Threat Round Up for December 29
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) CVE-2017-8759 is a code injection flaw (CWE-94) in Microsoft .NET Framework's handling of SOAP WSDL parsing, in which untrusted content referenced by a document or application is parsed and used during object instantiation, allowing attacker-controlled code to run. An attacker triggers it by delivering a specially crafted document — notably a Microsoft Word file referencing a malicious WSDL URL — and gets code execution when the document is opened and .NET downloads and parses the referenced content. Successful exploitation gives the attacker code execution with the privileges of the current user, sufficient to install malware, steal data, or facilitate further compromise. Any Windows system running .NET Framework versions 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, or 4.7 is affected, which at disclosure covered the vast majority of Windows desktops and servers in use. The flaw was a zero-day exploited in the wild at disclosure (September 2017, used in targeted attacks including BlackOasis), is listed in CISA's Known Exploited Vulnerabilities catalog, and public proof-of-concept exploits are available. Do: Apply Microsoft's security updates addressing this vulnerability to all affected .NET Framework versions on Windows endpoints and servers, per the CISA KEV required action. Prioritize user-facing systems that open documents and are internet-exposed, and verify installed .NET Framework versions before and after remediation. As a compensating control, exercise caution with untrusted documents and block or inspect outbound fetches of WSDL references embedded in Office files. | 7.8 | 89% | KEV PoC ×2 |
| masshundreds of millions of Windows devices (affected .NET Framework versions were enabled by default across broadly deployed Windows client and server releases) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | 0i3tenrainy.loan | ain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or director |
| domain | dayi-yc.com | raceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or directories created %ProgramFiles%\Rfjd\conf |
| domain | goochandhousego.pro | k[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or directories created %ProgramFi |
| domain | graceland2017.com | IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Fi |
| domain | jas-pol.com.pl | DFE67F9832960 IP Addresses 89[.]161[.]153[.]74 Domain Names jas-pol[.]com[.]pl Files and or directories created %SystemDrive%\Document |
| domain | kistags.com | Q Mutexes N/A IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.] |
| domain | pragmaticinquiry.org | bKslin0UfIk= IP Addresses 98[.]124[.]252[.]145 Domain Names pragmaticinquiry[.]org Files and or directories created %TEMP%\ASPNETSetup_00001 |
| domain | u.teknik.io | \RUN Value: VRGTQ Mutexes N/A IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan go |
| domain | weekendfakc.top | Registry Keys N/A Mutexes N/A IP Addresses N/A Domain Names weekendfakc[.]top Files and or directories created N/A File Hashes 024782b5 |
| md5 | d0a08beb99882af4b1771426905ee556 | dinit.exe %SystemDrive%\DOCUME~1\ALLUSE~1\clipsrv.exe \TEMP\d0a08beb99882af4b1771426905ee556.exe %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\MICRO |
| sha256 | 024782b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e | fakc[.]top Files and or directories created N/A File Hashes 024782b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca189283 |
| sha256 | 07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6fc2c50 | c672052182d9d10b0d094f07ec67f182939556c90f66236d75d4e795cd6 07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6fc2c50 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S |
| sha256 | 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575 | fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee6 |
| sha256 | 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b | 2b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc56 |
| sha256 | 0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32 | 6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a4819664b790 0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3f |
| sha256 | 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac | 3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166 |
| sha256 | 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4 | 03896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4 33fd94f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56 |
| sha256 | 10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817 | 2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269ca636 10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff4256 |
| sha256 | 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293 | edfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb |
| sha256 | 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a | b5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a |
| sha256 | 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0 | fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0 2d92ee55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54 |
| sha256 | 17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52 | bf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc5f7e0 17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52 e5c95545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95b |
| sha256 | 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527 | c95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc9 |
| sha256 | 1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1 | 4f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56c96bc 1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261 |
| sha256 | 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0 | d54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887 |
