Cisco Talospublished Jun 23, 19:55 UTC (Jun 23, 2017)ingested Sep 10, 06:19 UTC

Threat Round-up for June 16

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,173 words · extracted from blog.talosintelligence.com · click to collapse

Friday, June 23, 2017 15:55

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 16 and June 23. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

Doc.Macro.StrObfuscation-6329879-0
VB Macro
Microsoft Office macros can be obfuscated in various ways. A recent resurgence of malicious Word documents include the use of a string obfuscation to mask the intended functionality
Win.Dropper.skypee-6329923-0
Dropper
This malware is a trojan dropper that is used to steal banking information and user credentials. It leverages Visual Basic code to install itself and establish persistence. Characteristics this malware exhibits include connecting to different domains to POST data using URI patterns like /http/image.php or /admin/image.php.
Win.Worm.Untukmu-5949608-0
Worm
Untukmu, also known as Brontok, is a worm spread through email or infected USB drives. It stores several copies of itself on different places on the hard disk, including system directories. It gains persistence by modifying registry keys and creating an entry in the Startup directory. IT also modifies several system configuration parameters to disable the registry editor and the shell, as well as modify the safeboot shell to prevent the user from cleaning the machine.
Win.Trojan.Shifu-6330434-1
Trojan
This well-known malware family contains counter measures to protect itself from analysis. It gathers details about its victims by stealing user's login credentials for online banking business.
Win.Trojan.Blackshades-6327385-1
Trojan
Blackshades is a prevalent trojan with many capabilities including logging keystrokes, recording video from webcams, and downloading and executing additional malware.
Win.Ransomware.BTCWare-6329927-0
Ransomware
BTCWare is active Windows ransomware that was first discovered a few months ago. Since then, it has undergone various changes, including changes to the encrypted file extension & the cipher used to encrypt such files. Earlier variants relied on weaker cryptography options that included RC4, allowing brute force recovery of the private key in some cases. There was also a noted variant that had its private RSA key leaked online. This recent variant relies on AES-256 with improvements to the handling of the private key generation.
Doc.Dropper.Agent-6330744-0
Office Macro Downloader
This is an obfuscated Office Macro downloader that leverages Powershell to download a malicious payload executable. The host that these samples attempt to download the next stage from currently does not resolve.
Win.Trojan.Yakes-6330794-0
Trojan
Yakes is a trojan which installs itself on a machine via a .vbs script in the Startup folder, and then allows its packager to connect to the infected machine. IPs and domain names of the CnC server as well as mutex names vary depending on the packager.
Win.Ransomware.Locky-6330799-0
Ransomware
Throughout the majority of 2016, Locky was the dominant ransomware in the threat landscape. It was an early pioneer when it came to using scripting formats Windows hosts would natively handle, like .js, .wsf, and .hta. These scripting formats acted as a vehicle to deliver the payload via email campaigns. Recent in-depth look: /necurs-locky-campaign
Win.Trojan.DownloaderJava-6330457-0
Downloader
This sample is a .NET downloader. It downloads additional Java files from an hardcoded URL and they are executed. This binary is actively sent as attachment in an ongoing spam campaign.

Threats

Doc.Macro.StrObfuscation-6329879-0

Indicators of Compromise Registry Keys

N/A Mutexes
N/A IP Addresses
185[.]165[.]29[.]36
52[.]173[.]193[.]166 Domain Names
N/A Files and or directories created
%TEMP%\<random_string>.txt
%TEMP%\<random_string>.txt
%TEMP%\<random_string>.js
%TEMP%\<random_string>.txt
%TEMP%\<random_string>.txt File Hashes
b64e77a8b76986e6929e48507b5f8fed9c0eb339f058fa5a31d38920e25c3a8c
9bcbbba6636b99da1ab567813af8226fb22ab47509326c6501d22e40efa1464c
79a89d266bcf1b8c829b823203fce8e69159246469c14ac355f615c2dd783e01
b96f975a2c7cfb03e53e35f365e3f16e51c2370b15970693c7dd2201f08ddb1c
3e4c9f8828897c19e264a2a066d9c181edf08885b6fafdec833aa683259aced9
79a89d266bcf1b8c829b823203fce8e69159246469c14ac355f615c2dd783e01
48487be062791d86b66d10cbdd54ce1b1dfbfe99a86bfd8c3b2ba6be7df28f6e
3e4c9f8828897c19e264a2a066d9c181edf08885b6fafdec833aa683259aced9
b64e77a8b76986e6929e48507b5f8fed9c0eb339f058fa5a31d38920e25c3a8c
e0e134db8de265d9ecd2f174cd143da54a4a922d64abfff704488ded3c7b3bdf
9bcbbba6636b99da1ab567813af8226fb22ab47509326c6501d22e40efa1464c
02840c7ca57b46ba7d6b40f93e0054dd180a290b30c2a8397fcd646ef30cfdf6
6f39761c2c1fcd6975505a47828f9dec483c8ec730ba68eb05e09ef60a91c879
b96f975a2c7cfb03e53e35f365e3f16e51c2370b15970693c7dd2201f08ddb1c

