Cisco Talospublished May 4, 20:10 UTC (May 4, 2018)ingested Sep 10, 06:19 UTC

Threat Round Up for April 27 to May 04

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article550 words · extracted from blog.talosintelligence.com · click to collapse

Friday, May 4, 2018 16:10

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 27 and May 4. As with previous roundups, this post isn't meant to be an in-depth analysis. We'll summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

Win.Dropper.Yakes-6527307-0
Dropper
This malware family sets up persistence on target systems by adding a registry entry to HKLM\Software\Microsoft\CurrentUser\Run. It also uses netsh.exe to modify Windows Firewall rules to allow a DLL to communicate externally.
Win.Ransomware.GandCrab-6526409-1
Ransomware
Gandcrab is a piece of ransomware that encrypts documents, photos, databases and other important files, and adds the file extension ".GDCB" or ".CRAB".
Win.Dropper.Tiggre-6526413-0
Dropper
This malware is a trojan spyware. It will exfiltrates information from the victim's PC and sends it to a command and control (C2) server controller by the threat actor.

Threats

Win.Dropper.Yakes-6527307-0

Indicators of Compromise

Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: internat.exe
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value: stplck
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI
<HKLM>\System\CurrentControlSet\Services\NapAgent\Shas
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups
<HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs
<HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig Mutexes
N/A IP Addresses
N/A Domain Names
N/A Files and or directories created
N/A File Hashes
212459961e8c3c574cefadaf422e3226c169f01593d480cdf303dceae56e200d
c4a606577fe097b9f3eb9ad1bf3e3d95f917383c765ba929b428fdb8bd17f44c
ac7b2901d2dffff27e27c4e2889f729496b94c4ffef3802391f7aefd837f6109
50d4bc39a6a426f9980a64bc464703dabe3ea4fa183265c66cb3d1c8adf82ddf
e5bf1ff23ec9b7977e28643ba1102adb96576166de6e749c15f0fd54e8379a45
1d0a138b233dd25cfba925034778bc05e911407633385de30ebe15be61984bae
bf131b8194cdc3073adc2913e3133d049361cc0d8ffd09161e71c537abbc9b46
4b581e236cd18568b32a67356c31a86799393edaad60af2b8dbba8babe3ebeb1
0d6f846d3a96d84279a28b990201473882ffa08d733300b0da19e7897580d0e1
d77b972781dcf37a1c6a8f3d17077db8ef83f01f0e6449595836dafde9dabd13
76dc4a0faea60ed479dca96a57faa6eb4249665d32f23530ae57ebe63a1911b3
f8d14cf852d1a450866d4749733dca06ce08f0b48534874b46218d671526eef5
d377c493b98ffbf9dcc3b9938441f628de5bef99078b1351b6c0088f3ca87483
ff06a02731588c4dd5b78584f5342739f4b65c37cfb34d73380d8e98a66fa18e
d76273353bf949dafe1afb1ee27c19efd1221e8cc3bc9eb7cba1d18089b7ff4f
c2ff1b2e48e269a22f10d7a89d2483af007fad5ac21d417e213802aaa0403870
cc52ae1383c424b2481b3e975aa0b6c93061e63c28b7f93935222e474b75fae6
39cd2440d772085b1f2b84e524363a6e260eef6f2031300b9b6e02e433010419
3a5cff60f6dce5a0f264921838486ce9a7f48c2d897eb57886211bc99130d132
14b2f4fb032f20cedbdd692dcc1a8cefcd445a94198f58adc474fee8dc7d57af
cd5ac2fd508dc3db95995fc643090f73581d937ac7620e058b7bef011e5c7eed
3015144e74631e7990953621367f33a673dea745154e904147532239ae5fedc6
26498d8b242924cad96dea24b39d5df88850c24c5e567db646c8d20891e87ab2
35f0da1890f512f1185cf1502306c641cc9a6a28060b387e33d638bda22a5e96
ed57490c6876bf5d420841bdf5bf79002c323ea29b1e4b74093eb40290abb821