| sha256 | 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3 | 1d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c |
| sha256 | 1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18 | 9307649854e520f733df3df40ed960650103a78b8460488319156e059cf 1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18 9ca5fd8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742b |
| sha256 | 1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92 | 7982ceca8711ec2f6c7ad83103db41b5d2c644b9beee07c81f92efa30a5 1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92 377a4c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b770 |
| sha256 | 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353 | 043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7f |
| sha256 | 2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0 | c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d5f8e3 2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0 43d2b149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618 |
| sha256 | 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e | 7c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f94 |
| sha256 | 22ae9fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d | m\SOAPAssembly\http100u4teknik4io0HUKzO4png.pdb File Hashes 22ae9fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a38 |
| sha256 | 22bcff79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad | \DOCUME~1\ADMINI~1\LOCALS~1\Temp\rdwpamlgaz.bat File Hashes 22bcff79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad c06da956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685 |
| sha256 | 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e | c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e954 |
| sha256 | 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9 | ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282b |
| sha256 | 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4 | a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4 305790984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c |
| sha256 | 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd | 26cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c |
| sha256 | 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8 | 1997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8 2ab47d6d82225c62487054db91e804418060b3334531e09d96dc6d3630f |
| sha256 | 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f | 548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac |
| sha256 | 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820 | 67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820 2b24aa417d6ab02fa9f82be1a41bc8c2e5de814057ed76074e2960d74f3 |
| sha256 | 2ab47d6d82225c62487054db91e804418060b3334531e09d96dc6d3630fa54b3 | 92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8 2ab47d6d82225c62487054db91e804418060b3334531e09d96dc6d3630fa54b3 34ae5c841f6e992fe09979fff521d2e8367385260cf73112e79ce656e95 |
| sha256 | 2b24aa417d6ab02fa9f82be1a41bc8c2e5de814057ed76074e2960d74f31d2d1 | cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820 2b24aa417d6ab02fa9f82be1a41bc8c2e5de814057ed76074e2960d74f31d2d1 Coverage Screenshots of Detection AMP ThreatGrid Umbrella D |
| sha256 | 2d92ee55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54aba98 | dde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0 2d92ee55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54aba98 3894ba1250493f0798f9212fc20e96e8114dcc218850fef13979410dc63 |
| sha256 | 305790984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c4e8dc | 3caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4 305790984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c4e8dc 305f855ff8d47be5cc2d57e137a436bb2e17b1783f6cc5b8302c2df56b7 |
| sha256 | 305f855ff8d47be5cc2d57e137a436bb2e17b1783f6cc5b8302c2df56b75afd7 | 0984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c4e8dc 305f855ff8d47be5cc2d57e137a436bb2e17b1783f6cc5b8302c2df56b75afd7 32d85f3dded85d0375965a50991ddb7b608166f51a12b297ae981348119 |
| sha256 | 32d85f3dded85d0375965a50991ddb7b608166f51a12b297ae981348119512da | 55ff8d47be5cc2d57e137a436bb2e17b1783f6cc5b8302c2df56b75afd7 32d85f3dded85d0375965a50991ddb7b608166f51a12b297ae981348119512da 36fc2029280816810324e3be9cf3a4257f0dbb1a8b11eaffdbacdead863 |
| sha256 | 33fd94f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56c96bc | 160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4 33fd94f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56c96bc 1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d79 |
| sha256 | 34ae5c841f6e992fe09979fff521d2e8367385260cf73112e79ce656e952bbb5 | d6d82225c62487054db91e804418060b3334531e09d96dc6d3630fa54b3 34ae5c841f6e992fe09979fff521d2e8367385260cf73112e79ce656e952bbb5 564ace4ef8e2c3aab367969748e02a0dee555733e9085fcc0a86b9f1b70 |
| sha256 | 36fc2029280816810324e3be9cf3a4257f0dbb1a8b11eaffdbacdead863aaf44 | f3dded85d0375965a50991ddb7b608166f51a12b297ae981348119512da 36fc2029280816810324e3be9cf3a4257f0dbb1a8b11eaffdbacdead863aaf44 3abdf9d8249e3cc7507529aec80d93551f1fcd714a61861a69c059662aa |
| sha256 | 377a4c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b7700a0b7 | f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92 377a4c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b7700a0b7 aff6517827847137411d37bafc0aee2915e87b9d2494493c1723634ba10 |
| sha256 | 3894ba1250493f0798f9212fc20e96e8114dcc218850fef13979410dc63affba | e55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54aba98 3894ba1250493f0798f9212fc20e96e8114dcc218850fef13979410dc63affba 3a26d63160a43b64ee4f4adba0a5c19cb3ee6db2dc44c0ffb7b72b62154 |
| sha256 | 38c7c22fd8526dd108422befd6fd38212ef45fb30db3272d5016fa942cd2323d | 17827847137411d37bafc0aee2915e87b9d2494493c1723634ba1014792 38c7c22fd8526dd108422befd6fd38212ef45fb30db3272d5016fa942cd2323d 3ab0d96b041b994d6f32a4351120b822d39b681d2c5133f12bb507fe2fb |