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Screenshot

Win.Dropper.skypee-6329923-0

Indicators of Compromise Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: skypee Mutexes
1505527138 IP Addresses
N/A Domain Names
N/A Files and or directories created
N/A File Hashes
35b8bf77573eef9acef8b19521e43ce3d440a5e02ccf6deda05ae58eeac3cfe8
09aa51458f73755e4e58a7d59853f07d685d7e7dc48971117b1e9392a1aa416f
99e7ecbe795d7d6a03c4965b2ac7d79544a6772a97ccaca909f66bfe174fa023
26ef58faf48e58dc0680c6b595436dbba01ea3c8fca809858fcfc47d66b56914
0d983d4ee06e08b4e1df021c17792a8352c8ff4b2d3e6ee4f7fe53ce30122d66
0b5800e19bdb4c43ab1469ce88af3d807eaa7620697a4b88368ab6beef098240
3a5c13ed645ab7571c2a6ba27fd689e748e7d42de35bc076d18ad76070a13d14
a6f34f3a70ea64adccfbd983abfebe9dc46741064da0520582b09ce6d6a966ee
5ac152e574c091986561d8055d0b0a97fab1267c6dfba69d169ac9c41a5bc390
f33a3141ee599c94ff60b40be0c0d18c66732640a809b4319a0140eb7827bafb
7f7fe90b586671e59c6769e4202871fb10573983de7fbe7ca7ad3a97af7395af
dd8826ffbe107318163ed2716231ccf588453308bbcd3c798720e7586c059f99
2b3d33238a64134c347db9a3f5b9f0fbecfe62199f081c3c44fb5f1b0948e7cc
e336b8976fb83889c3027ed084a02f9de97f90787304bfa87c58be8dd8035e20
7f990624c65a28f0803e19c5a37d34567a921d17531899a384f2077c1c6f5dff
c62ef9ef0c92b95740f8a67c9879d3c2f951655cccc20c310140668265d8135f
bb5f19265e7b5094cdf55c401bae987cf895bf885cf485c3c627c1fe267e9bfd
f5d55f9539e753fe3a4e0de50bb3c6347ee9928c0f6db33e5f6b6e4af179da0f
2948da52a96f06cfc4bfb7d4d079201aaa3ef89de1cc144462973107c4962435
77ca8909ec71c9086e569cb2acbf4c766dd60f758a5ccc938402d3f176636ae3
c80fbdbba34721670043965c3b02832df7f8cb1c5b5c57b04dbb5ee6346d5994
8c2579168922d065854582cc486a0bb43f8accb60ccc01ad1035894012ac2e83
de8f2233c54d10ae9b51325cefb5dfad644acc225d4ddacb5c77ed89b6b1a645
f5f11cc63feec411864cdc27f1d0d186b5173cf443876450e445d47d29b8ada6
1ca9f0b54357839435e64dd26d74fb365622b54395f56bf25985db0e7470a355
68ed0c9628c7764c5b3826309fe5db06a5380e7f1c8ebfb8f62c68d12d135b49

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Worm.Untukmu-5949608-0

Indicators of Compromise Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\OFFICE\12.0\OUTLOOK\RESILIENCY\STARTUPITEMS
Value: w+%
<HKCU>\SOFTWARE\MICROSOFT\OFFICE\12.0\OUTLOOK\RESILIENCY\STARTUPITEMS
Value: l:(
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: LogonAdministrator
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER
Value: DisableMSI
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE
Value: DisableSR
<HKCU>\CONTROL PANEL\DESKTOP
Value: SCRNSAVE.EXE
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
Value: NoFolderOptions
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CABINETSTATE
Value: FullPathAddress
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value: DisableRegistryTools
<HKCU>\CONTROL PANEL\DESKTOP
Value: ScreenSaveTimeOut
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM
Value: DisableCMD
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: xk
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE
Value: DisableConfig
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\AEDEBUG
Value: Debugger
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value: Shell
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: internat.exe
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MENUORDER\START MENU
Value: Order
<HKCU>\Software\Microsoft\Office\12.0\Outlook\Resiliency\StartupItems
<HKLM>\SOFTWARE\CLASSES\lnkfile\shell\open\command
<HKLM>\SOFTWARE\CLASSES\LNKFILE\SHELL\open
<HKLM>\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\System\ Mutexes
N/A IP Addresses
N/A Domain Names
N/A Files and or directories created
\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS\CSRSS.EXE
\Documents and Settings\Administrator\Local Settings\Application Data\winlogon.exe
\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe
\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS\SERVICES.EXE
\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS\SMSS.EXE
%System32%\shell.exe
\Documents and Settings\All Users\Start Menu\Programs\Startup\Empty.pif
\Documents and Settings\Administrator\Local Settings\Application Data\lsass.exe
\XK\Folder.htt
\Documents and Settings\Administrator\Local Settings\Application Data\csrss.exe
%WinDir%\xk.exe
\Data Administrator.exe
\Documents and Settings\Administrator\Local Settings\Application Data\services.exe
%System32%\IExplorer.exe
\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS\LSASS.EXE
%System32%\Mig2.scr
\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
\xk.exe
\XK\New Folder.exe File Hashes
26fbb2aa5a28de5e149e0178dacb964333c852bbca2a1416d860e5edc84cbe04
b5e7b1b06efe80a081a2cbdff0fab4539be0797b2351ab4e1b247303586d1340
36890fa6756c252bc89abb88ec9da140cd87937eb5223af05e4e8ef36ec019c9
34c9c0d2fbb403f7e8068ce49071da6dbeadc4ad995101388c9ad092e38f90de

