Ransomwarehigh

Threat Round Up for December 29

Cisco TalosJan 5, 2018 · 19:46 UTC (Jan 5, 2018)4 min read2 · 1 read

Read at blog.talosintelligence.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2017-8759

Tags: cve-2017-8759 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2017-8759	Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94)	7.8	89%	KEVPoC ×2	Sep 13, 2017 KEV Nov 3, 2021

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

4 min read at blog.talosintelligence.com

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 29 and January 05. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
domain	0i3tenrainy.loan	ain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or director
domain	dayi-yc.com	raceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or directories created %ProgramFiles%\Rfjd\conf
domain	goochandhousego.pro	k[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Files and or directories created %ProgramFi
domain	graceland2017.com	IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]pro dayi-yc[.]com Fi
domain	jas-pol.com.pl	DFE67F9832960 IP Addresses 89[.]161[.]153[.]74 Domain Names jas-pol[.]com[.]pl Files and or directories created %SystemDrive%\Document
domain	kistags.com	Q Mutexes N/A IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan goochandhousego[.]
domain	pragmaticinquiry.org	bKslin0UfIk= IP Addresses 98[.]124[.]252[.]145 Domain Names pragmaticinquiry[.]org Files and or directories created %TEMP%\ASPNETSetup_00001
domain	u.teknik.io	\RUN Value: VRGTQ Mutexes N/A IP Addresses N/A Domain Names u[.]teknik[.]io kistags[.]com graceland2017[.]com 0i3tenrainy[.]loan go
domain	weekendfakc.top	Registry Keys N/A Mutexes N/A IP Addresses N/A Domain Names weekendfakc[.]top Files and or directories created N/A File Hashes 024782b5
md5	d0a08beb99882af4b1771426905ee556	dinit.exe %SystemDrive%\DOCUME~1\ALLUSE~1\clipsrv.exe \TEMP\d0a08beb99882af4b1771426905ee556.exe %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\MICRO
sha256	024782b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e	fakc[.]top Files and or directories created N/A File Hashes 024782b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca189283
sha256	07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6fc2c50	c672052182d9d10b0d094f07ec67f182939556c90f66236d75d4e795cd6 07a1d83e2fdce0b0383fc05e2931d3aa557e3eeeeca50762258431ecf6fc2c50 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256	08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575	fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee6
sha256	0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b	2b5d080879af2a7a4280d262929e85e9815b2b37e9aeb6384a26e97895e 0ad1db5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc56
sha256	0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32	6bc6ee491a2b180d6b353ae8f8da230f27a0cdfc1757c58a4819664b790 0c51e3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3f
sha256	0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac	3df0b09f14e04b268102afc9342c35fcc2460c645f9c8d21b2413910d32 0cfdad54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166
sha256	0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4	03896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb1f0f4 33fd94f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56
sha256	10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817	2436474bbad1e9ce20f8fc7a294586fde89c39b3bd2e2fd257d269ca636 10c96fcbeee7e93309abc9616958ef214953f512f236ddff2db39f12a8f4a817 08c9fedfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff4256
sha256	113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293	edfcf1100f8450ad930a55a2cbf7dcc0fa88b646da2c5916ff42565c575 113e003896939e85f048e528b6f50fa9e984009fe2677143c7cfaad9ee693293 0d136160f510d87af7edeeb1533979a5cdc1d1511528798d5871bbb88bb
sha256	1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a	b5a012d54fe11b06cf8b8822135e5285e21ab99e7ae5c8ca1892836375b 1283fc95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a
sha256	129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0	fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a388e9c0 2d92ee55d56e96822aca748c7d69344d90a663e0db77e7ddd0ce9befa54