| sha256 | 3a26d63160a43b64ee4f4adba0a5c19cb3ee6db2dc44c0ffb7b72b621548c4f8 | a1250493f0798f9212fc20e96e8114dcc218850fef13979410dc63affba 3a26d63160a43b64ee4f4adba0a5c19cb3ee6db2dc44c0ffb7b72b621548c4f8 4b4efd1527b404064604707dbf7a143745d764629d6cfcc05a6c204b662 |
| sha256 | 3ab0d96b041b994d6f32a4351120b822d39b681d2c5133f12bb507fe2fb66e19 | 22fd8526dd108422befd6fd38212ef45fb30db3272d5016fa942cd2323d 3ab0d96b041b994d6f32a4351120b822d39b681d2c5133f12bb507fe2fb66e19 ca8eb5e89426e3c6771a72cffac6998abce9ca2a6011207691e47df1738 |
| sha256 | 3abdf9d8249e3cc7507529aec80d93551f1fcd714a61861a69c059662aa39e9f | 029280816810324e3be9cf3a4257f0dbb1a8b11eaffdbacdead863aaf44 3abdf9d8249e3cc7507529aec80d93551f1fcd714a61861a69c059662aa39e9f 495b93c1a9940e94c14063b1e52877864d54fb544a3a32e923b0530cb03 |
| sha256 | 3e5a5c672052182d9d10b0d094f07ec67f182939556c90f66236d75d4e795cd6 | s\injectDll64_configs\dinj %TEMP%\Wn-lbzpms.exe File Hashes 3e5a5c672052182d9d10b0d094f07ec67f182939556c90f66236d75d4e795cd6 07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6f |
| sha256 | 43d2b149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618865d9 | 84585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0 43d2b149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618865d9 9e7ae2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269 |
| sha256 | 495b93c1a9940e94c14063b1e52877864d54fb544a3a32e923b0530cb03c96cf | 9d8249e3cc7507529aec80d93551f1fcd714a61861a69c059662aa39e9f 495b93c1a9940e94c14063b1e52877864d54fb544a3a32e923b0530cb03c96cf 4c04d8aeebdd0eb1747a9a66b10e4681328a03edcbcbd0e9921c4a74367 |
| sha256 | 4b4efd1527b404064604707dbf7a143745d764629d6cfcc05a6c204b66238db8 | 63160a43b64ee4f4adba0a5c19cb3ee6db2dc44c0ffb7b72b621548c4f8 4b4efd1527b404064604707dbf7a143745d764629d6cfcc05a6c204b66238db8 56b951fe25e1d0266dd49eba6b127efe63c49d71063533cee2ba3bb7eac |
| sha256 | 4c04d8aeebdd0eb1747a9a66b10e4681328a03edcbcbd0e9921c4a74367bbd08 | 3c1a9940e94c14063b1e52877864d54fb544a3a32e923b0530cb03c96cf 4c04d8aeebdd0eb1747a9a66b10e4681328a03edcbcbd0e9921c4a74367bbd08 580b05987531aa4ef4bed150bd51fdbbcad5f95abb63e8439e3d4bb07eb |
| sha256 | 564ace4ef8e2c3aab367969748e02a0dee555733e9085fcc0a86b9f1b70fb7b3 | c841f6e992fe09979fff521d2e8367385260cf73112e79ce656e952bbb5 564ace4ef8e2c3aab367969748e02a0dee555733e9085fcc0a86b9f1b70fb7b3 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W |
| sha256 | 56b951fe25e1d0266dd49eba6b127efe63c49d71063533cee2ba3bb7eac08744 | d1527b404064604707dbf7a143745d764629d6cfcc05a6c204b66238db8 56b951fe25e1d0266dd49eba6b127efe63c49d71063533cee2ba3bb7eac08744 56ede7ef1d1e5216231c847eead200bc8b5c5f8ef7ac8389b7dc5f069b3 |
| sha256 | 56ede7ef1d1e5216231c847eead200bc8b5c5f8ef7ac8389b7dc5f069b37831d | 1fe25e1d0266dd49eba6b127efe63c49d71063533cee2ba3bb7eac08744 56ede7ef1d1e5216231c847eead200bc8b5c5f8ef7ac8389b7dc5f069b37831d 650abb87b45b41a344c677c0d6bb6a13cbe9a66785b87a0f2ff3fb37822 |
| sha256 | 580b05987531aa4ef4bed150bd51fdbbcad5f95abb63e8439e3d4bb07eb68598 | 8aeebdd0eb1747a9a66b10e4681328a03edcbcbd0e9921c4a74367bbd08 580b05987531aa4ef4bed150bd51fdbbcad5f95abb63e8439e3d4bb07eb68598 5c4d5f6d7d0a8d4e805c1341cadf76a924aa2fe6437d432d96f103c4319 |
| sha256 | 5af23d9dedc83e1fe8c808fe62d858767dd95f2b9402fa785072cc7247a2e4c6 | add0d36be4543317c4d14823e2cb380f7b07bacc1f893ec86bdd0b04468 5af23d9dedc83e1fe8c808fe62d858767dd95f2b9402fa785072cc7247a2e4c6 bf828a8f3fb1a27532aa9f3fb0383a1ce3418f7dd52cefa4264ab2e3e94 |
| sha256 | 5c4d5f6d7d0a8d4e805c1341cadf76a924aa2fe6437d432d96f103c4319e84c2 | 5987531aa4ef4bed150bd51fdbbcad5f95abb63e8439e3d4bb07eb68598 5c4d5f6d7d0a8d4e805c1341cadf76a924aa2fe6437d432d96f103c4319e84c2 6e35534f8b79187dbe2fbdd1b0a21b03752a89df5981cb6fb89154eb7b3 |
| sha256 | 64fac9307649854e520f733df3df40ed960650103a78b8460488319156e059cf | 377f58643e454ef33f21dc65f696567bf8700ae120caac5086f85bfeace 64fac9307649854e520f733df3df40ed960650103a78b8460488319156e059cf 1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac088 |
| sha256 | 650abb87b45b41a344c677c0d6bb6a13cbe9a66785b87a0f2ff3fb378220448c | 7ef1d1e5216231c847eead200bc8b5c5f8ef7ac8389b7dc5f069b37831d 650abb87b45b41a344c677c0d6bb6a13cbe9a66785b87a0f2ff3fb378220448c 72399fbb24239a2e1897132ad0e3270103c727253275009e010c74a94f3 |
| sha256 | 6d1b40fbdcad0c96c687f661469e39b7b10a0b083a9ea3c9f6bb959c284df149 | 545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95beb382 6d1b40fbdcad0c96c687f661469e39b7b10a0b083a9ea3c9f6bb959c284df149 7d1ae051d633a3ed3c0991aaa3ed63357804a80e67dd19ae5deab71e525 |
| sha256 | 6e35534f8b79187dbe2fbdd1b0a21b03752a89df5981cb6fb89154eb7b34a087 | f6d7d0a8d4e805c1341cadf76a924aa2fe6437d432d96f103c4319e84c2 6e35534f8b79187dbe2fbdd1b0a21b03752a89df5981cb6fb89154eb7b34a087 8f36a3ebcb2714d7f6d99d8d0672bcdf16980da788331953cba52c21fde |
| sha256 | 6f15dc426b87da591d0a2d4965558a22857e2b1c8e1e6fdfe9c36c8a4b50a99c | fabc1451dce556864690cc55e70c8236db2a7b01b8726af0a5700ebafea 6f15dc426b87da591d0a2d4965558a22857e2b1c8e1e6fdfe9c36c8a4b50a99c Coverage Screenshots of Detection AMP ThreatGrid Screenshot |
| sha256 | 72399fbb24239a2e1897132ad0e3270103c727253275009e010c74a94f36700d | b87b45b41a344c677c0d6bb6a13cbe9a66785b87a0f2ff3fb378220448c 72399fbb24239a2e1897132ad0e3270103c727253275009e010c74a94f36700d 7b58861aab0a53cac5ac90af09723703fb47fda584fc66212ff663c52a8 |
| sha256 | 78286db82473a9f1eddba51f39333a77c2b30fb582e9fe3e71d2924e060eb273 | d8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742bf1345 78286db82473a9f1eddba51f39333a77c2b30fb582e9fe3e71d2924e060eb273 7e888fabc1451dce556864690cc55e70c8236db2a7b01b8726af0a5700e |
| sha256 | 799e5b77de09f7971f0187b69266e45f70e0cda170c615c604806ec2444ab89a | 051d633a3ed3c0991aaa3ed63357804a80e67dd19ae5deab71e525947a6 799e5b77de09f7971f0187b69266e45f70e0cda170c615c604806ec2444ab89a 910b590e28bc72bc14c05d47a026ed56928ea8b6608f626555d955beccb |
