915221a6679dcab25f942a6799c998bfffd36004f500faf1d2aa 69fee7f159df45b2f3fe177b0e4f8377b2f281d907c15ce69b3f5fd4359
sha25669fee7f159df45b2f3fe177b0e4f8377b2f281d907c15ce69b3f5fd43592d297078ad88915221a6679dcab25f942a6799c998bfffd36004f500faf1d2aa 69fee7f159df45b2f3fe177b0e4f8377b2f281d907c15ce69b3f5fd43592d297 6a7fcf70672bec03c73443dc26ad8cd5dbed6227de7073d7d37d2c920d3
sha2566a7fcf70672bec03c73443dc26ad8cd5dbed6227de7073d7d37d2c920d3ca5b77f159df45b2f3fe177b0e4f8377b2f281d907c15ce69b3f5fd43592d297 6a7fcf70672bec03c73443dc26ad8cd5dbed6227de7073d7d37d2c920d3ca5b7 77deb4917f19577c06643e0268b96b12050d6814c07e961f84bd143189b
sha2566cff1fdde90a5708301b2d3c48729ebf3be7bb4a8f0e6992406affe034ad0a0f8d35bcb6ff16206c6d1e1495d4ddf9f1911f785bccda24c2b1e0bfe3d03 6cff1fdde90a5708301b2d3c48729ebf3be7bb4a8f0e6992406affe034ad0a0f 94549c01f4ca88d7169141b7a8aaa0a79a28e2770811ef84febd639af70
sha2566ffc7684a7ce4e263d0018310e03f4c81df776cd2ad1fdb26e0cb46ee5a9d899temDrive%\9f2c5u7.exe %SystemDrive%\022240c.exe File Hashes 6ffc7684a7ce4e263d0018310e03f4c81df776cd2ad1fdb26e0cb46ee5a9d899 588d681952c3d07a6f2dd740e6253a6160a37ec3d80d376f742b2f1c9e9
sha25672464898f83126f1a89d76cf76b2867b58655b3b316c2000dd185f2c31a4d7860f487d021aed897deee04e7aaada2521d096406517cd3adcacf4754beac 72464898f83126f1a89d76cf76b2867b58655b3b316c2000dd185f2c31a4d786 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256727d8957c910dd733b4960f22535e61375e417cc521b820ae8a917597af862959c86e7879ecf25442bc0a8105193d44e9641ac939077d43f6c4dcfc4e9c 727d8957c910dd733b4960f22535e61375e417cc521b820ae8a917597af86295 a84e3659977948b8f14cb2bfacef19d997463e779fed8750fa2d44b4342
sha2567531238a3e7a788700bef153d999c6527975c108176e435a0ca200e15fa08d5a393831d35adf5343ddeaedc3de4f9b4c11565cbcb21e220ef20d34061d6 7531238a3e7a788700bef153d999c6527975c108176e435a0ca200e15fa08d5a 5702fa93b08399d8f8d7d1ef1eb2902e7f37a9bbaaf5d9aa6b85a284422
sha25677deb4917f19577c06643e0268b96b12050d6814c07e961f84bd143189ba23b8f70672bec03c73443dc26ad8cd5dbed6227de7073d7d37d2c920d3ca5b7 77deb4917f19577c06643e0268b96b12050d6814c07e961f84bd143189ba23b8 7b28472b8552e2f9f63126a66ef1bec226acf49919e821c8204e0142864
sha2567a6d5ae7d7bc2849ea40907912a27e8aa6c83fafd952168f9e2d43f76881300cPROFILE%\Documents\_README-Encrypted-Files.html File Hashes 7a6d5ae7d7bc2849ea40907912a27e8aa6c83fafd952168f9e2d43f76881300c cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b5
sha2567ac2d7693119e8e07ee9ab0979a219f99763deb2b4134e8a6c18cec7aba1a76a9c0ea3f8061c69e0dac80c6706e9ad263059ed845f1d69fc77b367a51aa 7ac2d7693119e8e07ee9ab0979a219f99763deb2b4134e8a6c18cec7aba1a76a 29015d08a221749ca7cd1b9526ae4c434457199ac3226236f9e57fdb01b
sha2567b28472b8552e2f9f63126a66ef1bec226acf49919e821c8204e0142864af7c24917f19577c06643e0268b96b12050d6814c07e961f84bd143189ba23b8 7b28472b8552e2f9f63126a66ef1bec226acf49919e821c8204e0142864af7c2 7c31ebd234e9ea4e8e5176cca74f95cf6d0f8ebdad6f5bae0aa07229cff
sha2567c31ebd234e9ea4e8e5176cca74f95cf6d0f8ebdad6f5bae0aa07229cff3557a72b8552e2f9f63126a66ef1bec226acf49919e821c8204e0142864af7c2 7c31ebd234e9ea4e8e5176cca74f95cf6d0f8ebdad6f5bae0aa07229cff3557a 8046e1b4a24d714812f4fcfa7f7debfa2057a83c8631b7e2112d37653c8
sha2567cd99c34887ea6213f18347720d7b1d257969f821bc78f6ad128f55ff137096c4146e151d525e94e536ee2605a76c8a0d1699024979181712a03b249f25 7cd99c34887ea6213f18347720d7b1d257969f821bc78f6ad128f55ff137096c 61012a5ae49bcfc6c31110b0117c9ed3d3f810cb8053857ef3017b403ae
sha2568046e1b4a24d714812f4fcfa7f7debfa2057a83c8631b7e2112d37653c83aa04bd234e9ea4e8e5176cca74f95cf6d0f8ebdad6f5bae0aa07229cff3557a 8046e1b4a24d714812f4fcfa7f7debfa2057a83c8631b7e2112d37653c83aa04 8902a87a99470edc2210af7f660ae3f1d032a4e764ae5415f00b3de4e87
sha25681bec8df30db0bd694ecf01d3950fbe91823854ab017c0cb176d32c9ada3f202nd Settings\Administrator\SKsYAMwU\OugokkEo.exe File Hashes 81bec8df30db0bd694ecf01d3950fbe91823854ab017c0cb176d32c9ada3f202 d49a98d35bcb6ff16206c6d1e1495d4ddf9f1911f785bccda24c2b1e0bf