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Trojan.Shifu-6330434-1

Indicators of Compromise Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: IntelPowerAgent[0-9] Mutexes
N/A IP Addresses
N/A Domain Names
DGA Domains
adtejoyo1377[.]tk Files and or directories created
%PROGRAMDATA%\[a-z0-9]{8}.exe
%APPDATA%\[a-z0-9]{8}.exe File Hashes
280a3734efd7e54a32c8719c0efe0365df6b14e8ac54e301736c8ff9829da424
5283c7d5db5b5629b5b58534bcf6cd7607f0d015d740ca91ee85ade420b7460f
2271a2e9d72580e98331792d94fca75e5a0c1dfee958d79652adf9eaab3ee266
fc9a9633b8ab0b78a820c74bda57ab608316c81d6ed6b469e7487ce3712bf62b
3ad0138c2d8842f3aef8b045e05e28e441b81ea8444dce0b6799f4ec65c70540
23045a27de525a0d8c85390414ac4458a32bdbd6f9dc8f0e39b32dad3f89fa55
55768ac9504b8e612b380fc0984277f0576dd8d129a5363e73d4d2a9baff5c7e
06144d28c5d1db06fa8f78fdcb651145d6500483a9b1fe26c62a510dbe1763b7
bace9b3e3220c6e9f6281f4d4a1eabb9223e6093ccc9876c600a31671b790ed2
fbaab6ab727898b1ff27fdffec49bbe00976474b93741b1fca5eeb38f1f25099
0c4a32e9eaeb38e1b30ad44f52c4f8ea3f2e3f522d9b2281ecd3701383b20cfa
252db718eb383331a34cbe53c0b9889c80452e19bc06007e740eaa23e2ef2a8f
ca9c3f80a3faaaf001f3fdb37e1cf9abb14a1628be2a9f6ba4e0cc51ed708cb9
27922f495e54bf51cb7329a75c533ca4a1ab8323f1f781dfd027571a37c7485f
f1dcb8e18a764d300267f2bc0873bf8ec15385cec7ab1d2871e43f238f86a6f1
a9639bd0930f2db17de0321f99ce70355f1dba17b4aa6f5444a4c2490738e255
c0522065fbce82a74d13361c88be210f62a8633c9a59203cea0ce6722619092b
f7e904b2eb8c5280d008cdf93e10fab87df6bb2423bdf1e8f7bb203f63c15ede
280a3734efd7e54a32c8719c0efe0365df6b14e8ac54e301736c8ff9829da424
e2404f8fb7f080cb0b344c1f006cde4a00143641633bb454069773d616a9106e
b232dccdb27873c64616d2cefcf2dd81f7958ec8778e31da7f1688a68fda4249

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Trojan.Blackshades-6327385-1

Indicators of Compromise Registry Keys

HKU\Software\Microsoft\Windows\CurrentVersion\Run
HKU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mutexes
LVLWU6KG22 IP Addresses
N/A Domain Names
N/A Files and or directories created
\Documents and Settings\Administrator\Local Settings\Temp\jd7018sy8tv.exe.jpg
%AppData%\D6GM5WGET8
%AppData%\JD7018SY8TV.exe.tmp
%AppData%\JD7018SY8TV.exe File Hashes
017a3ea76063f364f9d7a70ecde761e22005b74fce020e798e6151d3806dd251
0620a1061f4c14acbaa3b5b70bab4894aae33bc9f30bc8623ea9f63ddc953088
0743dd7863c03515d74a1832592c1409bdff0d30aac4f45ba73dc99ef3c1e5e3
086be8b2789ccb88f60c71773de7c22cf1d97aa72d2b21a3cde9248cc7321606
0a3e9d5ec49cc97f1c9fc2a59e53462d0d2fe6fa1f448e69e401e63769dafe0a
0ba95e35fcde6b1b3f49d1267e3dea8f2a8b4acb5633bc3acb3aefe9bf3e7680
0d58482c771ef85649f1375f6ab61c48c380c7694b3ad7552af1bdc1ec724890
1014e1c1246a6c7cbb519ed711a2168955ee4b4222baae5be911f981088604db
15a64cded5bcf3dc911bfeb3a5701a376dea51f9f8530dc0949ba6e6f4339cc4
18039335deeaf295164f5e24c5afbcc50fa27f2eaf5733be2cf51bcf01f664c3

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Ransomware.BTCWare-6329927-0