Coverage

Screenshots of Detection
AMP

ThreatGrid

Win.Ransomware.GandCrab-6526409-1

Indicators of Compromise

Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: SavedLegacySettings
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: DefaultConnectionSettings
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value: azpprnrnrcq
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: UNCAsIntranet
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyServer
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyOverride
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyEnable
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoConfigURL
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Mutexes
N/A IP Addresses
66[.]171[.]248[.]178 Domain Names
NS2[.]VIRMACH[.]RU
politiaromana[.]bit
ns1[.]virmach[.]ru
ns2[.]virmach[.]ru
ipv4bot[.]whatismyipaddress[.]com
malwarehunterteam[.]bit
NS1[.]VIRMACH[.]RU
gdcb[.]bit Files and or directories created
%AppData%\Microsoft\auzyuj.exe
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\7TZAD419.htm File Hashes
7b9b8f829674aa2eb6a64413c242597e3a2f6f4b1aa4c9f6309be3877180209f
6c1521794b8232598e0fee70656da09528e8acac1e3ccb443e8cc9efb4a43d83
eb27a047448f0d5901cda8d4e47854a26acd602bc3d89eebdc0768ad053b0c2f
d880eed2076d1e0ce0d019e029b503dae291aa620f5624ba7c40f21a0f425e77
311746c6767acda1e4cb18471642a1fea312a5e00aa69098c8f84de0846da311
7a89a0ac5ef495b7198dbdf91d06f21b976a70ad693c1236116a5eb0dac087a7
8b59359e89fbddfd85ac6af0641ebec1881aa7c28a6479205b876abdc47fc8bb
740528b18d963721e598cbf35e42df5929cd0c3ee90c41853063174c05d5d689
d1901ded57b17e405c68f235db33d7be48cef6b0a9a45eb58de7b771b7582004
dd387d1748454444a8990cae3d0a46b9c11d5addc9830bac55013a2db15dbd16
022995fa1ce1451aac2d87c8b85cdddd68f5bea4563c3af98987c4d3dca2f824
6b3a7117a457273d4016243892b86456ae9d1acd35eb770702363ce55b938e1a
d71337186b871ad011ae9b1f568290997ec445f468702273a68a7f5366bfb2d9
dd57a216c5482daa9ffe0764e144bda881fd5e47d27c5b716d2d71ae471bc624
7c99916b0478a4cbc8c94aeea5aa6b90f8056461c4881fdb645dabe98a1ee190
2f73091f77c899d4ad8df765088d7602081e0a570cb1d26da030c64781ab0172
4b64922b694e26c5abcd2bf8ba9954520009e4c1088e4ce9417fb2d06a2c79db
f7961fecbaf223b8318e50cbea4822c3a7da106ecb2a8411d03af5aee6328812
a62bd1ff7efca64002d5831c3ea43cb713f8501e2c83bd30ab60d91047d45a72
9b162db4b38c2b650d2521e1de8c56cb0fc5b56aebcedf27c9d35f51e12a717a
0678aafb4eb91d68de4c9354e4a254ece02422cbb43157ae06b5b925a1165992
eea453fe669f09bc36259544063528ceac9153caf597e5ca27801cfb7e8db3be
4b53ebc0f9a4678c012151171718731e98d45f806b170ca04c7b2510b0e7c116
af2705303549459628dfa11354c4fa16ecf13c45453d16c819a8cd6c26d5cee1
280d97ae7c5e478c185f5ea86e5fd214b0023539f7623be7c9500489309f85a1

Coverage

Screenshots of Detection
AMP

ThreatGrid

Win.Dropper.Tiggre-6526413-0

Indicators of Compromise

Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: SavedLegacySettings
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: DefaultConnectionSettings
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: UNCAsIntranet
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value: DhcpDomain
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value: DhcpNameServer
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpDefaultGateway
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpDomain
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNameServer
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpSubnetMaskOpt
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpInterfaceOptions
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNetbiosOptions
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value: DhcpNameServerList
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
Value: DhcpScopeID
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
Value: CachePrefix
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
Value: Collection
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyServer
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyOverride
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyEnable
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoConfigURL
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKLM>\Software\Wow6432Node\Microsoft\DownloadManager Mutexes
N/A IP Addresses
104[.]238[.]156[.]230
45[.]76[.]241[.]231 Domain Names
down[.]kaidandll[.]com
api[.]new-api[.]com Files and or directories created
%LocalAppData%\AdService File Hashes
d51890673d1a7cd7de5eecd76a54211b3cebb15058ec22dce44bfabb3ef86ec0
939d208be5589007d24178a92620411e2c6d84387c790699e57cb52e063a5348
03d61dc3fc8d70e0075081d3e02f520861f342f7ec1c4b1cbaf895f995d38b4f
77d36423c105319a4797d0c70acd6858416cf87111ff843eef23e2b30ad0b473
c87547487236791ff3dc1d6daef854825fb49f0ad5c96b69037dba7b08185841
9cbb5dbb783671ffbfa65ce3b5053259536de48f0d64312e5c46e6cf49d9c901
ae6f4e3c68704c99db60617c09405ffcd914141f6147f7234bc5639105fb702b
876b2e195cbc70915501f15a41b6f4e5b447985683427ba36d392bb0907ad021
575d3e31f44e5af6fb84ad47d6b5556338b3f092847e49366358a0523b34cda0
b5ace9a48d9b304066b4d355921495cf32d3a8b303b2f82800ef11556b310474