| sha256 | 7b58861aab0a53cac5ac90af09723703fb47fda584fc66212ff663c52a8150a4 | fbb24239a2e1897132ad0e3270103c727253275009e010c74a94f36700d 7b58861aab0a53cac5ac90af09723703fb47fda584fc66212ff663c52a8150a4 7ed5fec1aabe2e91524a9a84d2c4f4d29a8da5777289023c40ffbcc7810 |
| sha256 | 7d1ae051d633a3ed3c0991aaa3ed63357804a80e67dd19ae5deab71e525947a6 | 0fbdcad0c96c687f661469e39b7b10a0b083a9ea3c9f6bb959c284df149 7d1ae051d633a3ed3c0991aaa3ed63357804a80e67dd19ae5deab71e525947a6 799e5b77de09f7971f0187b69266e45f70e0cda170c615c604806ec2444 |
| sha256 | 7d326add0d36be4543317c4d14823e2cb380f7b07bacc1f893ec86bdd0b04468 | 90e28bc72bc14c05d47a026ed56928ea8b6608f626555d955beccb719c8 7d326add0d36be4543317c4d14823e2cb380f7b07bacc1f893ec86bdd0b04468 5af23d9dedc83e1fe8c808fe62d858767dd95f2b9402fa785072cc7247a |
| sha256 | 7e888fabc1451dce556864690cc55e70c8236db2a7b01b8726af0a5700ebafea | db82473a9f1eddba51f39333a77c2b30fb582e9fe3e71d2924e060eb273 7e888fabc1451dce556864690cc55e70c8236db2a7b01b8726af0a5700ebafea 6f15dc426b87da591d0a2d4965558a22857e2b1c8e1e6fdfe9c36c8a4b5 |
| sha256 | 7ed5fec1aabe2e91524a9a84d2c4f4d29a8da5777289023c40ffbcc7810b2ee8 | 61aab0a53cac5ac90af09723703fb47fda584fc66212ff663c52a8150a4 7ed5fec1aabe2e91524a9a84d2c4f4d29a8da5777289023c40ffbcc7810b2ee8 84593a125442a9541b2992a2934f4db5cbe1a87b6e5f5edd17982e67766 |
| sha256 | 84593a125442a9541b2992a2934f4db5cbe1a87b6e5f5edd17982e677667c53f | ec1aabe2e91524a9a84d2c4f4d29a8da5777289023c40ffbcc7810b2ee8 84593a125442a9541b2992a2934f4db5cbe1a87b6e5f5edd17982e677667c53f 9f9217702cc1d59edc29007f745eeec78118941f3d4f99b2f664a967786 |
| sha256 | 8957b057803dd6369f877c359b96423b61129fa3f68257c272644e1d56c7c667 | 5e89426e3c6771a72cffac6998abce9ca2a6011207691e47df1738cdeb6 8957b057803dd6369f877c359b96423b61129fa3f68257c272644e1d56c7c667 c4471377f58643e454ef33f21dc65f696567bf8700ae120caac5086f85b |
| sha256 | 8f36a3ebcb2714d7f6d99d8d0672bcdf16980da788331953cba52c21fde64efb | 34f8b79187dbe2fbdd1b0a21b03752a89df5981cb6fb89154eb7b34a087 8f36a3ebcb2714d7f6d99d8d0672bcdf16980da788331953cba52c21fde64efb 962beb562acef288c5ef09f14e366d7ff3f51a00dd28b3dc5c0e388c92d |
| sha256 | 910b590e28bc72bc14c05d47a026ed56928ea8b6608f626555d955beccb719c8 | b77de09f7971f0187b69266e45f70e0cda170c615c604806ec2444ab89a 910b590e28bc72bc14c05d47a026ed56928ea8b6608f626555d955beccb719c8 7d326add0d36be4543317c4d14823e2cb380f7b07bacc1f893ec86bdd0b |
| sha256 | 962beb562acef288c5ef09f14e366d7ff3f51a00dd28b3dc5c0e388c92d3c0a2 | 3ebcb2714d7f6d99d8d0672bcdf16980da788331953cba52c21fde64efb 962beb562acef288c5ef09f14e366d7ff3f51a00dd28b3dc5c0e388c92d3c0a2 c2f482372523031b880b7a4f1909b30b5aa20304d0a691309484ad49a0c |
| sha256 | 9b48b6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a4819664b790 | 47978b7d8bed904ccadbcc49f184bc16e872f22d7b53b1030bc22ebd794 9b48b6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a4819664b790 0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b24139 |
| sha256 | 9ca5fd8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742bf1345 | 9b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18 9ca5fd8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742bf1345 78286db82473a9f1eddba51f39333a77c2b30fb582e9fe3e71d2924e060 |
| sha256 | 9e7ae2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269ca636 | 149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618865d9 9e7ae2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269ca636 10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f |
| sha256 | 9f9217702cc1d59edc29007f745eeec78118941f3d4f99b2f664a9677867ffb6 | a125442a9541b2992a2934f4db5cbe1a87b6e5f5edd17982e677667c53f 9f9217702cc1d59edc29007f745eeec78118941f3d4f99b2f664a9677867ffb6 b28a3bd9be8ec8d9dec980896002d84e2544acb2625e1acbbe8351d57b2 |
| sha256 | a27376262110767a28e376b723caa46d3cc50d33da60029df8e7af024ff67be9 | d44f682104d536c60832d2064f71d3261ffbf0e1555c236a36b505619d3 a27376262110767a28e376b723caa46d3cc50d33da60029df8e7af024ff67be9 f1b2bbf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc |
| sha256 | a3940c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d5f8e3 | 05eb68ce4ef44776de0ad2b3c6181ad6a99813612a1ce3cc8b453359482 a3940c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d5f8e3 2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4 |
| sha256 | a3f68a31db23b9c7312219990bfe27bf9bb7c158fde4200c0af7a985bd7ac97d | \Local\Adobe\Acrobat\9.0\Updater\Read___ME.html File Hashes a3f68a31db23b9c7312219990bfe27bf9bb7c158fde4200c0af7a985bd7ac97d d4a8da30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c |
| sha256 | a9db16baffc0b92aacae6647952fc2d32673998fc035493d50d32bad5bceb516 | a30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c111ef a9db16baffc0b92aacae6647952fc2d32673998fc035493d50d32bad5bceb516 f07f747978b7d8bed904ccadbcc49f184bc16e872f22d7b53b1030bc22e |
| sha256 | aff6517827847137411d37bafc0aee2915e87b9d2494493c1723634ba1014792 | c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b7700a0b7 aff6517827847137411d37bafc0aee2915e87b9d2494493c1723634ba1014792 38c7c22fd8526dd108422befd6fd38212ef45fb30db3272d5016fa942cd |
| sha256 | b010ae9122a8651be194c5bc3d49540d51287040f1a1f066e193835f942277a9 | f0be76f80faaa683ef580e3f018e1e0108e5b4457bad379e99dda2c627f b010ae9122a8651be194c5bc3d49540d51287040f1a1f066e193835f942277a9 d775f05eb68ce4ef44776de0ad2b3c6181ad6a99813612a1ce3cc8b4533 |
| sha256 | b1da876da56ba09770d594765727d167bf1a655247f094360e032a35d3d41461 | 76dec96cc9d530dd6cb64bdd743a115a12a7b03e41f7ec737e4d80b6850 b1da876da56ba09770d594765727d167bf1a655247f094360e032a35d3d41461 b82ebd17236c41d9e457f640a2871695326ef8014ebd71b7a5f37d8b2c3 |