sha256824eed3471a9f86836ac4bced8a5ce7f57df95048a995dc0219feab771404f28c01f4ca88d7169141b7a8aaa0a79a28e2770811ef84febd639af70c7a74 824eed3471a9f86836ac4bced8a5ce7f57df95048a995dc0219feab771404f28 db2415f2259b7ec9aaa6ab004a659753ad51dafccbc8696f0a5e9067503
sha25683a482b1771474915838db7251d00cf12ae5171c04966621bba82c5829e57b4aa3204106c4fa3e11c310f21a3d0a89795ae90cad00117c779386ea619fd 83a482b1771474915838db7251d00cf12ae5171c04966621bba82c5829e57b4a a831d5503c549917d333d45c72532f0407ed306ca5c95478dad11cb3434
sha2568902a87a99470edc2210af7f660ae3f1d032a4e764ae5415f00b3de4e873715b1b4a24d714812f4fcfa7f7debfa2057a83c8631b7e2112d37653c83aa04 8902a87a99470edc2210af7f660ae3f1d032a4e764ae5415f00b3de4e873715b 9217691c969ca90bba7e68648c5d52c1fec4183f2837adb407b55e6957c
sha2568c0559c86e7879ecf25442bc0a8105193d44e9641ac939077d43f6c4dcfc4e9c2378c3fe002163abb763ab30de3b167512255af8f90c0ab7ca85e15fe7f 8c0559c86e7879ecf25442bc0a8105193d44e9641ac939077d43f6c4dcfc4e9c 727d8957c910dd733b4960f22535e61375e417cc521b820ae8a917597af
sha2569217691c969ca90bba7e68648c5d52c1fec4183f2837adb407b55e6957cc62c887a99470edc2210af7f660ae3f1d032a4e764ae5415f00b3de4e873715b 9217691c969ca90bba7e68648c5d52c1fec4183f2837adb407b55e6957cc62c8 95dfa7cb08275d55c2daa3dab39cd3502ed8e9221501ccd43096c4dcb69
sha256927bd28d825adc6569d1e307bd3709f73350b3ca2b0f98bbbdd2370526ae19b6o|jog|dat) %TEMP%\667796.bat %TEMP%\fjs\svu-mkc File Hashes 927bd28d825adc6569d1e307bd3709f73350b3ca2b0f98bbbdd2370526ae19b6 bb51a0200e84137fb1c07e39fbd7f0ded1eda78d3c95cfa1e16887f0762
sha25694549c01f4ca88d7169141b7a8aaa0a79a28e2770811ef84febd639af70c7a74fdde90a5708301b2d3c48729ebf3be7bb4a8f0e6992406affe034ad0a0f 94549c01f4ca88d7169141b7a8aaa0a79a28e2770811ef84febd639af70c7a74 824eed3471a9f86836ac4bced8a5ce7f57df95048a995dc0219feab7714
sha25695dfa7cb08275d55c2daa3dab39cd3502ed8e9221501ccd43096c4dcb69574df91c969ca90bba7e68648c5d52c1fec4183f2837adb407b55e6957cc62c8 95dfa7cb08275d55c2daa3dab39cd3502ed8e9221501ccd43096c4dcb69574df 9a7972ec543717861bf0030e35069c5d672ed0447a1f7690f8e3992329b
sha2569a7972ec543717861bf0030e35069c5d672ed0447a1f7690f8e3992329b4e08f7cb08275d55c2daa3dab39cd3502ed8e9221501ccd43096c4dcb69574df 9a7972ec543717861bf0030e35069c5d672ed0447a1f7690f8e3992329b4e08f a5067cd834500ad631443d66f52a8454adedcc316bdd9a9f340587efe3d
sha256a0b29989213e1c2e08bcb136d77164251fcff105c640a9ba75f9ed87c6a0407b82c08af4579275a7bfd7859bd9031c43a4c871ab6bb1d3fe1d699c020ca a0b29989213e1c2e08bcb136d77164251fcff105c640a9ba75f9ed87c6a0407b f04ce92cb9f190f8c06d444ac5431f637b6ea8ba864201a549903e31159
sha256a4e076bdea2bdc1028d232079b0bcf42a9b4997fb43e78fbda745f6bb047612c659977948b8f14cb2bfacef19d997463e779fed8750fa2d44b4342584b4 a4e076bdea2bdc1028d232079b0bcf42a9b4997fb43e78fbda745f6bb047612c 404de9c0ea3f8061c69e0dac80c6706e9ad263059ed845f1d69fc77b367
sha256a5067cd834500ad631443d66f52a8454adedcc316bdd9a9f340587efe3d718622ec543717861bf0030e35069c5d672ed0447a1f7690f8e3992329b4e08f a5067cd834500ad631443d66f52a8454adedcc316bdd9a9f340587efe3d71862 a912eebe77cd06413744e8bca95c7bc4d7200a82097178cbfd478778d89
sha256a831d5503c549917d333d45c72532f0407ed306ca5c95478dad11cb34342ca602b1771474915838db7251d00cf12ae5171c04966621bba82c5829e57b4a a831d5503c549917d333d45c72532f0407ed306ca5c95478dad11cb34342ca60 f8305d63f8d4ebc4b4c4bea7c3dd75b3d3c3f53aa2f28cc789a2573d55b
sha256a84e3659977948b8f14cb2bfacef19d997463e779fed8750fa2d44b4342584b4957c910dd733b4960f22535e61375e417cc521b820ae8a917597af86295 a84e3659977948b8f14cb2bfacef19d997463e779fed8750fa2d44b4342584b4 a4e076bdea2bdc1028d232079b0bcf42a9b4997fb43e78fbda745f6bb04