Coverage

Screenshots of Detection
AMP

ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-0427-0504/

Type	Indicator	Context
domain	api.new-api.com	230 45[.]76[.]241[.]231 Domain Names down[.]kaidandll[.]com api[.]new-api[.]com Files and or directories created %LocalAppData%\AdServi
domain	down.kaidandll.com	sses 104[.]238[.]156[.]230 45[.]76[.]241[.]231 Domain Names down[.]kaidandll[.]com api[.]new-api[.]com Files and or directories created %L
domain	gdcb.bit	yipaddress[.]com malwarehunterteam[.]bit NS1[.]VIRMACH[.]RU gdcb[.]bit Files and or directories created %AppData%\Microsoft\auzy
domain	ipv4bot.whatismyipaddress.com	U politiaromana[.]bit ns1[.]virmach[.]ru ns2[.]virmach[.]ru ipv4bot[.]whatismyipaddress[.]com malwarehunterteam[.]bit NS1[.]VIRMACH[.]RU gdcb[.]bit F
domain	malwarehunterteam.bit	h[.]ru ns2[.]virmach[.]ru ipv4bot[.]whatismyipaddress[.]com malwarehunterteam[.]bit NS1[.]VIRMACH[.]RU gdcb[.]bit Files and or directories cr
domain	ns1.virmach.ru	8[.]178 Domain Names NS2[.]VIRMACH[.]RU politiaromana[.]bit ns1[.]virmach[.]ru ns2[.]virmach[.]ru ipv4bot[.]whatismyipaddress[.]com ma
domain	ns2.virmach.ru	Mutexes N/A IP Addresses 66[.]171[.]248[.]178 Domain Names NS2[.]VIRMACH[.]RU politiaromana[.]bit ns1[.]virmach[.]ru ns2[.]virmach[.]
domain	politiaromana.bit	resses 66[.]171[.]248[.]178 Domain Names NS2[.]VIRMACH[.]RU politiaromana[.]bit ns1[.]virmach[.]ru ns2[.]virmach[.]ru ipv4bot[.]whatismyi
sha256	022995fa1ce1451aac2d87c8b85cdddd68f5bea4563c3af98987c4d3dca2f824	d1748454444a8990cae3d0a46b9c11d5addc9830bac55013a2db15dbd16 022995fa1ce1451aac2d87c8b85cdddd68f5bea4563c3af98987c4d3dca2f824 6b3a7117a457273d4016243892b86456ae9d1acd35eb770702363ce55b9
sha256	03d61dc3fc8d70e0075081d3e02f520861f342f7ec1c4b1cbaf895f995d38b4f	08be5589007d24178a92620411e2c6d84387c790699e57cb52e063a5348 03d61dc3fc8d70e0075081d3e02f520861f342f7ec1c4b1cbaf895f995d38b4f 77d36423c105319a4797d0c70acd6858416cf87111ff843eef23e2b30ad
sha256	0678aafb4eb91d68de4c9354e4a254ece02422cbb43157ae06b5b925a1165992	db4b38c2b650d2521e1de8c56cb0fc5b56aebcedf27c9d35f51e12a717a 0678aafb4eb91d68de4c9354e4a254ece02422cbb43157ae06b5b925a1165992 eea453fe669f09bc36259544063528ceac9153caf597e5ca27801cfb7e8
sha256	0d6f846d3a96d84279a28b990201473882ffa08d733300b0da19e7897580d0e1	e236cd18568b32a67356c31a86799393edaad60af2b8dbba8babe3ebeb1 0d6f846d3a96d84279a28b990201473882ffa08d733300b0da19e7897580d0e1 d77b972781dcf37a1c6a8f3d17077db8ef83f01f0e6449595836dafde9d
sha256	14b2f4fb032f20cedbdd692dcc1a8cefcd445a94198f58adc474fee8dc7d57af	f60f6dce5a0f264921838486ce9a7f48c2d897eb57886211bc99130d132 14b2f4fb032f20cedbdd692dcc1a8cefcd445a94198f58adc474fee8dc7d57af cd5ac2fd508dc3db95995fc643090f73581d937ac7620e058b7bef011e5
sha256	1d0a138b233dd25cfba925034778bc05e911407633385de30ebe15be61984bae	ff23ec9b7977e28643ba1102adb96576166de6e749c15f0fd54e8379a45 1d0a138b233dd25cfba925034778bc05e911407633385de30ebe15be61984bae bf131b8194cdc3073adc2913e3133d049361cc0d8ffd09161e71c537abb