| sha256 | b28a3bd9be8ec8d9dec980896002d84e2544acb2625e1acbbe8351d57b2b6cfc | 7702cc1d59edc29007f745eeec78118941f3d4f99b2f664a9677867ffb6 b28a3bd9be8ec8d9dec980896002d84e2544acb2625e1acbbe8351d57b2b6cfc c0ed86aab56032d1ba313aa6b5eaabcd687caa28937f56f23832206f81e |
| sha256 | b3f5ad44f682104d536c60832d2064f71d3261ffbf0e1555c236a36b505619d3 | d17236c41d9e457f640a2871695326ef8014ebd71b7a5f37d8b2c3a4522 b3f5ad44f682104d536c60832d2064f71d3261ffbf0e1555c236a36b505619d3 a27376262110767a28e376b723caa46d3cc50d33da60029df8e7af024ff |
| sha256 | b82ebd17236c41d9e457f640a2871695326ef8014ebd71b7a5f37d8b2c3a4522 | 76da56ba09770d594765727d167bf1a655247f094360e032a35d3d41461 b82ebd17236c41d9e457f640a2871695326ef8014ebd71b7a5f37d8b2c3a4522 b3f5ad44f682104d536c60832d2064f71d3261ffbf0e1555c236a36b505 |
| sha256 | b95a5e8f1dc23677e9e700b44d014aeee127869e46af6a674f93d34da3c606d0 | 790645ae7404cd3c746b9a26bcd667b6c1c45f727e504d0833d04726488 b95a5e8f1dc23677e9e700b44d014aeee127869e46af6a674f93d34da3c606d0 f3ee9f0be76f80faaa683ef580e3f018e1e0108e5b4457bad379e99dda2 |
| sha256 | bf828a8f3fb1a27532aa9f3fb0383a1ce3418f7dd52cefa4264ab2e3e941e8d9 | d9dedc83e1fe8c808fe62d858767dd95f2b9402fa785072cc7247a2e4c6 bf828a8f3fb1a27532aa9f3fb0383a1ce3418f7dd52cefa4264ab2e3e941e8d9 Coverage Screenshots of Detection AMP ThreatGrid |
| sha256 | c06da956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685f6c4f | f79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad c06da956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685f6c4f e474e51a6f29b9e32702445797ef4baaa96b1e30fa3f212ae2953bbb843 |
| sha256 | c0ed86aab56032d1ba313aa6b5eaabcd687caa28937f56f23832206f81ec1271 | bd9be8ec8d9dec980896002d84e2544acb2625e1acbbe8351d57b2b6cfc c0ed86aab56032d1ba313aa6b5eaabcd687caa28937f56f23832206f81ec1271 c5b450ac63234f3d23ace0379486a33788187f14b47801971ad96ace76f |
| sha256 | c2f482372523031b880b7a4f1909b30b5aa20304d0a691309484ad49a0c451d5 | b562acef288c5ef09f14e366d7ff3f51a00dd28b3dc5c0e388c92d3c0a2 c2f482372523031b880b7a4f1909b30b5aa20304d0a691309484ad49a0c451d5 cab8fcbe8bce311464418e2fcd05e55353255c511e698726e009f075de8 |
| sha256 | c4471377f58643e454ef33f21dc65f696567bf8700ae120caac5086f85bfeace | 057803dd6369f877c359b96423b61129fa3f68257c272644e1d56c7c667 c4471377f58643e454ef33f21dc65f696567bf8700ae120caac5086f85bfeace 64fac9307649854e520f733df3df40ed960650103a78b8460488319156e |
| sha256 | c5b450ac63234f3d23ace0379486a33788187f14b47801971ad96ace76f85410 | 6aab56032d1ba313aa6b5eaabcd687caa28937f56f23832206f81ec1271 c5b450ac63234f3d23ace0379486a33788187f14b47801971ad96ace76f85410 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W |
| sha256 | c9329790645ae7404cd3c746b9a26bcd667b6c1c45f727e504d0833d04726488 | 51a6f29b9e32702445797ef4baaa96b1e30fa3f212ae2953bbb843a559b c9329790645ae7404cd3c746b9a26bcd667b6c1c45f727e504d0833d04726488 b95a5e8f1dc23677e9e700b44d014aeee127869e46af6a674f93d34da3c |
| sha256 | ca8eb5e89426e3c6771a72cffac6998abce9ca2a6011207691e47df1738cdeb6 | 96b041b994d6f32a4351120b822d39b681d2c5133f12bb507fe2fb66e19 ca8eb5e89426e3c6771a72cffac6998abce9ca2a6011207691e47df1738cdeb6 8957b057803dd6369f877c359b96423b61129fa3f68257c272644e1d56c |
| sha256 | cab8fcbe8bce311464418e2fcd05e55353255c511e698726e009f075de82e2ea | 2372523031b880b7a4f1909b30b5aa20304d0a691309484ad49a0c451d5 cab8fcbe8bce311464418e2fcd05e55353255c511e698726e009f075de82e2ea ce5d33fb70fc7834d8faa7749d5cedbcb6b0958105ebe94633e2daba897 |
| sha256 | cd32c7982ceca8711ec2f6c7ad83103db41b5d2c644b9beee07c81f92efa30a5 | e%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nOowsYQI.bat File Hashes cd32c7982ceca8711ec2f6c7ad83103db41b5d2c644b9beee07c81f92efa30a5 1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc63 |
| sha256 | ce5d33fb70fc7834d8faa7749d5cedbcb6b0958105ebe94633e2daba897612ef | cbe8bce311464418e2fcd05e55353255c511e698726e009f075de82e2ea ce5d33fb70fc7834d8faa7749d5cedbcb6b0958105ebe94633e2daba897612ef d18256e9f4062259e941028c531c5219b63446a35c524ef00554c69de21 |
| sha256 | d18256e9f4062259e941028c531c5219b63446a35c524ef00554c69de2110e98 | 3fb70fc7834d8faa7749d5cedbcb6b0958105ebe94633e2daba897612ef d18256e9f4062259e941028c531c5219b63446a35c524ef00554c69de2110e98 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S |
| sha256 | d4a8da30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c111ef | a31db23b9c7312219990bfe27bf9bb7c158fde4200c0af7a985bd7ac97d d4a8da30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c111ef a9db16baffc0b92aacae6647952fc2d32673998fc035493d50d32bad5bc |
| sha256 | d775f05eb68ce4ef44776de0ad2b3c6181ad6a99813612a1ce3cc8b453359482 | e9122a8651be194c5bc3d49540d51287040f1a1f066e193835f942277a9 d775f05eb68ce4ef44776de0ad2b3c6181ad6a99813612a1ce3cc8b453359482 a3940c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d |
| sha256 | e474e51a6f29b9e32702445797ef4baaa96b1e30fa3f212ae2953bbb843a559b | 956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685f6c4f e474e51a6f29b9e32702445797ef4baaa96b1e30fa3f212ae2953bbb843a559b c9329790645ae7404cd3c746b9a26bcd667b6c1c45f727e504d0833d047 |
| sha256 | e5c95545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95beb382 | d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52 e5c95545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95beb382 6d1b40fbdcad0c96c687f661469e39b7b10a0b083a9ea3c9f6bb959c284 |
| sha256 | ec3075ac9775e3c41bc8227a00ef76905bbd96a62b813c99f277865ff353c5ce | \Application Data\Microsoft\esentutl.exe (copy) File Hashes ec3075ac9775e3c41bc8227a00ef76905bbd96a62b813c99f277865ff353c5ce f4b6b76dec96cc9d530dd6cb64bdd743a115a12a7b03e41f7ec737e4d80 |
| sha256 | f07f747978b7d8bed904ccadbcc49f184bc16e872f22d7b53b1030bc22ebd794 | 6baffc0b92aacae6647952fc2d32673998fc035493d50d32bad5bceb516 f07f747978b7d8bed904ccadbcc49f184bc16e872f22d7b53b1030bc22ebd794 9b48b6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a481966 |