sha256a912eebe77cd06413744e8bca95c7bc4d7200a82097178cbfd478778d89afc16cd834500ad631443d66f52a8454adedcc316bdd9a9f340587efe3d71862 a912eebe77cd06413744e8bca95c7bc4d7200a82097178cbfd478778d89afc16 af598ffbba3c59ce109d2ddd9ef58425bd3a8a70bbbea48b14460dcef21
sha256ab004137cd4eeff2528c749bc80fa8c05be279fbadf54fd48eb433a63ba9ebafc035609dc41608e2580bd9ee1555bbd8e9311dcf879e12821ce40727db5 ab004137cd4eeff2528c749bc80fa8c05be279fbadf54fd48eb433a63ba9ebaf 2611831b22f6b0df892e363d429a666b5a4bb9303a97b30c527fb4f4337
sha256af598ffbba3c59ce109d2ddd9ef58425bd3a8a70bbbea48b14460dcef21704d7ebe77cd06413744e8bca95c7bc4d7200a82097178cbfd478778d89afc16 af598ffbba3c59ce109d2ddd9ef58425bd3a8a70bbbea48b14460dcef21704d7 b1828e83a4d01b45adb238165e17520f5853a2a8d1ac083d2f6130be881
sha256b1828e83a4d01b45adb238165e17520f5853a2a8d1ac083d2f6130be8813e5fbffbba3c59ce109d2ddd9ef58425bd3a8a70bbbea48b14460dcef21704d7 b1828e83a4d01b45adb238165e17520f5853a2a8d1ac083d2f6130be8813e5fb ba9ae0515d7d720634114de6f669bcb9c9bc8bebb9b30df98585b8c2751
sha256ba9ae0515d7d720634114de6f669bcb9c9bc8bebb9b30df98585b8c2751cb419e83a4d01b45adb238165e17520f5853a2a8d1ac083d2f6130be8813e5fb ba9ae0515d7d720634114de6f669bcb9c9bc8bebb9b30df98585b8c2751cb419 d34e29aeae628324e27067f1b0ed9895b335a99eed2bad836b2cb08cc31
sha256bb51a0200e84137fb1c07e39fbd7f0ded1eda78d3c95cfa1e16887f0762ab66528d825adc6569d1e307bd3709f73350b3ca2b0f98bbbdd2370526ae19b6 bb51a0200e84137fb1c07e39fbd7f0ded1eda78d3c95cfa1e16887f0762ab665 2cd44a3204106c4fa3e11c310f21a3d0a89795ae90cad00117c779386ea
sha256cacc1b16c233ad74c95b051edb5542a2824441314aba3f12e0397b857222c0a9a5b2cd218ae1c277e6fcc509f571cc409ae4b2aba007d0e1ef28057fd7d cacc1b16c233ad74c95b051edb5542a2824441314aba3f12e0397b857222c0a9 Coverage Screenshots of Detection AMP ThreatGrid Screenshot
sha256cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b51617fae7d7bc2849ea40907912a27e8aa6c83fafd952168f9e2d43f76881300c cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b51617f Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256d34e29aeae628324e27067f1b0ed9895b335a99eed2bad836b2cb08cc311276e0515d7d720634114de6f669bcb9c9bc8bebb9b30df98585b8c2751cb419 d34e29aeae628324e27067f1b0ed9895b335a99eed2bad836b2cb08cc311276e d3a1dc1018514102ce83b054374a0422328ba812f78a9fee7d17b224a7b
sha256d3a1dc1018514102ce83b054374a0422328ba812f78a9fee7d17b224a7b7fb9b9aeae628324e27067f1b0ed9895b335a99eed2bad836b2cb08cc311276e d3a1dc1018514102ce83b054374a0422328ba812f78a9fee7d17b224a7b7fb9b e3a122deee0913710df8e2d8137f089123e455195a6d71dac072343fc8e
sha256d49a98d35bcb6ff16206c6d1e1495d4ddf9f1911f785bccda24c2b1e0bfe3d038df30db0bd694ecf01d3950fbe91823854ab017c0cb176d32c9ada3f202 d49a98d35bcb6ff16206c6d1e1495d4ddf9f1911f785bccda24c2b1e0bfe3d03 6cff1fdde90a5708301b2d3c48729ebf3be7bb4a8f0e6992406affe034a
sha256d603a19fb425aa77308ee7d3527f03e0a455667aed2030b4fc2c46388a230dad\LOCALS~1\Temp\713906.bat \TEMP\scan sample.exe File Hashes d603a19fb425aa77308ee7d3527f03e0a455667aed2030b4fc2c46388a230dad f23220f487d021aed897deee04e7aaada2521d096406517cd3adcacf475
sha256db2415f2259b7ec9aaa6ab004a659753ad51dafccbc8696f0a5e906750304efcd3471a9f86836ac4bced8a5ce7f57df95048a995dc0219feab771404f28 db2415f2259b7ec9aaa6ab004a659753ad51dafccbc8696f0a5e906750304efc faaa74146e151d525e94e536ee2605a76c8a0d1699024979181712a03b2
sha256e3a122deee0913710df8e2d8137f089123e455195a6d71dac072343fc8e48c2ec1018514102ce83b054374a0422328ba812f78a9fee7d17b224a7b7fb9b e3a122deee0913710df8e2d8137f089123e455195a6d71dac072343fc8e48c2e ec67964a20940b42a58a3149327e519c97505ae0227566d31a72e94a31a
sha256ea047fca20938acaeaf82d7753a86bdf9c6ed1bcb6573634d8f515d15b6ddd13d63f8d4ebc4b4c4bea7c3dd75b3d3c3f53aa2f28cc789a2573d55b83613 ea047fca20938acaeaf82d7753a86bdf9c6ed1bcb6573634d8f515d15b6ddd13 62f72450c470bd01096766ac25e8b6ca4edb79683c2ee5b2cc89ec22349