sha256	212459961e8c3c574cefadaf422e3226c169f01593d480cdf303dceae56e200d	Names N/A Files and or directories created N/A File Hashes 212459961e8c3c574cefadaf422e3226c169f01593d480cdf303dceae56e200d c4a606577fe097b9f3eb9ad1bf3e3d95f917383c765ba929b428fdb8bd1
sha256	26498d8b242924cad96dea24b39d5df88850c24c5e567db646c8d20891e87ab2	44e74631e7990953621367f33a673dea745154e904147532239ae5fedc6 26498d8b242924cad96dea24b39d5df88850c24c5e567db646c8d20891e87ab2 35f0da1890f512f1185cf1502306c641cc9a6a28060b387e33d638bda22
sha256	280d97ae7c5e478c185f5ea86e5fd214b0023539f7623be7c9500489309f85a1	5303549459628dfa11354c4fa16ecf13c45453d16c819a8cd6c26d5cee1 280d97ae7c5e478c185f5ea86e5fd214b0023539f7623be7c9500489309f85a1 Coverage Screenshots of Detection AMP ThreatGrid Win.Droppe
sha256	2f73091f77c899d4ad8df765088d7602081e0a570cb1d26da030c64781ab0172	16b0478a4cbc8c94aeea5aa6b90f8056461c4881fdb645dabe98a1ee190 2f73091f77c899d4ad8df765088d7602081e0a570cb1d26da030c64781ab0172 4b64922b694e26c5abcd2bf8ba9954520009e4c1088e4ce9417fb2d06a2
sha256	3015144e74631e7990953621367f33a673dea745154e904147532239ae5fedc6	2fd508dc3db95995fc643090f73581d937ac7620e058b7bef011e5c7eed 3015144e74631e7990953621367f33a673dea745154e904147532239ae5fedc6 26498d8b242924cad96dea24b39d5df88850c24c5e567db646c8d20891e
sha256	311746c6767acda1e4cb18471642a1fea312a5e00aa69098c8f84de0846da311	ed2076d1e0ce0d019e029b503dae291aa620f5624ba7c40f21a0f425e77 311746c6767acda1e4cb18471642a1fea312a5e00aa69098c8f84de0846da311 7a89a0ac5ef495b7198dbdf91d06f21b976a70ad693c1236116a5eb0dac
sha256	35f0da1890f512f1185cf1502306c641cc9a6a28060b387e33d638bda22a5e96	d8b242924cad96dea24b39d5df88850c24c5e567db646c8d20891e87ab2 35f0da1890f512f1185cf1502306c641cc9a6a28060b387e33d638bda22a5e96 ed57490c6876bf5d420841bdf5bf79002c323ea29b1e4b74093eb40290a
sha256	39cd2440d772085b1f2b84e524363a6e260eef6f2031300b9b6e02e433010419	e1383c424b2481b3e975aa0b6c93061e63c28b7f93935222e474b75fae6 39cd2440d772085b1f2b84e524363a6e260eef6f2031300b9b6e02e433010419 3a5cff60f6dce5a0f264921838486ce9a7f48c2d897eb57886211bc9913
sha256	3a5cff60f6dce5a0f264921838486ce9a7f48c2d897eb57886211bc99130d132	440d772085b1f2b84e524363a6e260eef6f2031300b9b6e02e433010419 3a5cff60f6dce5a0f264921838486ce9a7f48c2d897eb57886211bc99130d132 14b2f4fb032f20cedbdd692dcc1a8cefcd445a94198f58adc474fee8dc7
sha256	4b53ebc0f9a4678c012151171718731e98d45f806b170ca04c7b2510b0e7c116	3fe669f09bc36259544063528ceac9153caf597e5ca27801cfb7e8db3be 4b53ebc0f9a4678c012151171718731e98d45f806b170ca04c7b2510b0e7c116 af2705303549459628dfa11354c4fa16ecf13c45453d16c819a8cd6c26d
sha256	4b581e236cd18568b32a67356c31a86799393edaad60af2b8dbba8babe3ebeb1	b8194cdc3073adc2913e3133d049361cc0d8ffd09161e71c537abbc9b46 4b581e236cd18568b32a67356c31a86799393edaad60af2b8dbba8babe3ebeb1 0d6f846d3a96d84279a28b990201473882ffa08d733300b0da19e789758