| sha256 | f1b2bbf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc5f7e0 | 6262110767a28e376b723caa46d3cc50d33da60029df8e7af024ff67be9 f1b2bbf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc5f7e0 17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f798 |
| sha256 | f3ee9f0be76f80faaa683ef580e3f018e1e0108e5b4457bad379e99dda2c627f | e8f1dc23677e9e700b44d014aeee127869e46af6a674f93d34da3c606d0 f3ee9f0be76f80faaa683ef580e3f018e1e0108e5b4457bad379e99dda2c627f b010ae9122a8651be194c5bc3d49540d51287040f1a1f066e193835f942 |
| sha256 | f4b6b76dec96cc9d530dd6cb64bdd743a115a12a7b03e41f7ec737e4d80b6850 | 5ac9775e3c41bc8227a00ef76905bbd96a62b813c99f277865ff353c5ce f4b6b76dec96cc9d530dd6cb64bdd743a115a12a7b03e41f7ec737e4d80b6850 b1da876da56ba09770d594765727d167bf1a655247f094360e032a35d3d |
Full article952 words · extracted from blog.talosintelligence.com · click to collapse
Friday, January 5, 2018 14:46
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 29 and January 05. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
The most prevalent threats highlighted in this round up are:
- Doc.Downloader.Trickbot-6412300-1
Office Macro Downloader
This downloader was submitted to ThreatGrid more than 50 times on December 26. This office document downloads a multipayload Trickbot loader. This post-Christmas gift is not something that somebody just back from the holiday wants to open. - Doc.Dropper.Agent-6412231-0
Office Macro Downloader
This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable. The sample was unable to download the next stage so no further analysis is available. - Doc.Macro.Necurs-6412436-0
Downloader
Another wave of OLE based downloaders spiked in prevalence just prior to the new year. The samples use obfuscated VBA macros to download various malware families distributed for the Necurs botnet, including Locky. - Ppt.Downloader.CVE_2017_8759-6413368-0
Office Macro Downloader
These PowerPoint files contain an XML, located in ppt/slides/_rels/slide1.xml.rels, with a malicious SOAP WSDL definition that leverages CVE-2017-8759. If the file is saved as a PPSX, the slideshow will automatically start on opening, triggering the malicious code. - Win.Ransomware.PolyRansom-6413978-0
Ransomware
PolyRansom variants continue to thrive in 2018. PolyRansom is polymorphic ransomware that spreads by infecting other executables. It gains persistence through an installed service, and run keys added to the registry. Its primary infection vectors are share network drives, removable media, and email. - Win.Trojan.Generic-6414413-0
Trojan
This cluster provides generic detection for the Emotet Trojan downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to by pass antivirus products. - Win.Trojan.Multi-6413508-0
Trojan
This trojan will potentially connect to one or more servers to receive instructions and download additional malware.
Threats
Doc.Downloader.Trickbot-6412300-1
Indicators of Compromise
Registry Keys
- N/A Mutexes
- 316D1C7871E00
- Global\552FFA80-3393-423d-8671-7BA046BB5906
- \BaseNamedObjects\C1A8DFE67F9832960 IP Addresses
- 89[.]161[.]153[.]74 Domain Names
- jas-pol[.]com[.]pl Files and or directories created
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\Inue8.bat
- %AppData%\localservice\Wn-lbzpms.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\mo-r.exe
- %AppData%\localservice\mo-r.exe
- %TEMP%\Ecmjtqf.bat
- %AppData%\localservice\Modules\injectDll64_configs\sinj
- %AppData%\localservice\Modules\injectDll64_configs\dinj
- %TEMP%\Wn-lbzpms.exe File Hashes
- 3e5a5c672052182d9d10b0d094f07ec67f182939556c90f66236d75d4e795cd6
- 07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6fc2c50
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Screenshot
Doc.Dropper.Agent-6412231-0
Indicators of Compromise
Registry Keys
- N/A Mutexes
- N/A IP Addresses
- N/A Domain Names
- weekendfakc[.]top Files and or directories created
- N/A File Hashes
- 024782b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e
- 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b
- 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a
- 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527
- 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e
- 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e
- 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd
- 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f
- 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820
- 2b24aa417d6ab02fa9f82be1a41bc8c2e5de814057ed76074e2960d74f31d2d1
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Doc.Macro.Necurs-6412436-0
Indicators of Compromise
Registry Keys
- <HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce Mutexes
- Groove:PathMutex:tzanqCjN6dCs1QGzbKslin0UfIk= IP Addresses
- 98[.]124[.]252[.]145 Domain Names
- pragmaticinquiry[.]org Files and or directories created
- %TEMP%\ASPNETSetup_00001.log..doc
- \Users\Administrator\AppData\Local\Adobe\Acrobat\9.0\Updater\updater.log..doc
- \Users\Administrator\Read___ME.html
- %TEMP%\ASPNETSetup.log..doc
- \Users\Administrator\AppData\Local\Adobe\Acrobat\9.0\Updater\Read___ME.html File Hashes
- a3f68a31db23b9c7312219990bfe27bf9bb7c158fde4200c0af7a985bd7ac97d
- d4a8da30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c111ef
- a9db16baffc0b92aacae6647952fc2d32673998fc035493d50d32bad5bceb516
- f07f747978b7d8bed904ccadbcc49f184bc16e872f22d7b53b1030bc22ebd794
- 9b48b6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a4819664b790
- 0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32
- 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac
- 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0
- 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4
- 305790984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c4e8dc
- 305f855ff8d47be5cc2d57e137a436bb2e17b1783f6cc5b8302c2df56b75afd7
- 32d85f3dded85d0375965a50991ddb7b608166f51a12b297ae981348119512da