Indicators of CompromiseRegistry Keys

N/A Mutexes
ONYONLOCK IP Addresses
N/A Domain Names
N/A Files and or directories created
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk
%System32%\config\SysEvent.Evt
%System32%\config\WindowsPowerShell.evt
%UserProfile%\Desktop\!#_RESTORE_FILES_#!File Hashes
0951b80a41f06f8062c85c80be0276c6a1328edb2a501ed69ed25083303724d2
0b5b4111df2b4b2f78ec053db14ea5c74965ec13f1902570b06697d71a77dcd7
1cde4818229f719153565dd84b01d3927928e7a2b6a61684ee932520f55250a9
3f9b9062ca3497614ac021146b229b07786774934f98a261547b24df5cc5b263
6617035053954a5131d401061c58831e181ddfde221f402029d5ed4bd39561dd
6b4363a419208d6fe093f5a95b55653560d236e1a302f98d22fdfc36488ebcb1
72653d3a882901867143579131a6e9dff2f72a647afe21035c1deda0c4c943b0
741950e9be430267efff601fca1a7c21b65b904658fa46f9e618ea50787faaac
79afde5a759bcd71165b547f7a310fa06674c565a2e81af0304bc1a4527bfa1b
7bd14a6ceacc14e67e84add894d432c6383676ea89265b36515014cd136851e3
7c19bc3a4ad7cddcd78eee053b408779c25a56c9666e9cc9d76ea617aaa0934d
7f86548bdcd97e3faa3e8df0bd6b6aac7c05ed9d445a2bb7973a4d6efd39bd6a
880d25776e08769a75c43bf9a69f9f7cafcc46546690270fa36785195f327d97
8bbaa450526bc2933d462ae24439148273434ff342e0a0774d5e37af4bb16864
97b88ae6bee56ae6193c7908eaabac9be579861868cc575cc345c1d1bca1e302
cef0439b7b483900323614d6cf2eb341019d747aaa0feb81710ef836d330ca9c
d0ab335e86e665edbab58240ae6aa691fa4802ae831c0204e71f90a34ae66983
db5fefc3b8349efa907ed2812c869b10d8de109ff005fe8aac15eaa4c8efdcb8
eb843f4f80ae2e58b569f916239c6208601eece08efb334ae12b8658e3436987
ed3118f96c7e87ea768a40acc574b2ff3cae3a3cdf2419ccb30c750a876d5f30
f7850a2efe397098859d8c3d0ed0b4fa93f87148382e250f094d12f021bc8460
f9d27f4f3231cd80b19b30de4426aecada466e18ee785e82d5afa59e986b4d16

Coverage

Screenshots of DetectionAMP

ThreatGrid

Doc.Dropper.Agent-6330744-0

Indicators of Compromise Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
wi92[.]js2-order[.]pl Files and or directories created
%AppData%.exe File Hashes
0033b70080a9ee615a371a5c18c373bc9a703a9b5dbcac39a2584a328a49bb87
3a8abf2f7fade51114fde4251ff98b23093e07a7545be3568f3da7ba730bb995
3a93346632f58a112708b761154a170be06de1b6a0583f58053cfb1fce09c780
6465c7ce45a1430e55cf10e43732892a1f86fa90646adf5628dd6d72dd849e8f
6ab9d03a0fc72b377712f262601db2f14561e6f285d9742e956416409bba3e64
8daded1c8acd270c0371e6c24310dacb4d841c801b707594823f371ce601f29b
9b23fd1d89331bddc13063391bea1c03fbaf813a584554cd43b1d6bb6574992a
d19a574a36079ca7885ae142c0f24578743eb98cca7f57df3c2258c8dbb874bc
d31705a64e38340872f6b9e8287e0297d4fd13cb8373295ce0d9ffdf6947e43f
e545a49f26d1482225dd25bf0b2790a1f6d5f96bda9afd90ec8cd38b7b20ec07
f048103ee6f0902b3025729301ce9bbbfee35272bc594be2a6cbd7da72f6f4c4

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Screenshot

Win.Trojan.Yakes-6330794-0

Indicators of Compromise Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: 35bbded46273bc9f6fa3fc5557dba9af
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: 35bbded46273bc9f6fa3fc5557dba9af
<HKCU>\Software\35bbded46273bc9f6fa3fc5557dba9af
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Mutexes
qazwsxedc
35bbded46273bc9f6fa3fc5557dba9af IP Addresses
105[.]154[.]213[.]56
52[.]173[.]193[.]166 Domain Names
pokas12[.]ddns[.]net Files and or directories created
%TEMP%\IXP000.TMP\1.xyz
%SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\x.vbs
%TEMP%\server.exe
%AppData%\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs File Hashes
be73fc08bed6bba6c25688c150da18e26314c5d670d741d52c457e01f0a1ad0e
f1055f9d223106263dd0d8879be304da2cbe83428c2277a8b42c96c762121a1b
a5024be1b974fc16ca190a26a01bef35e02aceaa4c8fe8a3938084e22d623ce2
eb319d0c53ec709a0482cf58a65b615fcba38a2b44b41e832b4804c6aba68280
75d9b6086aa9bd51596733a163bd568cc648978ac68e7ebdd817654b4c7e6fed
d323180a15cf584a184aa63a0044ec7701cb9d75769386bec21992ffd585d9dc
eeb4c5448c1a4a8723f860c7ce30889c2c5d018abe17df43fae2f6d23a713568
4657c3f05d44048fdfc41190e652413ba2508565aa9185fa1a0670a2536a95cc
c585135463d4fce5053f47c255747524585b98c1c3f8dc305beefa17d2fcfa9e
c99d37d2cfc2861254d1bb82cc6b41617e659e8f0430e63cd20f44778a3bfaac