sha256ec0aba7dec0510afc007260370f08f166f6aeadbf0e38206aef3b2df96c6fddb7e3bef51dd39867317b47870076c8bda3efede772fc571b48d59ff79bcf ec0aba7dec0510afc007260370f08f166f6aeadbf0e38206aef3b2df96c6fddb 58bcd393831d35adf5343ddeaedc3de4f9b4c11565cbcb21e220ef20d34
sha256ec67964a20940b42a58a3149327e519c97505ae0227566d31a72e94a31add0b42deee0913710df8e2d8137f089123e455195a6d71dac072343fc8e48c2e ec67964a20940b42a58a3149327e519c97505ae0227566d31a72e94a31add0b4 ed8779e9e0231c4882152bae2be367a9cac0d2b270a5fba8d9dd56ccd6d
sha256ed8779e9e0231c4882152bae2be367a9cac0d2b270a5fba8d9dd56ccd6ddcb3464a20940b42a58a3149327e519c97505ae0227566d31a72e94a31add0b4 ed8779e9e0231c4882152bae2be367a9cac0d2b270a5fba8d9dd56ccd6ddcb34 ee5b16b15dd712ff7e0ada9e6b93da04fcfe9043e53a605d0ace1fe365f
sha256ee5b16b15dd712ff7e0ada9e6b93da04fcfe9043e53a605d0ace1fe365f0bd549e9e0231c4882152bae2be367a9cac0d2b270a5fba8d9dd56ccd6ddcb34 ee5b16b15dd712ff7e0ada9e6b93da04fcfe9043e53a605d0ace1fe365f0bd54 f0892554e22c923645f20e9de0920199a791f744dee18f9c8df7f0b0ffa
sha256f04ce92cb9f190f8c06d444ac5431f637b6ea8ba864201a549903e3115968403989213e1c2e08bcb136d77164251fcff105c640a9ba75f9ed87c6a0407b f04ce92cb9f190f8c06d444ac5431f637b6ea8ba864201a549903e3115968403 3743bc035609dc41608e2580bd9ee1555bbd8e9311dcf879e12821ce407
sha256f0892554e22c923645f20e9de0920199a791f744dee18f9c8df7f0b0ffa954e06b15dd712ff7e0ada9e6b93da04fcfe9043e53a605d0ace1fe365f0bd54 f0892554e22c923645f20e9de0920199a791f744dee18f9c8df7f0b0ffa954e0 f921d1fd16fe5735f1abab55e836fd6817e9d6e340d0d056af25b721455
sha256f11534d903c19da7f9b951419fb31fc8027c27f7ed7e3fdb89a923004a838ca17426fb87e5f2c9a5aa575d8bc0e98b7e1a09947dcb4e4943c5c047933d9 f11534d903c19da7f9b951419fb31fc8027c27f7ed7e3fdb89a923004a838ca1 513a70f9692100bab9aee761125a446c7a7fb2ddd8395810f64c73cedd6
sha256f23220f487d021aed897deee04e7aaada2521d096406517cd3adcacf4754beac19fb425aa77308ee7d3527f03e0a455667aed2030b4fc2c46388a230dad f23220f487d021aed897deee04e7aaada2521d096406517cd3adcacf4754beac 72464898f83126f1a89d76cf76b2867b58655b3b316c2000dd185f2c31a
sha256f2fee82c08af4579275a7bfd7859bd9031c43a4c871ab6bb1d3fe1d699c020ca0f9692100bab9aee761125a446c7a7fb2ddd8395810f64c73cedd664f8e f2fee82c08af4579275a7bfd7859bd9031c43a4c871ab6bb1d3fe1d699c020ca a0b29989213e1c2e08bcb136d77164251fcff105c640a9ba75f9ed87c6a
sha256f81a37d816c639fd977d7781f7fe54cc51e2e34aa3bb8bc877c74ae140025003c80844d6f6b0d1a73843f1a4704d7bb12cf2ca61d98a54d1cdb5722ac66 f81a37d816c639fd977d7781f7fe54cc51e2e34aa3bb8bc877c74ae140025003 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256f8305d63f8d4ebc4b4c4bea7c3dd75b3d3c3f53aa2f28cc789a2573d55b836135503c549917d333d45c72532f0407ed306ca5c95478dad11cb34342ca60 f8305d63f8d4ebc4b4c4bea7c3dd75b3d3c3f53aa2f28cc789a2573d55b83613 ea047fca20938acaeaf82d7753a86bdf9c6ed1bcb6573634d8f515d15b6
sha256f903440f2b8e05fde78b17ad34bdae047604a33af999aaee8954dc1f689d3298ents and Settings\Administrator\josYsEwI\IEkIQAgg.exe \TEMP\f903440f2b8e05fde78b17ad34bdae047604a33af999aaee8954dc1f689d3298.exe %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\B291D.dmp
sha256f921d1fd16fe5735f1abab55e836fd6817e9d6e340d0d056af25b7214559cf7b554e22c923645f20e9de0920199a791f744dee18f9c8df7f0b0ffa954e0 f921d1fd16fe5735f1abab55e836fd6817e9d6e340d0d056af25b7214559cf7b ff29411724d4cac3a6553ab621180f8a2c05cf01573c97873061b9df9ba
sha256faaa74146e151d525e94e536ee2605a76c8a0d1699024979181712a03b249f255f2259b7ec9aaa6ab004a659753ad51dafccbc8696f0a5e906750304efc faaa74146e151d525e94e536ee2605a76c8a0d1699024979181712a03b249f25 7cd99c34887ea6213f18347720d7b1d257969f821bc78f6ad128f55ff13
sha256ff29411724d4cac3a6553ab621180f8a2c05cf01573c97873061b9df9ba572461fd16fe5735f1abab55e836fd6817e9d6e340d0d056af25b7214559cf7b ff29411724d4cac3a6553ab621180f8a2c05cf01573c97873061b9df9ba57246 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
Full article1,082 words · extracted from blog.talosintelligence.com · click to collapse