- 36fc2029280816810324e3be9cf3a4257f0dbb1a8b11eaffdbacdead863aaf44
- 3abdf9d8249e3cc7507529aec80d93551f1fcd714a61861a69c059662aa39e9f
- 495b93c1a9940e94c14063b1e52877864d54fb544a3a32e923b0530cb03c96cf
- 4c04d8aeebdd0eb1747a9a66b10e4681328a03edcbcbd0e9921c4a74367bbd08
- 580b05987531aa4ef4bed150bd51fdbbcad5f95abb63e8439e3d4bb07eb68598
- 5c4d5f6d7d0a8d4e805c1341cadf76a924aa2fe6437d432d96f103c4319e84c2
- 6e35534f8b79187dbe2fbdd1b0a21b03752a89df5981cb6fb89154eb7b34a087
- 8f36a3ebcb2714d7f6d99d8d0672bcdf16980da788331953cba52c21fde64efb
- 962beb562acef288c5ef09f14e366d7ff3f51a00dd28b3dc5c0e388c92d3c0a2
- c2f482372523031b880b7a4f1909b30b5aa20304d0a691309484ad49a0c451d5
- cab8fcbe8bce311464418e2fcd05e55353255c511e698726e009f075de82e2ea
- ce5d33fb70fc7834d8faa7749d5cedbcb6b0958105ebe94633e2daba897612ef
- d18256e9f4062259e941028c531c5219b63446a35c524ef00554c69de2110e98
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Screenshot
Ppt.Downloader.CVE_2017_8759-6413368-0
Indicators of Compromise
Registry Keys
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: VRGTQ Mutexes
- N/A IP Addresses
- N/A Domain Names
- u[.]teknik[.]io
- kistags[.]com
- graceland2017[.]com
- 0i3tenrainy[.]loan
- goochandhousego[.]pro
- dayi-yc[.]com Files and or directories created
- %ProgramFiles%\Rfjd\confighbch.exe
- %TEMP%\dsruxkfs.0.cs
- %TEMP%\dsruxkfs.cmdline
- %TEMP%\dsruxkfs.err
- %TEMP%\i02bp4bi.0.cs
- %TEMP%\i02bp4bi.cmdline
- %TEMP%\i02bp4bi.dll
- %TEMP%\i02bp4bi.err
- %TEMP%\tmp95D4.exe
- %TEMP%\tmp970E.exe
- %AppData%\Roaming\982PQQP9\982logrc.ini
- %TEMP%\dsruxkfs.out
- %TEMP%\svchost.exe
- %AppData%\Roaming\982PQQP9\982logim.jpeg
- %AppData%\Roaming\982PQQP9\982logrv.ini
- %AppData%\Roaming\tmp.exe
- %SystemRoot%\SysWOW64\com\SOAPAssembly\http100u4teknik4io0HUKzO4png.dll
- %SystemRoot%\SysWOW64\com\SOAPAssembly\http100u4teknik4io0HUKzO4png.pdb File Hashes
- 22ae9fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d
- 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0
- 2d92ee55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54aba98
- 3894ba1250493f0798f9212fc20e96e8114dcc218850fef13979410dc63affba
- 3a26d63160a43b64ee4f4adba0a5c19cb3ee6db2dc44c0ffb7b72b621548c4f8
- 4b4efd1527b404064604707dbf7a143745d764629d6cfcc05a6c204b66238db8
- 56b951fe25e1d0266dd49eba6b127efe63c49d71063533cee2ba3bb7eac08744
- 56ede7ef1d1e5216231c847eead200bc8b5c5f8ef7ac8389b7dc5f069b37831d
- 650abb87b45b41a344c677c0d6bb6a13cbe9a66785b87a0f2ff3fb378220448c
- 72399fbb24239a2e1897132ad0e3270103c727253275009e010c74a94f36700d
- 7b58861aab0a53cac5ac90af09723703fb47fda584fc66212ff663c52a8150a4
- 7ed5fec1aabe2e91524a9a84d2c4f4d29a8da5777289023c40ffbcc7810b2ee8
- 84593a125442a9541b2992a2934f4db5cbe1a87b6e5f5edd17982e677667c53f
- 9f9217702cc1d59edc29007f745eeec78118941f3d4f99b2f664a9677867ffb6
- b28a3bd9be8ec8d9dec980896002d84e2544acb2625e1acbbe8351d57b2b6cfc
- c0ed86aab56032d1ba313aa6b5eaabcd687caa28937f56f23832206f81ec1271
- c5b450ac63234f3d23ace0379486a33788187f14b47801971ad96ace76f85410
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Win.Ransomware.PolyRansom-6413978-0
Indicators of Compromise
Registry Keys
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\ZSCGIYAL
- Value: Type
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: FacAQkYU.exe
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\ZSCGIYAL
- Value: Start
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\zscgIYAL Mutexes
- \BaseNamedObjects\mMkUAokE
- Âë@
- MkUUAgkc1
- ºë@
- poAUcoMg1
- \BaseNamedObjects\lEwoEIAg
- \BaseNamedObjects\sgwQgcAM0
- ²ë@
- fusUgwwA
- oskQowMk
- ¢ë@
- \BaseNamedObjects\hYsQEUYI0
- \BaseNamedObjects\ @
- ªë@ IP Addresses
- N/A Domain Names
- N/A Files and or directories created
- %SystemDrive%\Documents and Settings\All Users\Lgwg.txt
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nOowsYQI.bat File Hashes
- cd32c7982ceca8711ec2f6c7ad83103db41b5d2c644b9beee07c81f92efa30a5
- 1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92
- 377a4c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b7700a0b7
- aff6517827847137411d37bafc0aee2915e87b9d2494493c1723634ba1014792
- 38c7c22fd8526dd108422befd6fd38212ef45fb30db3272d5016fa942cd2323d
- 3ab0d96b041b994d6f32a4351120b822d39b681d2c5133f12bb507fe2fb66e19
- ca8eb5e89426e3c6771a72cffac6998abce9ca2a6011207691e47df1738cdeb6
- 8957b057803dd6369f877c359b96423b61129fa3f68257c272644e1d56c7c667
- c4471377f58643e454ef33f21dc65f696567bf8700ae120caac5086f85bfeace
- 64fac9307649854e520f733df3df40ed960650103a78b8460488319156e059cf
- 1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18
- 9ca5fd8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742bf1345
- 78286db82473a9f1eddba51f39333a77c2b30fb582e9fe3e71d2924e060eb273
- 7e888fabc1451dce556864690cc55e70c8236db2a7b01b8726af0a5700ebafea
- 6f15dc426b87da591d0a2d4965558a22857e2b1c8e1e6fdfe9c36c8a4b50a99c
Coverage
Screenshots of Detection AMP
ThreatGrid
Screenshot
Win.Trojan.Generic-6414413-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: internat.exe
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: Microsoft Windows Manager
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
- Value: Start
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: Microsoft Windows Manager
- <HKU>\Software\Microsoft\Windows\ShellNoRoam\MUICache
- <HKU>\Software\Microsoft\Windows\CurrentVersion\Run
- <HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mutexes
- \BaseNamedObjects\b11
- b11IP Addresses
- 220[.]181[.]87[.]80
- 69[.]49[.]96[.]16 Domain Names
- www[.]murphysisters[.]org Files and or directories created
- \DAV RPC SERVICE
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\H3T7LZRL\m[1].exe
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cymycvgmtt.exe
- \;Z:000000000000d46c\192.168.0.1\vm9-116\_\DeviceConfigManager.exe
- %AppData%\winmgr.txt
- \;Z:000000000000d46c\192.168.0.1\vm9-116\autorun.inf