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Ransomware.Locky-6330799-0

Indicators of Compromise Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
N/A Files and or directories created
.*\loptr-5e5a.htm
<GUID>.loptr File Hashes
091141f6b67540ba8848f1b081ad40d5f6d8172c878d40046f82ab0234acf3db
7f4777245025c96d936d14b3b4a718be35ced59558f090e1197adfca5d9573b2
26074772fa68db08f463c66deeabe064bcd9d48032430bbbdf27ffdf8967e8c5
85fa592bf685966d8da1cf72f2c6c092b40664de9c17d9cc4894f8f08e06f567
49184047c840287909cf0e6a5e00273c6d60da1750655ad66e219426b3cf9cd8
e7b8d8e3c19b6b3cc4a6eafced463f08176330fe243d8a9fcd20aedc5af17806

Coverage

Screenshots of Detection AMP

ThreatGrid

Screenshot

Win.Trojan.DownloaderJava-6330457-0

Indicators of Compromise Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: internat.exe
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: miZPeWpyLHr
<HKCU>\Software\Microsoft\SystemCertificates\My
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\TrustedPublisher
<HKCU>\Software\Microsoft\Windows Script Host\Settings
<HKLM>\SOFTWARE\WOW6432NODE\Microsoft
<HKCU>\Software\Microsoft\SystemCertificates\TrustedPublisher
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\TrustedPublisher
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Root
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CTLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SystemCertificates
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TrustedPeople
<HKCU>\Software\Microsoft\SystemCertificates\trust
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLs
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
<HKCU>\Software\Microsoft\SystemCertificates\Disallowed
<HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Disallowed
<HKCU>\Software\Policies\Microsoft\SystemCertificates\CA
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\Certificates
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TrustedPublisher
<A>\{C108F07B-312C-11E7-8D90-00501E3AE7B5}\DEFAULTOBJECTSTORE\LruList
<HKLM>\SYSTEM\CONTROLSET001\Control\DeviceClasses
<HKLM>\SYSTEM\CONTROLSET001\Control\CoDeviceInstallers
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\Root
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CTLs
<HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
<A>\{C108F07B-312C-11E7-8D90-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\A93\Indexes
<HKLM>\SOFTWARE\WOW6432NODE\Policies
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PRINT\PRINTERS\Fax\PrinterDriverData
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs Mutexes
N11463_-4521624950585898-1497978066453
Local\__DDrawExclMode__
Local\__DDrawCheckExclMode__
RasPbFile IP Addresses
149[.]210[.]145[.]237 Domain Names
nup[.]pw Files and or directories created
%AppData%\.qjava\Java\lib\jfr.jar
%AppData%\.qjava\Java\lib\rt.jar
%AppData%\.qjava\Java\lib\jfr\default.jfc
%AppData%\1497978066454.jar
%AppData%\.qjava\Java\lib\javafx.properties
%AppData%\.q7z.exe
%TEMP%\_0.15066600419658372851713423405977803.class
%WinDir%\Temp\FXSTIFFDebugLogFile.txt
\Users\Administrator\UlBrZNAMJSJ\iMCImxZnYcm.KwyVDG
%TEMP%\tmpA3A6.8e4d0709-e282-42fd-a717-9d512ecd2cb0.7z
%TEMP%\_0.32579030377917368405753216876059627.class
\TEMP\c9bd2f466d2c1500af5414f03f7d5c908cafdd602c23a8136cf82054233f7791.exe
%TEMP%\Windows7851854962857713622.dll
\Users\Administrator\fUTkALeaTxM\ID.txt
%AppData%\Oracle\lib\fontconfig.properties.src
%AppData%\.qjava\Java\lib\ext\cldrdata.jar
%TEMP%\tmpA3A6.tmp
\Users\Administrator\UlBrZNAMJSJ\ID.txt
%AppData%\Oracle\lib\jfr\profile.jfc
%TEMP%\tmpA395.tmp File Hashes
c9bd2f466d2c1500af5414f03f7d5c908cafdd602c23a8136cf82054233f7791
a49fb3f2f4a8e5d996b49d51eae11ec11dca3a1aa2db319ed004d898c4484bf2
b0f8ca0c55a07bc4a9a12ee6dade6843aa9ca875ebd082759b2a85727fe64f83
26c487810b80460a69711463dc3ffaa8d0ca6cc21dbf2856660fc1ceed23af53
555bdc43352d19ed64b7580206208462bfd3be9038bcb92c0898d2861f995c4b
3977f37224326f7508ed5f086fc4161d2f8d2aacff62f7c05d29243a8f401fa8
a84eef3d331514764cb72146a376f61e3cf2189fa7d2f81d1a7e99b41fafaedf