Friday, July 21, 2017 12:34

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 14 and July 21. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Downloader.Agent-6333860-0
    Document Macro obfuscation
    These document downloaders are Excel worksheets which use obfuscated macros to trigge Shell functions and leverage cmd calling powershell. The execution chain typically is Excel -> CMD -> PowerShell download and execute.
  • Doc.Dropper.Agent-6333859-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable.
  • Doc.Macro.Obfuscation-6332451-0
    Office Macro
    Malware authors leverage Office documents to compromise a target system. To bypass anti-virus products they will employ obfuscation techniques. This cluster uses Arrays to indirectly access data and reform it into the required data to evaluate.
  • Js.Dropper.sPowerShell-6333821-0
    Dropper
    sPowerShell is a JavaScript dropper for both ransomware & information stealers that are written as PowerShell scripts. The script itself is encoded with Base64; the original JS script is responsible for decoding it. Once decoded, the PowerShell ransomware gets to work on encrypting files based on an inclusion list for file extensions. It will not change the file extension for affected files, & it's up to the user to discover these modified files or the ransom note that is left for them. There is no automatic prompt for the dropped ransom note.
  • Win.Trojan.Agent-1388716
    Trojan
    This polymorphic sample is a dropper that will create copies of itself on the hard drive under different random names to ensure persistence. It can carry different malicious payloads, so it can be used as a delivery mechanism for different types of threats.
  • Win.Trojan.AutoIT-6333854-0
    Trojan
    This is an AutoIT malware which is packed in a self-executing RAR archive. The malware is using process hollowing to hide itself from a debugger, is communicating with a remote web server, steals passwords from Firefox' password store and adds an autorun registry key to achieve persistence.
  • Win.Trojan.DelphiSpamDown-6333856-0
    Downloader
    This sample is a Delphi downloader. It is spread in the wild and it is related to a massive spam campaign. The binary is written in Delphi and contains anti-debug and anti-vm tricks and tries to contact a remote server to download additional resources.
  • Win.Virus.Virlock-6332874-0
    Virus
    VirLock and its variants are polymorphic ransomware that not only encrypts the files on the system, but also infects them by inserting a modified version of its own code at the beginning of each file. It will replace each file by an executable disguised as the original file, with the same icon and its "exe" extension hidden. Once executed, it will infect the system and show the contents of the original file. Additionally, it locks the screen and asks the user to pay a ransom. It will try to connect to google.com to check if it gets redirected to some localized google page such as google.co.uk or google.au. It will also try to spread to network shares or cloud storage platforms, in an attempt to increase the damage and potentially infect other users that may inadvertently open shared infected files.

Threats

Doc.Downloader.Agent-6333860-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 52[.]14[.]80[.]76
  • 52[.]173[.]193[.]166  Domain Names
  • farmona[.]co Files and or directories created
  • %TEMP%\CVR668.tmp.cvr
  • %AppData%.exe File Hashes
  • 01c4f96c8117df219cf9f50723454ace242edcf2d22b09e8e72c5d0c92aad540
  • 01ed6302a7ea8d4c54d439b7016b99b6dca275f85d22611811bac8c135309d41
  • 0634216b34baf0fdc293002632932312293fc4854701b143c6f4735e8cd98b45
  • 070e56e7170fc63c1c42c3b0b37df5a25f5c7e2e0a5fd454e8e8e63de2b71bdf
  • 07aa3365d733098e11e91ece1628130217414488d3fce0e2e261bfb29ab6fed9
  • 0be6e5bb277cbe815beced059aa5fb5160954dc8fd3fef918746caf276cc82a3
  • 0fc8af1a3deb4d2895b9bb202278299369a16950239288577472bc06fbf07e4b
  • 13fd575d1474ae579f55615733f75fa50231447b8653e6eb58678103ee82e99e
  • 1b01632e1a44445124165ed61592527fe649a32ed889ee75fdb73d07bf396812
  • 2248f89b848781c0405cc0cead60172ec75e035aca12e8c147818192fde2266d
  • 204ecc72a94c1d1ef60a08ccb132a5123d2e8dcfc16ef1cacebb20887049ec2d