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ftoidjlwgv.exe
- \;Z:000000000000d46c\192.168.0.1\vm9-116\DeviceConfigManager.bat
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\H3T7LZRL\b11[1].exe
- %WinDir%\M-5050572947025827857375865240\winmgr.exe
- %TEMP%\phqghumeay
- \;Z:000000000000d46c\192.168.0.1\vm9-116\.lnk
- %TEMP%\rgjqmvnkyr
- %TEMP%\edakubnfgu
- \;Z:000000000000d46c\192.168.0.1\vm9-116\DeviceConfigManager.vbs
- %TEMP%\gwhroqkhwu
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rdwpamlgaz.bat File Hashes
- 22bcff79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad
- c06da956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685f6c4f
- e474e51a6f29b9e32702445797ef4baaa96b1e30fa3f212ae2953bbb843a559b
- c9329790645ae7404cd3c746b9a26bcd667b6c1c45f727e504d0833d04726488
- b95a5e8f1dc23677e9e700b44d014aeee127869e46af6a674f93d34da3c606d0
- f3ee9f0be76f80faaa683ef580e3f018e1e0108e5b4457bad379e99dda2c627f
- b010ae9122a8651be194c5bc3d49540d51287040f1a1f066e193835f942277a9
- d775f05eb68ce4ef44776de0ad2b3c6181ad6a99813612a1ce3cc8b453359482
- a3940c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d5f8e3
- 2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0
- 43d2b149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618865d9
- 9e7ae2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269ca636
- 10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817
- 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575
- 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293
- 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4
- 33fd94f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56c96bc
- 1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1
- 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3
- 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353
- 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9
- 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8
- 2ab47d6d82225c62487054db91e804418060b3334531e09d96dc6d3630fa54b3
- 34ae5c841f6e992fe09979fff521d2e8367385260cf73112e79ce656e952bbb5
- 564ace4ef8e2c3aab367969748e02a0dee555733e9085fcc0a86b9f1b70fb7b3
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Win.Trojan.Multi-6413508-0
Indicators of Compromise
Registry Keys
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: Logman
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
- Value: load
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
- Value: run
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyServer
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: internat.exe
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyOverride
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: Session Manager
- <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
- Value: lsm service
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value: ClipSrv
- <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion
- <HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Mutexes
- N/A IP Addresses
- N/A Domain Names
- www[.]wholists[.]org Files and or directories created
- %System16%\lsm.exe
- %AppData%\clipsrv.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\lsm.exe (copy)
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\dllhost.exe (copy)
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\spoolsv.exe
- %SystemDrive%\Documents and Settings\All Users\Microsoft\RCX2.tmp
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\RCX8.tmp
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\spoolsv.exe (copy)
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\RCX6.tmp
- %AppData%\ieudinit.exe
- %SystemDrive%\DOCUME~1\ALLUSE~1\clipsrv.exe
- \TEMP\d0a08beb99882af4b1771426905ee556.exe
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\dllhost.exe
- \Users\Administrator\AppData\Local\Microsoft\dllhst3g.exe
- %System16%\smss.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\RCX4.tmp
- %WinDir%\SysWOW64\drivers\ieudinit.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\lsm.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\dllhst3g.exe
- %SystemDrive%\Documents and Settings\All Users\Microsoft\mstinit.exe (copy)
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\esentutl.exe
- %SystemDrive%\DOCUME~1\ALLUSE~1\clipsrv.exe (copy)
- %SystemDrive%\Documents and Settings\All Users\Microsoft\mstinit.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\dllhst3g.exe (copy)
- %WinDir%\spoolsv.exe (copy)
- \Users\Administrator\AppData\Local\Microsoft\rsvp.exe
- %WinDir%\logman.exe
- %WinDir%\spoolsv.exe
- %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\esentutl.exe (copy) File Hashes
- ec3075ac9775e3c41bc8227a00ef76905bbd96a62b813c99f277865ff353c5ce
- f4b6b76dec96cc9d530dd6cb64bdd743a115a12a7b03e41f7ec737e4d80b6850
- b1da876da56ba09770d594765727d167bf1a655247f094360e032a35d3d41461
- b82ebd17236c41d9e457f640a2871695326ef8014ebd71b7a5f37d8b2c3a4522
- b3f5ad44f682104d536c60832d2064f71d3261ffbf0e1555c236a36b505619d3
- a27376262110767a28e376b723caa46d3cc50d33da60029df8e7af024ff67be9
- f1b2bbf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc5f7e0
- 17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52
- e5c95545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95beb382
- 6d1b40fbdcad0c96c687f661469e39b7b10a0b083a9ea3c9f6bb959c284df149
- 7d1ae051d633a3ed3c0991aaa3ed63357804a80e67dd19ae5deab71e525947a6
- 799e5b77de09f7971f0187b69266e45f70e0cda170c615c604806ec2444ab89a
- 910b590e28bc72bc14c05d47a026ed56928ea8b6608f626555d955beccb719c8
- 7d326add0d36be4543317c4d14823e2cb380f7b07bacc1f893ec86bdd0b04468
- 5af23d9dedc83e1fe8c808fe62d858767dd95f2b9402fa785072cc7247a2e4c6
- bf828a8f3fb1a27532aa9f3fb0383a1ce3418f7dd52cefa4264ab2e3e941e8d9
Coverage
Screenshots of Detection AMP
ThreatGrid
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-1229-0105/