sha256	4b64922b694e26c5abcd2bf8ba9954520009e4c1088e4ce9417fb2d06a2c79db	91f77c899d4ad8df765088d7602081e0a570cb1d26da030c64781ab0172 4b64922b694e26c5abcd2bf8ba9954520009e4c1088e4ce9417fb2d06a2c79db f7961fecbaf223b8318e50cbea4822c3a7da106ecb2a8411d03af5aee63
sha256	50d4bc39a6a426f9980a64bc464703dabe3ea4fa183265c66cb3d1c8adf82ddf	901d2dffff27e27c4e2889f729496b94c4ffef3802391f7aefd837f6109 50d4bc39a6a426f9980a64bc464703dabe3ea4fa183265c66cb3d1c8adf82ddf e5bf1ff23ec9b7977e28643ba1102adb96576166de6e749c15f0fd54e83
sha256	575d3e31f44e5af6fb84ad47d6b5556338b3f092847e49366358a0523b34cda0	e195cbc70915501f15a41b6f4e5b447985683427ba36d392bb0907ad021 575d3e31f44e5af6fb84ad47d6b5556338b3f092847e49366358a0523b34cda0 b5ace9a48d9b304066b4d355921495cf32d3a8b303b2f82800ef11556b3
sha256	6b3a7117a457273d4016243892b86456ae9d1acd35eb770702363ce55b938e1a	5fa1ce1451aac2d87c8b85cdddd68f5bea4563c3af98987c4d3dca2f824 6b3a7117a457273d4016243892b86456ae9d1acd35eb770702363ce55b938e1a d71337186b871ad011ae9b1f568290997ec445f468702273a68a7f5366b
sha256	6c1521794b8232598e0fee70656da09528e8acac1e3ccb443e8cc9efb4a43d83	f829674aa2eb6a64413c242597e3a2f6f4b1aa4c9f6309be3877180209f 6c1521794b8232598e0fee70656da09528e8acac1e3ccb443e8cc9efb4a43d83 eb27a047448f0d5901cda8d4e47854a26acd602bc3d89eebdc0768ad053
sha256	740528b18d963721e598cbf35e42df5929cd0c3ee90c41853063174c05d5d689	59e89fbddfd85ac6af0641ebec1881aa7c28a6479205b876abdc47fc8bb 740528b18d963721e598cbf35e42df5929cd0c3ee90c41853063174c05d5d689 d1901ded57b17e405c68f235db33d7be48cef6b0a9a45eb58de7b771b75
sha256	76dc4a0faea60ed479dca96a57faa6eb4249665d32f23530ae57ebe63a1911b3	72781dcf37a1c6a8f3d17077db8ef83f01f0e6449595836dafde9dabd13 76dc4a0faea60ed479dca96a57faa6eb4249665d32f23530ae57ebe63a1911b3 f8d14cf852d1a450866d4749733dca06ce08f0b48534874b46218d67152
sha256	77d36423c105319a4797d0c70acd6858416cf87111ff843eef23e2b30ad0b473	dc3fc8d70e0075081d3e02f520861f342f7ec1c4b1cbaf895f995d38b4f 77d36423c105319a4797d0c70acd6858416cf87111ff843eef23e2b30ad0b473 c87547487236791ff3dc1d6daef854825fb49f0ad5c96b69037dba7b081
sha256	7a89a0ac5ef495b7198dbdf91d06f21b976a70ad693c1236116a5eb0dac087a7	6c6767acda1e4cb18471642a1fea312a5e00aa69098c8f84de0846da311 7a89a0ac5ef495b7198dbdf91d06f21b976a70ad693c1236116a5eb0dac087a7 8b59359e89fbddfd85ac6af0641ebec1881aa7c28a6479205b876abdc47
sha256	7b9b8f829674aa2eb6a64413c242597e3a2f6f4b1aa4c9f6309be3877180209f	nternet Files\Content.IE5\SSZWDDXW\7TZAD419.htm File Hashes 7b9b8f829674aa2eb6a64413c242597e3a2f6f4b1aa4c9f6309be3877180209f 6c1521794b8232598e0fee70656da09528e8acac1e3ccb443e8cc9efb4a
sha256	7c99916b0478a4cbc8c94aeea5aa6b90f8056461c4881fdb645dabe98a1ee190	216c5482daa9ffe0764e144bda881fd5e47d27c5b716d2d71ae471bc624 7c99916b0478a4cbc8c94aeea5aa6b90f8056461c4881fdb645dabe98a1ee190 2f73091f77c899d4ad8df765088d7602081e0a570cb1d26da030c64781a