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Doc.Dropper.Agent-6333859-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • atlon-mebel[.]ru
  • ayurvoyage[.]com
  • enzyma[.]es
  • inormann[.]it
  • kms2017[.]com
  • pta-babel[.]net
  • studio80[.]biz
  • sxmht[.]com
  • test[.]atlon-mebel[.]ru
  • tidytrend[.]com
  • westsussexcentre[.]org[.]uk
  • wizbam[.]com Files and or directories created
  • %TEMP%\proshuto8.exe
  • %TEMP%\~DFFD1107AB284DD884.TMP
  • %TEMP%\serenade8.TEMP File Hashes
  • 026b944764ec5f0f342b2f532e18093627930a1c9810d235a4893ecbbbe4eaee
  • 04f5160bf3126ad52a819a86cf4807dc83c89a4e5a2643b49b3fe60bf01c8419
  • 09a43a41f182b0677d28b7e9cc685d1217f5c1fca63af4418f0a9ef776f6dd0a
  • 0a0bf44d664575b194063536138d0b5ea9d3583e956e675462b55decf4ad73a9
  • 0ea9107334209b304b650ff86854862d4eed68e616aec015618853b1d6a3c001
  • 1c32493b72d3c3da9b7d4b9022edfdec445a7feaa261e621799c1e45241b5b2f
  • 1dd941235ba3aae55c0f876131d6381ef47c4c37f6be0116b61a5ff0ddf4da6a
  • 201a567836576380edc8d7a1b7f2e70c4127faa7ea541da4d7e0457401b2b492
  • 2debe28ebdeea8789a136170782018789d7ba6e8d07b8289231c8b6aa509a839
  • 351376c7a04ab7bf3f4a22b124165c4817d7fefe35dd2d0834cd3fcf3c580043
  • 36ac209d2115d4b64b3b2b41b8731235168ac71d744740dbbc73f6c13cc85bab
  • 3ceb74963648d8adf4b47303d74d344628257dc36cf87a4330099fc264fe6ae5
  • 46bdd38ab49faaed1aa40c17d17e2a45ba87236dee0802c6e9e1385bfc1fe261
  • 4aca7a72441a2100f4d40348e813ce0bcdb87e7d311e4e2e3b1dc53eecd9f149
  • 4b62feae568e3aaf8510897ab6c674283a7d133d4e72b4aaa4864a465bd88807
  • 4d4906439c50c3c8e80b40e0f1135f3c6df31b1fa596f668d4f8c48ead902dc3
  • 5e7442c9c6b95f9a7af5ce9a08b1d61852e1da901ddf96e1604374be36d823c1
  • 6274606653a2bb4470d3acdd72f11af37827253f5a728d539da9be0a6fb12db3
  • 631e4b651c157a1179bd28fc71cc072a933ec7a9be962fa4e758963c4f450673
  • 6994c078ad88915221a6679dcab25f942a6799c998bfffd36004f500faf1d2aa
  • 69fee7f159df45b2f3fe177b0e4f8377b2f281d907c15ce69b3f5fd43592d297
  • 6a7fcf70672bec03c73443dc26ad8cd5dbed6227de7073d7d37d2c920d3ca5b7
  • 77deb4917f19577c06643e0268b96b12050d6814c07e961f84bd143189ba23b8
  • 7b28472b8552e2f9f63126a66ef1bec226acf49919e821c8204e0142864af7c2
  • 7c31ebd234e9ea4e8e5176cca74f95cf6d0f8ebdad6f5bae0aa07229cff3557a
  • 8046e1b4a24d714812f4fcfa7f7debfa2057a83c8631b7e2112d37653c83aa04
  • 8902a87a99470edc2210af7f660ae3f1d032a4e764ae5415f00b3de4e873715b
  • 9217691c969ca90bba7e68648c5d52c1fec4183f2837adb407b55e6957cc62c8
  • 95dfa7cb08275d55c2daa3dab39cd3502ed8e9221501ccd43096c4dcb69574df
  • 9a7972ec543717861bf0030e35069c5d672ed0447a1f7690f8e3992329b4e08f
  • a5067cd834500ad631443d66f52a8454adedcc316bdd9a9f340587efe3d71862
  • a912eebe77cd06413744e8bca95c7bc4d7200a82097178cbfd478778d89afc16
  • af598ffbba3c59ce109d2ddd9ef58425bd3a8a70bbbea48b14460dcef21704d7
  • b1828e83a4d01b45adb238165e17520f5853a2a8d1ac083d2f6130be8813e5fb
  • ba9ae0515d7d720634114de6f669bcb9c9bc8bebb9b30df98585b8c2751cb419
  • d34e29aeae628324e27067f1b0ed9895b335a99eed2bad836b2cb08cc311276e
  • d3a1dc1018514102ce83b054374a0422328ba812f78a9fee7d17b224a7b7fb9b
  • e3a122deee0913710df8e2d8137f089123e455195a6d71dac072343fc8e48c2e
  • ec67964a20940b42a58a3149327e519c97505ae0227566d31a72e94a31add0b4
  • ed8779e9e0231c4882152bae2be367a9cac0d2b270a5fba8d9dd56ccd6ddcb34
  • ee5b16b15dd712ff7e0ada9e6b93da04fcfe9043e53a605d0ace1fe365f0bd54
  • f0892554e22c923645f20e9de0920199a791f744dee18f9c8df7f0b0ffa954e0
  • f921d1fd16fe5735f1abab55e836fd6817e9d6e340d0d056af25b7214559cf7b
  • ff29411724d4cac3a6553ab621180f8a2c05cf01573c97873061b9df9ba57246