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0616-0623/

Type	Indicator	Context
domain	adtejoyo1377.tk	[0-9] Mutexes N/A IP Addresses N/A Domain Names DGA Domains adtejoyo1377[.]tk Files and or directories created %PROGRAMDATA%\[a-z0-9]{8
md5	35bbded46273bc9f6fa3fc5557dba9af	<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value: 35bbded46273bc9f6fa3fc5557dba9af <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSIO
sha256	0033b70080a9ee615a371a5c18c373bc9a703a9b5dbcac39a2584a328a49bb87	Files and or directories created %AppData%.exe File Hashes 0033b70080a9ee615a371a5c18c373bc9a703a9b5dbcac39a2584a328a49bb87 3a8abf2f7fade51114fde4251ff98b23093e07a7545be3568f3da7ba730
sha256	017a3ea76063f364f9d7a70ecde761e22005b74fce020e798e6151d3806dd251	%\JD7018SY8TV.exe.tmp %AppData%\JD7018SY8TV.exe File Hashes 017a3ea76063f364f9d7a70ecde761e22005b74fce020e798e6151d3806dd251 0620a1061f4c14acbaa3b5b70bab4894aae33bc9f30bc8623ea9f63ddc9
sha256	02840c7ca57b46ba7d6b40f93e0054dd180a290b30c2a8397fcd646ef30cfdf6	ba6636b99da1ab567813af8226fb22ab47509326c6501d22e40efa1464c 02840c7ca57b46ba7d6b40f93e0054dd180a290b30c2a8397fcd646ef30cfdf6 6f39761c2c1fcd6975505a47828f9dec483c8ec730ba68eb05e09ef60a9
sha256	06144d28c5d1db06fa8f78fdcb651145d6500483a9b1fe26c62a510dbe1763b7	ac9504b8e612b380fc0984277f0576dd8d129a5363e73d4d2a9baff5c7e 06144d28c5d1db06fa8f78fdcb651145d6500483a9b1fe26c62a510dbe1763b7 bace9b3e3220c6e9f6281f4d4a1eabb9223e6093ccc9876c600a31671b7
sha256	0620a1061f4c14acbaa3b5b70bab4894aae33bc9f30bc8623ea9f63ddc953088	ea76063f364f9d7a70ecde761e22005b74fce020e798e6151d3806dd251 0620a1061f4c14acbaa3b5b70bab4894aae33bc9f30bc8623ea9f63ddc953088 0743dd7863c03515d74a1832592c1409bdff0d30aac4f45ba73dc99ef3c
sha256	0743dd7863c03515d74a1832592c1409bdff0d30aac4f45ba73dc99ef3c1e5e3	1061f4c14acbaa3b5b70bab4894aae33bc9f30bc8623ea9f63ddc953088 0743dd7863c03515d74a1832592c1409bdff0d30aac4f45ba73dc99ef3c1e5e3 086be8b2789ccb88f60c71773de7c22cf1d97aa72d2b21a3cde9248cc73
sha256	086be8b2789ccb88f60c71773de7c22cf1d97aa72d2b21a3cde9248cc7321606	d7863c03515d74a1832592c1409bdff0d30aac4f45ba73dc99ef3c1e5e3 086be8b2789ccb88f60c71773de7c22cf1d97aa72d2b21a3cde9248cc7321606 0a3e9d5ec49cc97f1c9fc2a59e53462d0d2fe6fa1f448e69e401e63769d
sha256	091141f6b67540ba8848f1b081ad40d5f6d8172c878d40046f82ab0234acf3db	ectories created .*\loptr-5e5a.htm <GUID>.loptr File Hashes 091141f6b67540ba8848f1b081ad40d5f6d8172c878d40046f82ab0234acf3db 7f4777245025c96d936d14b3b4a718be35ced59558f090e1197adfca5d9
sha256	0951b80a41f06f8062c85c80be0276c6a1328edb2a501ed69ed25083303724d2	l.evt %UserProfile%\Desktop\!#_RESTORE_FILES_#! File Hashes 0951b80a41f06f8062c85c80be0276c6a1328edb2a501ed69ed25083303724d2 0b5b4111df2b4b2f78ec053db14ea5c74965ec13f1902570b06697d71a7
sha256	09aa51458f73755e4e58a7d59853f07d685d7e7dc48971117b1e9392a1aa416f	f77573eef9acef8b19521e43ce3d440a5e02ccf6deda05ae58eeac3cfe8 09aa51458f73755e4e58a7d59853f07d685d7e7dc48971117b1e9392a1aa416f 99e7ecbe795d7d6a03c4965b2ac7d79544a6772a97ccaca909f66bfe174
sha256	0a3e9d5ec49cc97f1c9fc2a59e53462d0d2fe6fa1f448e69e401e63769dafe0a	8b2789ccb88f60c71773de7c22cf1d97aa72d2b21a3cde9248cc7321606 0a3e9d5ec49cc97f1c9fc2a59e53462d0d2fe6fa1f448e69e401e63769dafe0a 0ba95e35fcde6b1b3f49d1267e3dea8f2a8b4acb5633bc3acb3aefe9bf3
sha256	0b5800e19bdb4c43ab1469ce88af3d807eaa7620697a4b88368ab6beef098240	d4ee06e08b4e1df021c17792a8352c8ff4b2d3e6ee4f7fe53ce30122d66 0b5800e19bdb4c43ab1469ce88af3d807eaa7620697a4b88368ab6beef098240 3a5c13ed645ab7571c2a6ba27fd689e748e7d42de35bc076d18ad76070a