sha256	876b2e195cbc70915501f15a41b6f4e5b447985683427ba36d392bb0907ad021	e3c68704c99db60617c09405ffcd914141f6147f7234bc5639105fb702b 876b2e195cbc70915501f15a41b6f4e5b447985683427ba36d392bb0907ad021 575d3e31f44e5af6fb84ad47d6b5556338b3f092847e49366358a0523b3
sha256	8b59359e89fbddfd85ac6af0641ebec1881aa7c28a6479205b876abdc47fc8bb	0ac5ef495b7198dbdf91d06f21b976a70ad693c1236116a5eb0dac087a7 8b59359e89fbddfd85ac6af0641ebec1881aa7c28a6479205b876abdc47fc8bb 740528b18d963721e598cbf35e42df5929cd0c3ee90c41853063174c05d
sha256	939d208be5589007d24178a92620411e2c6d84387c790699e57cb52e063a5348	0673d1a7cd7de5eecd76a54211b3cebb15058ec22dce44bfabb3ef86ec0 939d208be5589007d24178a92620411e2c6d84387c790699e57cb52e063a5348 03d61dc3fc8d70e0075081d3e02f520861f342f7ec1c4b1cbaf895f995d
sha256	9b162db4b38c2b650d2521e1de8c56cb0fc5b56aebcedf27c9d35f51e12a717a	1ff7efca64002d5831c3ea43cb713f8501e2c83bd30ab60d91047d45a72 9b162db4b38c2b650d2521e1de8c56cb0fc5b56aebcedf27c9d35f51e12a717a 0678aafb4eb91d68de4c9354e4a254ece02422cbb43157ae06b5b925a11
sha256	9cbb5dbb783671ffbfa65ce3b5053259536de48f0d64312e5c46e6cf49d9c901	7487236791ff3dc1d6daef854825fb49f0ad5c96b69037dba7b08185841 9cbb5dbb783671ffbfa65ce3b5053259536de48f0d64312e5c46e6cf49d9c901 ae6f4e3c68704c99db60617c09405ffcd914141f6147f7234bc5639105f
sha256	a62bd1ff7efca64002d5831c3ea43cb713f8501e2c83bd30ab60d91047d45a72	fecbaf223b8318e50cbea4822c3a7da106ecb2a8411d03af5aee6328812 a62bd1ff7efca64002d5831c3ea43cb713f8501e2c83bd30ab60d91047d45a72 9b162db4b38c2b650d2521e1de8c56cb0fc5b56aebcedf27c9d35f51e12
sha256	ac7b2901d2dffff27e27c4e2889f729496b94c4ffef3802391f7aefd837f6109	6577fe097b9f3eb9ad1bf3e3d95f917383c765ba929b428fdb8bd17f44c ac7b2901d2dffff27e27c4e2889f729496b94c4ffef3802391f7aefd837f6109 50d4bc39a6a426f9980a64bc464703dabe3ea4fa183265c66cb3d1c8adf
sha256	ae6f4e3c68704c99db60617c09405ffcd914141f6147f7234bc5639105fb702b	dbb783671ffbfa65ce3b5053259536de48f0d64312e5c46e6cf49d9c901 ae6f4e3c68704c99db60617c09405ffcd914141f6147f7234bc5639105fb702b 876b2e195cbc70915501f15a41b6f4e5b447985683427ba36d392bb0907
sha256	af2705303549459628dfa11354c4fa16ecf13c45453d16c819a8cd6c26d5cee1	bc0f9a4678c012151171718731e98d45f806b170ca04c7b2510b0e7c116 af2705303549459628dfa11354c4fa16ecf13c45453d16c819a8cd6c26d5cee1 280d97ae7c5e478c185f5ea86e5fd214b0023539f7623be7c9500489309
sha256	b5ace9a48d9b304066b4d355921495cf32d3a8b303b2f82800ef11556b310474	e31f44e5af6fb84ad47d6b5556338b3f092847e49366358a0523b34cda0 b5ace9a48d9b304066b4d355921495cf32d3a8b303b2f82800ef11556b310474 Coverage Screenshots of Detection AMP ThreatGrid
sha256	bf131b8194cdc3073adc2913e3133d049361cc0d8ffd09161e71c537abbc9b46	38b233dd25cfba925034778bc05e911407633385de30ebe15be61984bae bf131b8194cdc3073adc2913e3133d049361cc0d8ffd09161e71c537abbc9b46 4b581e236cd18568b32a67356c31a86799393edaad60af2b8dbba8babe3