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Doc.Macro.Obfuscation-6332451-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 185[.]165[.]29[.]36
  • 52[.]173[.]193[.]166 Domain Names
  • N/A Files and or directories created
  • %TEMP%\CVR65CC.tmp.cvr File Hashes
  • 41b9c93fed52bffe68d03abbcbe42086a9baf743d56f9262abd5b4c7fcbff951
  • 4c5f92378c3fe002163abb763ab30de3b167512255af8f90c0ab7ca85e15fe7f
  • 8c0559c86e7879ecf25442bc0a8105193d44e9641ac939077d43f6c4dcfc4e9c
  • 727d8957c910dd733b4960f22535e61375e417cc521b820ae8a917597af86295
  • a84e3659977948b8f14cb2bfacef19d997463e779fed8750fa2d44b4342584b4
  • a4e076bdea2bdc1028d232079b0bcf42a9b4997fb43e78fbda745f6bb047612c
  • 404de9c0ea3f8061c69e0dac80c6706e9ad263059ed845f1d69fc77b367a51aa
  • 7ac2d7693119e8e07ee9ab0979a219f99763deb2b4134e8a6c18cec7aba1a76a
  • 29015d08a221749ca7cd1b9526ae4c434457199ac3226236f9e57fdb01b21213
  • 1259e834561574787f5e8c6f0fd7e3af62ce566317275ad6e0484b2d2d02904e
  • 341b86bd427dfca140ef6b3f47c7f269fe3ada974692237cc038f5910326d806
  • 5d91e7426fb87e5f2c9a5aa575d8bc0e98b7e1a09947dcb4e4943c5c047933d9
  • f11534d903c19da7f9b951419fb31fc8027c27f7ed7e3fdb89a923004a838ca1
  • 513a70f9692100bab9aee761125a446c7a7fb2ddd8395810f64c73cedd664f8e
  • f2fee82c08af4579275a7bfd7859bd9031c43a4c871ab6bb1d3fe1d699c020ca
  • a0b29989213e1c2e08bcb136d77164251fcff105c640a9ba75f9ed87c6a0407b
  • f04ce92cb9f190f8c06d444ac5431f637b6ea8ba864201a549903e3115968403
  • 3743bc035609dc41608e2580bd9ee1555bbd8e9311dcf879e12821ce40727db5
  • ab004137cd4eeff2528c749bc80fa8c05be279fbadf54fd48eb433a63ba9ebaf
  • 2611831b22f6b0df892e363d429a666b5a4bb9303a97b30c527fb4f43379a462
  • 0dd337e3bef51dd39867317b47870076c8bda3efede772fc571b48d59ff79bcf
  • ec0aba7dec0510afc007260370f08f166f6aeadbf0e38206aef3b2df96c6fddb
  • 58bcd393831d35adf5343ddeaedc3de4f9b4c11565cbcb21e220ef20d34061d6
  • 7531238a3e7a788700bef153d999c6527975c108176e435a0ca200e15fa08d5a
  • 5702fa93b08399d8f8d7d1ef1eb2902e7f37a9bbaaf5d9aa6b85a2844224662e

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Js.Dropper.sPowerShell-6333821-0

Indicators of Compromise Registry Keys

  • HKLM\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection Mutexes
  • Sessions\1\BaseNamedObjects\_SHuassist.mtx
  • Sessions\1\BaseNamedObjects\DBWinMutex IP Addresses
  • N/A Domain Names
  • joelosteel[.]gdn
  • ipcaservices[.]xyz Files and or directories created
  • %USERPROFILE%\Desktop\_README-Encrypted-Files.html
  • %USERPROFILE%\Documents\_README-Encrypted-Files.html File Hashes
  • 7a6d5ae7d7bc2849ea40907912a27e8aa6c83fafd952168f9e2d43f76881300c
  • cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b51617f

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Win.Trojan.Agent-1388716

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %SystemDrive%\e86nw5.exe
  • %SystemDrive%\4kh4ht.exe
  • %SystemDrive%\ucrr38u.exe
  • %SystemDrive%\fllx91x.exe
  • %SystemDrive%\9f2c5u7.exe
  • %SystemDrive%\022240c.exe File Hashes
  • 6ffc7684a7ce4e263d0018310e03f4c81df776cd2ad1fdb26e0cb46ee5a9d899
  • 588d681952c3d07a6f2dd740e6253a6160a37ec3d80d376f742b2f1c9e9fa3a5
  • 0c27abc4b32cd84d8ed11907d8b47e0caa41af884efbe599e287978ad56cc6d4
  • 56fc60eff1ce21bc0662abce0ce74834e530b4baf297f055bdfdc5bb77c22ec6

Coverage

Screenshots of Detection AMP


ThreatGrid

Win.Trojan.AutoIT-6333854-0

Indicators of CompromiseRegistry Keys

  • <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
  • <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • cn67975[.]tmweb[.]ru Files and or directories created
  • %TEMP%\fjs\[a-z]{3}.(ppt|xl|icm|pdf|txt|bat|docx|mp4|bmp|ico|jog|dat)
  • %TEMP%\667796.bat
  • %TEMP%\fjs\svu-mkc  File Hashes
  • 927bd28d825adc6569d1e307bd3709f73350b3ca2b0f98bbbdd2370526ae19b6
  • bb51a0200e84137fb1c07e39fbd7f0ded1eda78d3c95cfa1e16887f0762ab665
  • 2cd44a3204106c4fa3e11c310f21a3d0a89795ae90cad00117c779386ea619fd
  • 83a482b1771474915838db7251d00cf12ae5171c04966621bba82c5829e57b4a
  • a831d5503c549917d333d45c72532f0407ed306ca5c95478dad11cb34342ca60
  • f8305d63f8d4ebc4b4c4bea7c3dd75b3d3c3f53aa2f28cc789a2573d55b83613
  • ea047fca20938acaeaf82d7753a86bdf9c6ed1bcb6573634d8f515d15b6ddd13
  • 62f72450c470bd01096766ac25e8b6ca4edb79683c2ee5b2cc89ec2234983c44
  • 38dfdc80844d6f6b0d1a73843f1a4704d7bb12cf2ca61d98a54d1cdb5722ac66
  • f81a37d816c639fd977d7781f7fe54cc51e2e34aa3bb8bc877c74ae140025003