sha256	17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52	bf13bde9ce65cbe1cee7e3d86a61e0511f206ae74589329dc1fffc5f7e0 17023d977e2b041c8a1994e7ae69b65e10f7097febefc9b47817dd9f7985cd52 e5c95545895dc13626b3f20b47fe2f0f1b5dc3915fef44c3c7a5352e95b
sha256	1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527	c95f56f1f32dcfeb5ec042a53f6e0dbd05d49c5bbc892e389cfc5613d9a 1a5257c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc9
sha256	1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1	4f82800a1f8551e73aebbbac4169c3c08cbe12c69e9fab52875d56c96bc 1b6651d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261
sha256	1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0	d54484cf1d4ff9be267469edefdb98e963ffabd6beeb081a208e3fca9ac 1c2f0a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887
sha256	1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3	1d1e43c7ff8dd291d178b8bad9fbfd1bb426d49da419ee7e4a4d7912ba1 1cfd3043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c
sha256	1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18	9307649854e520f733df3df40ed960650103a78b8460488319156e059cf 1dd699b7fdb082c35677938f6f064e02e226033f995189889799adac08811a18 9ca5fd8ee403b418f92118836171b72a334caeb94fae9b5b46d6246742b
sha256	1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92	7982ceca8711ec2f6c7ad83103db41b5d2c644b9beee07c81f92efa30a5 1ff90f71632162646145cd91a22fdb24683cb25e54254f9c311d54cbc633fb92 377a4c54239536019cef4c3fb2ed835a0142f58d64bc0bf49063440b770
sha256	201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353	043ecc8fd7c254201fcafe6865dfdb1c0d6ccc343d0e62e1cab261fefa3 201c0ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7f
sha256	2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0	c00bd3e8d07eb70cd23148d030a473f134a7aa19ff6b777862af6d5f8e3 2104784585c92828df37feab86fcabddf3ffdb2718dfc3718ae529ad9c4956e0 43d2b149b3e4fd33b03321d2bfb6980734d3725483fee21cd996f280618
sha256	211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e	7c6cd2e03848758d9541cbf4918194ff33669029a06baee9317d1a9a527 211e5c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f94
sha256	22ae9fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d	m\SOAPAssembly\http100u4teknik4io0HUKzO4png.pdb File Hashes 22ae9fc528b63ecfe163c2b4c472e68869e049023be009ef118c59346247082d 129bddde9c3cb01c69d92d9029d5da963a0dd5a72143054f9fa97471a38
sha256	22bcff79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad	\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rdwpamlgaz.bat File Hashes 22bcff79015a6f2d450ff4713bc1a195f6333444e96e616fb070ccf885f790ad c06da956f726a78aff82e8c2ec2ed7989f227ac560511512fd609574685
sha256	23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e	c8d07af1e6b61acb7af8bb1e0fefe25bee88275f2db8d53f868dc991e0e 23c8026cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e954
sha256	23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9	ca83973186aab93376147f1b60d009ef13ec827d0de5d19b483d3c0f353 23db71997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282b
sha256	241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4	a28b5c13eb2967078d947924c9a4a5f8f845d3899986df19e8a166d3ec0 241f83caf5c5a23a1d7adbeaa8c392da0edadff362f41bbb5727dc71887048c4 305790984d5ffa713794c1732eea4f83f18da6926e415a490b2fc090f2c
sha256	25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd	26cd6414fa083f83c856c9142af5905747eabb32d0d0d839e21f941bf3e 25191548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c
sha256	26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8	1997ed2f558e06232f600d3cc7b4e5eb58f18039923127c5b4fa7fec2f9 26f1a92cb36e4caff3fccc45fba269647410fbee71cc4f4a00e5d4c282ba01f8 2ab47d6d82225c62487054db91e804418060b3334531e09d96dc6d3630f
sha256	28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f	548ef2032df4acb687d940854f134de3aa738b69fc578e5397e95496afd 28f9a67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac
sha256	29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820	67de7f6b79b4bf66da9d114c723e16d619f6787257eff856c71b1c7047f 29062cd2c2d09199fc0716485e0e3a1fff880195a92c78ecd5f0e5184ac07820 2b24aa417d6ab02fa9f82be1a41bc8c2e5de814057ed76074e2960d74f3