sha256	c2ff1b2e48e269a22f10d7a89d2483af007fad5ac21d417e213802aaa0403870	3353bf949dafe1afb1ee27c19efd1221e8cc3bc9eb7cba1d18089b7ff4f c2ff1b2e48e269a22f10d7a89d2483af007fad5ac21d417e213802aaa0403870 cc52ae1383c424b2481b3e975aa0b6c93061e63c28b7f93935222e474b7
sha256	c4a606577fe097b9f3eb9ad1bf3e3d95f917383c765ba929b428fdb8bd17f44c	9961e8c3c574cefadaf422e3226c169f01593d480cdf303dceae56e200d c4a606577fe097b9f3eb9ad1bf3e3d95f917383c765ba929b428fdb8bd17f44c ac7b2901d2dffff27e27c4e2889f729496b94c4ffef3802391f7aefd837
sha256	c87547487236791ff3dc1d6daef854825fb49f0ad5c96b69037dba7b08185841	423c105319a4797d0c70acd6858416cf87111ff843eef23e2b30ad0b473 c87547487236791ff3dc1d6daef854825fb49f0ad5c96b69037dba7b08185841 9cbb5dbb783671ffbfa65ce3b5053259536de48f0d64312e5c46e6cf49d
sha256	cc52ae1383c424b2481b3e975aa0b6c93061e63c28b7f93935222e474b75fae6	b2e48e269a22f10d7a89d2483af007fad5ac21d417e213802aaa0403870 cc52ae1383c424b2481b3e975aa0b6c93061e63c28b7f93935222e474b75fae6 39cd2440d772085b1f2b84e524363a6e260eef6f2031300b9b6e02e4330
sha256	cd5ac2fd508dc3db95995fc643090f73581d937ac7620e058b7bef011e5c7eed	4fb032f20cedbdd692dcc1a8cefcd445a94198f58adc474fee8dc7d57af cd5ac2fd508dc3db95995fc643090f73581d937ac7620e058b7bef011e5c7eed 3015144e74631e7990953621367f33a673dea745154e904147532239ae5
sha256	d1901ded57b17e405c68f235db33d7be48cef6b0a9a45eb58de7b771b7582004	8b18d963721e598cbf35e42df5929cd0c3ee90c41853063174c05d5d689 d1901ded57b17e405c68f235db33d7be48cef6b0a9a45eb58de7b771b7582004 dd387d1748454444a8990cae3d0a46b9c11d5addc9830bac55013a2db15
sha256	d377c493b98ffbf9dcc3b9938441f628de5bef99078b1351b6c0088f3ca87483	cf852d1a450866d4749733dca06ce08f0b48534874b46218d671526eef5 d377c493b98ffbf9dcc3b9938441f628de5bef99078b1351b6c0088f3ca87483 ff06a02731588c4dd5b78584f5342739f4b65c37cfb34d73380d8e98a66
sha256	d51890673d1a7cd7de5eecd76a54211b3cebb15058ec22dce44bfabb3ef86ec0	or directories created %LocalAppData%\AdService File Hashes d51890673d1a7cd7de5eecd76a54211b3cebb15058ec22dce44bfabb3ef86ec0 939d208be5589007d24178a92620411e2c6d84387c790699e57cb52e063
sha256	d71337186b871ad011ae9b1f568290997ec445f468702273a68a7f5366bfb2d9	117a457273d4016243892b86456ae9d1acd35eb770702363ce55b938e1a d71337186b871ad011ae9b1f568290997ec445f468702273a68a7f5366bfb2d9 dd57a216c5482daa9ffe0764e144bda881fd5e47d27c5b716d2d71ae471
sha256	d76273353bf949dafe1afb1ee27c19efd1221e8cc3bc9eb7cba1d18089b7ff4f	02731588c4dd5b78584f5342739f4b65c37cfb34d73380d8e98a66fa18e d76273353bf949dafe1afb1ee27c19efd1221e8cc3bc9eb7cba1d18089b7ff4f c2ff1b2e48e269a22f10d7a89d2483af007fad5ac21d417e213802aaa04
sha256	d77b972781dcf37a1c6a8f3d17077db8ef83f01f0e6449595836dafde9dabd13	46d3a96d84279a28b990201473882ffa08d733300b0da19e7897580d0e1 d77b972781dcf37a1c6a8f3d17077db8ef83f01f0e6449595836dafde9dabd13 76dc4a0faea60ed479dca96a57faa6eb4249665d32f23530ae57ebe63a1