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Trojan.DelphiSpamDown-6333856-0

Indicators of Compromise Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection
  • HKU\Software\Microsoft\Windows\ShellNoRoam\MUICache
  • HKU\Software\WinRAR Mutexes
  • DBWinMutex IP Addresses
  • 92[.]53[.]96[.]122 Domain Names
  • cg51478[.]tmweb[.]ru  Files and or directories created
  • \samr
  • %System32%\wdi\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{debd4f12-5573-4e21-a11a-2adccd61a055}\snapshot.etl
  • %System32%\wdi\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{bc3d8877-b46d-4746-b041-b538af5e2cf0}\snapshot.etl
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\713906.bat
  • \TEMP\scan sample.exe File Hashes
  • d603a19fb425aa77308ee7d3527f03e0a455667aed2030b4fc2c46388a230dad
  • f23220f487d021aed897deee04e7aaada2521d096406517cd3adcacf4754beac
  • 72464898f83126f1a89d76cf76b2867b58655b3b316c2000dd185f2c31a4d786

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Virus.Virlock-6332874-0

Indicators of Compromise Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: ObjectName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: DisplayName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: Type
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: Start
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value: rgwIEcIs.exe
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: ImagePath
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value: IMMwgswc.exe
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
  • Value: HideFileExt
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
  • Value: Hidden
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VOSIYOAG
  • Value: WOW64
  • HKU\Software\Microsoft\Windows\CurrentVersion\Run
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\VosIYoaG
  • <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mutexes
  • \BaseNamedObjects\OeoQEIQU
  • \BaseNamedObjects\JMcsAgIg
  • \BaseNamedObjects\eKQoMYQM
  • \BaseNamedObjects\rgQAYgUk
  • \BaseNamedObjects\juAkwAUg
  • \BaseNamedObjects\WUUMAwEY
  • \BaseNamedObjects\LIAAoosI IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %SystemDrive%\Documents and Settings\Administrator\mYAMwMEo\aYEsEocI.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eAsoAsoc.bat
  • %SystemDrive%\Documents and Settings\All Users\xEQswAgE\hEEskAMI.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\file.vbs
  • %SystemDrive%\Documents and Settings\All Users\keAQYows\Ngwockko.exe
  • %SystemDrive%\Documents and Settings\All Users\eCQoYwsY\cOIkcIIs.exe
  • \MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\f1d2_appcompat.txt
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HAIgcwYY.bat
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JikQIUos.bat
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1aba_appcompat.txt
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\BywQYkYY.bat
  • %System32%\wdi\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{a69f0170-8245-4aed-a99e-3b0aad202ce2}\snapshot.etl
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vgMUkcEw.bat
  • %SystemDrive%\Documents and Settings\Administrator\HQcwsEQk\iUEAMAQY.exe
  • %SystemDrive%\Documents and Settings\All Users\wkkIwsUo\FcIoIUwU.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\oiwwooMU.bat
  • %SystemDrive%\Documents and Settings\All Users\UUkwYskE\tIAMksoQ.exe
  • %SystemDrive%\Documents and Settings\All Users\TiggsEgM\iigYwggc.exe
  • %SystemDrive%\Documents and Settings\Administrator\josYsEwI\IEkIQAgg.exe
  • \TEMP\f903440f2b8e05fde78b17ad34bdae047604a33af999aaee8954dc1f689d3298.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\B291D.dmp
  • %SystemDrive%\Documents and Settings\All Users\OUkAAEIY\qaMAkEQc.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\NuYsMUAc.bat
  • %SystemDrive%\Documents and Settings\All Users\ymYgUYAo\PqUEkQUs.exe
  • %SystemDrive%\Documents and Settings\Administrator\SKsYAMwU\OugokkEo.exe File Hashes
  • 81bec8df30db0bd694ecf01d3950fbe91823854ab017c0cb176d32c9ada3f202
  • d49a98d35bcb6ff16206c6d1e1495d4ddf9f1911f785bccda24c2b1e0bfe3d03
  • 6cff1fdde90a5708301b2d3c48729ebf3be7bb4a8f0e6992406affe034ad0a0f
  • 94549c01f4ca88d7169141b7a8aaa0a79a28e2770811ef84febd639af70c7a74
  • 824eed3471a9f86836ac4bced8a5ce7f57df95048a995dc0219feab771404f28
  • db2415f2259b7ec9aaa6ab004a659753ad51dafccbc8696f0a5e906750304efc
  • faaa74146e151d525e94e536ee2605a76c8a0d1699024979181712a03b249f25
  • 7cd99c34887ea6213f18347720d7b1d257969f821bc78f6ad128f55ff137096c
  • 61012a5ae49bcfc6c31110b0117c9ed3d3f810cb8053857ef3017b403aeb4ad0
  • 6161ca5b2cd218ae1c277e6fcc509f571cc409ae4b2aba007d0e1ef28057fd7d
  • cacc1b16c233ad74c95b051edb5542a2824441314aba3f12e0397b857222c0a9

Coverage

Screenshots of Detection AMP


ThreatGrid


Screenshot

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0714-0721/