sha256	0b5b4111df2b4b2f78ec053db14ea5c74965ec13f1902570b06697d71a77dcd7	80a41f06f8062c85c80be0276c6a1328edb2a501ed69ed25083303724d2 0b5b4111df2b4b2f78ec053db14ea5c74965ec13f1902570b06697d71a77dcd7 1cde4818229f719153565dd84b01d3927928e7a2b6a61684ee932520f55
sha256	0ba95e35fcde6b1b3f49d1267e3dea8f2a8b4acb5633bc3acb3aefe9bf3e7680	d5ec49cc97f1c9fc2a59e53462d0d2fe6fa1f448e69e401e63769dafe0a 0ba95e35fcde6b1b3f49d1267e3dea8f2a8b4acb5633bc3acb3aefe9bf3e7680 0d58482c771ef85649f1375f6ab61c48c380c7694b3ad7552af1bdc1ec7
sha256	0c4a32e9eaeb38e1b30ad44f52c4f8ea3f2e3f522d9b2281ecd3701383b20cfa	6ab727898b1ff27fdffec49bbe00976474b93741b1fca5eeb38f1f25099 0c4a32e9eaeb38e1b30ad44f52c4f8ea3f2e3f522d9b2281ecd3701383b20cfa 252db718eb383331a34cbe53c0b9889c80452e19bc06007e740eaa23e2e
sha256	0d58482c771ef85649f1375f6ab61c48c380c7694b3ad7552af1bdc1ec724890	e35fcde6b1b3f49d1267e3dea8f2a8b4acb5633bc3acb3aefe9bf3e7680 0d58482c771ef85649f1375f6ab61c48c380c7694b3ad7552af1bdc1ec724890 1014e1c1246a6c7cbb519ed711a2168955ee4b4222baae5be911f981088
sha256	0d983d4ee06e08b4e1df021c17792a8352c8ff4b2d3e6ee4f7fe53ce30122d66	8faf48e58dc0680c6b595436dbba01ea3c8fca809858fcfc47d66b56914 0d983d4ee06e08b4e1df021c17792a8352c8ff4b2d3e6ee4f7fe53ce30122d66 0b5800e19bdb4c43ab1469ce88af3d807eaa7620697a4b88368ab6beef0
sha256	1014e1c1246a6c7cbb519ed711a2168955ee4b4222baae5be911f981088604db	82c771ef85649f1375f6ab61c48c380c7694b3ad7552af1bdc1ec724890 1014e1c1246a6c7cbb519ed711a2168955ee4b4222baae5be911f981088604db 15a64cded5bcf3dc911bfeb3a5701a376dea51f9f8530dc0949ba6e6f43
sha256	15a64cded5bcf3dc911bfeb3a5701a376dea51f9f8530dc0949ba6e6f4339cc4	1c1246a6c7cbb519ed711a2168955ee4b4222baae5be911f981088604db 15a64cded5bcf3dc911bfeb3a5701a376dea51f9f8530dc0949ba6e6f4339cc4 18039335deeaf295164f5e24c5afbcc50fa27f2eaf5733be2cf51bcf01f
sha256	18039335deeaf295164f5e24c5afbcc50fa27f2eaf5733be2cf51bcf01f664c3	cded5bcf3dc911bfeb3a5701a376dea51f9f8530dc0949ba6e6f4339cc4 18039335deeaf295164f5e24c5afbcc50fa27f2eaf5733be2cf51bcf01f664c3 Coverage Screenshots of Detection AMP ThreatGrid Win.Ransom
sha256	1ca9f0b54357839435e64dd26d74fb365622b54395f56bf25985db0e7470a355	cc63feec411864cdc27f1d0d186b5173cf443876450e445d47d29b8ada6 1ca9f0b54357839435e64dd26d74fb365622b54395f56bf25985db0e7470a355 68ed0c9628c7764c5b3826309fe5db06a5380e7f1c8ebfb8f62c68d12d1
sha256	1cde4818229f719153565dd84b01d3927928e7a2b6a61684ee932520f55250a9	111df2b4b2f78ec053db14ea5c74965ec13f1902570b06697d71a77dcd7 1cde4818229f719153565dd84b01d3927928e7a2b6a61684ee932520f55250a9 3f9b9062ca3497614ac021146b229b07786774934f98a261547b24df5cc
sha256	2271a2e9d72580e98331792d94fca75e5a0c1dfee958d79652adf9eaab3ee266	7d5db5b5629b5b58534bcf6cd7607f0d015d740ca91ee85ade420b7460f 2271a2e9d72580e98331792d94fca75e5a0c1dfee958d79652adf9eaab3ee266 fc9a9633b8ab0b78a820c74bda57ab608316c81d6ed6b469e7487ce3712
sha256	23045a27de525a0d8c85390414ac4458a32bdbd6f9dc8f0e39b32dad3f89fa55	38c2d8842f3aef8b045e05e28e441b81ea8444dce0b6799f4ec65c70540 23045a27de525a0d8c85390414ac4458a32bdbd6f9dc8f0e39b32dad3f89fa55 55768ac9504b8e612b380fc0984277f0576dd8d129a5363e73d4d2a9baf
sha256	252db718eb383331a34cbe53c0b9889c80452e19bc06007e740eaa23e2ef2a8f	2e9eaeb38e1b30ad44f52c4f8ea3f2e3f522d9b2281ecd3701383b20cfa 252db718eb383331a34cbe53c0b9889c80452e19bc06007e740eaa23e2ef2a8f ca9c3f80a3faaaf001f3fdb37e1cf9abb14a1628be2a9f6ba4e0cc51ed7