sha256	d880eed2076d1e0ce0d019e029b503dae291aa620f5624ba7c40f21a0f425e77	047448f0d5901cda8d4e47854a26acd602bc3d89eebdc0768ad053b0c2f d880eed2076d1e0ce0d019e029b503dae291aa620f5624ba7c40f21a0f425e77 311746c6767acda1e4cb18471642a1fea312a5e00aa69098c8f84de0846
sha256	dd387d1748454444a8990cae3d0a46b9c11d5addc9830bac55013a2db15dbd16	ded57b17e405c68f235db33d7be48cef6b0a9a45eb58de7b771b7582004 dd387d1748454444a8990cae3d0a46b9c11d5addc9830bac55013a2db15dbd16 022995fa1ce1451aac2d87c8b85cdddd68f5bea4563c3af98987c4d3dca
sha256	dd57a216c5482daa9ffe0764e144bda881fd5e47d27c5b716d2d71ae471bc624	7186b871ad011ae9b1f568290997ec445f468702273a68a7f5366bfb2d9 dd57a216c5482daa9ffe0764e144bda881fd5e47d27c5b716d2d71ae471bc624 7c99916b0478a4cbc8c94aeea5aa6b90f8056461c4881fdb645dabe98a1
sha256	e5bf1ff23ec9b7977e28643ba1102adb96576166de6e749c15f0fd54e8379a45	c39a6a426f9980a64bc464703dabe3ea4fa183265c66cb3d1c8adf82ddf e5bf1ff23ec9b7977e28643ba1102adb96576166de6e749c15f0fd54e8379a45 1d0a138b233dd25cfba925034778bc05e911407633385de30ebe15be619
sha256	eb27a047448f0d5901cda8d4e47854a26acd602bc3d89eebdc0768ad053b0c2f	1794b8232598e0fee70656da09528e8acac1e3ccb443e8cc9efb4a43d83 eb27a047448f0d5901cda8d4e47854a26acd602bc3d89eebdc0768ad053b0c2f d880eed2076d1e0ce0d019e029b503dae291aa620f5624ba7c40f21a0f4
sha256	ed57490c6876bf5d420841bdf5bf79002c323ea29b1e4b74093eb40290abb821	a1890f512f1185cf1502306c641cc9a6a28060b387e33d638bda22a5e96 ed57490c6876bf5d420841bdf5bf79002c323ea29b1e4b74093eb40290abb821 Coverage Screenshots of Detection AMP ThreatGrid Win.Ransom
sha256	eea453fe669f09bc36259544063528ceac9153caf597e5ca27801cfb7e8db3be	afb4eb91d68de4c9354e4a254ece02422cbb43157ae06b5b925a1165992 eea453fe669f09bc36259544063528ceac9153caf597e5ca27801cfb7e8db3be 4b53ebc0f9a4678c012151171718731e98d45f806b170ca04c7b2510b0e
sha256	f7961fecbaf223b8318e50cbea4822c3a7da106ecb2a8411d03af5aee6328812	22b694e26c5abcd2bf8ba9954520009e4c1088e4ce9417fb2d06a2c79db f7961fecbaf223b8318e50cbea4822c3a7da106ecb2a8411d03af5aee6328812 a62bd1ff7efca64002d5831c3ea43cb713f8501e2c83bd30ab60d91047d
sha256	f8d14cf852d1a450866d4749733dca06ce08f0b48534874b46218d671526eef5	a0faea60ed479dca96a57faa6eb4249665d32f23530ae57ebe63a1911b3 f8d14cf852d1a450866d4749733dca06ce08f0b48534874b46218d671526eef5 d377c493b98ffbf9dcc3b9938441f628de5bef99078b1351b6c0088f3ca
sha256	ff06a02731588c4dd5b78584f5342739f4b65c37cfb34d73380d8e98a66fa18e	493b98ffbf9dcc3b9938441f628de5bef99078b1351b6c0088f3ca87483 ff06a02731588c4dd5b78584f5342739f4b65c37cfb34d73380d8e98a66fa18e d76273353bf949dafe1afb1ee27c19efd1221e8cc3bc9eb7cba1d18089b

Threat Round Up for April 27 to May 04

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Dropper.Yakes-6527307-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Ransomware.GandCrab-6526409-1

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Win.Dropper.Tiggre-6526413-0

Indicators of Compromise

Coverage

Screenshots of Detection AMP

Screenshots of Detection
AMP

Screenshots of Detection
AMP

Screenshots of Detection
AMP