sha256	26074772fa68db08f463c66deeabe064bcd9d48032430bbbdf27ffdf8967e8c5	7245025c96d936d14b3b4a718be35ced59558f090e1197adfca5d9573b2 26074772fa68db08f463c66deeabe064bcd9d48032430bbbdf27ffdf8967e8c5 85fa592bf685966d8da1cf72f2c6c092b40664de9c17d9cc4894f8f08e0
sha256	26ef58faf48e58dc0680c6b595436dbba01ea3c8fca809858fcfc47d66b56914	cbe795d7d6a03c4965b2ac7d79544a6772a97ccaca909f66bfe174fa023 26ef58faf48e58dc0680c6b595436dbba01ea3c8fca809858fcfc47d66b56914 0d983d4ee06e08b4e1df021c17792a8352c8ff4b2d3e6ee4f7fe53ce301
sha256	26fbb2aa5a28de5e149e0178dacb964333c852bbca2a1416d860e5edc84cbe04	WINDOWS\WINLOGON.EXE \xk.exe \XK\New Folder.exe File Hashes 26fbb2aa5a28de5e149e0178dacb964333c852bbca2a1416d860e5edc84cbe04 b5e7b1b06efe80a081a2cbdff0fab4539be0797b2351ab4e1b247303586
sha256	27922f495e54bf51cb7329a75c533ca4a1ab8323f1f781dfd027571a37c7485f	f80a3faaaf001f3fdb37e1cf9abb14a1628be2a9f6ba4e0cc51ed708cb9 27922f495e54bf51cb7329a75c533ca4a1ab8323f1f781dfd027571a37c7485f f1dcb8e18a764d300267f2bc0873bf8ec15385cec7ab1d2871e43f238f8
sha256	280a3734efd7e54a32c8719c0efe0365df6b14e8ac54e301736c8ff9829da424	DATA%\[a-z0-9]{8}.exe %APPDATA%\[a-z0-9]{8}.exe File Hashes 280a3734efd7e54a32c8719c0efe0365df6b14e8ac54e301736c8ff9829da424 5283c7d5db5b5629b5b58534bcf6cd7607f0d015d740ca91ee85ade420b
sha256	2948da52a96f06cfc4bfb7d4d079201aaa3ef89de1cc144462973107c4962435	f9539e753fe3a4e0de50bb3c6347ee9928c0f6db33e5f6b6e4af179da0f 2948da52a96f06cfc4bfb7d4d079201aaa3ef89de1cc144462973107c4962435 77ca8909ec71c9086e569cb2acbf4c766dd60f758a5ccc938402d3f1766
sha256	2b3d33238a64134c347db9a3f5b9f0fbecfe62199f081c3c44fb5f1b0948e7cc	6ffbe107318163ed2716231ccf588453308bbcd3c798720e7586c059f99 2b3d33238a64134c347db9a3f5b9f0fbecfe62199f081c3c44fb5f1b0948e7cc e336b8976fb83889c3027ed084a02f9de97f90787304bfa87c58be8dd80
sha256	34c9c0d2fbb403f7e8068ce49071da6dbeadc4ad995101388c9ad092e38f90de	fa6756c252bc89abb88ec9da140cd87937eb5223af05e4e8ef36ec019c9 34c9c0d2fbb403f7e8068ce49071da6dbeadc4ad995101388c9ad092e38f90de Coverage Screenshots of Detection AMP ThreatGrid Win.Trojan
sha256	35b8bf77573eef9acef8b19521e43ce3d440a5e02ccf6deda05ae58eeac3cfe8	Names N/A Files and or directories created N/A File Hashes 35b8bf77573eef9acef8b19521e43ce3d440a5e02ccf6deda05ae58eeac3cfe8 09aa51458f73755e4e58a7d59853f07d685d7e7dc48971117b1e9392a1a
sha256	36890fa6756c252bc89abb88ec9da140cd87937eb5223af05e4e8ef36ec019c9	1b06efe80a081a2cbdff0fab4539be0797b2351ab4e1b247303586d1340 36890fa6756c252bc89abb88ec9da140cd87937eb5223af05e4e8ef36ec019c9 34c9c0d2fbb403f7e8068ce49071da6dbeadc4ad995101388c9ad092e38
sha256	3a5c13ed645ab7571c2a6ba27fd689e748e7d42de35bc076d18ad76070a13d14	0e19bdb4c43ab1469ce88af3d807eaa7620697a4b88368ab6beef098240 3a5c13ed645ab7571c2a6ba27fd689e748e7d42de35bc076d18ad76070a13d14 a6f34f3a70ea64adccfbd983abfebe9dc46741064da0520582b09ce6d6a
sha256	3a8abf2f7fade51114fde4251ff98b23093e07a7545be3568f3da7ba730bb995	70080a9ee615a371a5c18c373bc9a703a9b5dbcac39a2584a328a49bb87 3a8abf2f7fade51114fde4251ff98b23093e07a7545be3568f3da7ba730bb995 3a93346632f58a112708b761154a170be06de1b6a0583f58053cfb1fce0
sha256	3a93346632f58a112708b761154a170be06de1b6a0583f58053cfb1fce09c780	f2f7fade51114fde4251ff98b23093e07a7545be3568f3da7ba730bb995 3a93346632f58a112708b761154a170be06de1b6a0583f58053cfb1fce09c780 6465c7ce45a1430e55cf10e43732892a1f86fa90646adf5628dd6d72dd8