Threat Round Up for Feb 9

Friday, February 16, 2018 12:55

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between February 9 and February 16. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

• Win.Packer.VBashcan-6450053-1
  Packer
  VBashcan is a packer written in Visual Basic and has been used with trojans such as Umbra and Bozok.
  
• Win.Ransomware.Gandcrab-6450061-1
  Ransomware
  Gandcrab is ransomware that encrypts documents, photos, databases and other important files, and adds the file extension ".GDCB".
  
• Win.Ransomware.Godju-6450274-0
  Trojan
  This ransomware appends the extension "cypher" to the files and deletes them. It also creates a file called "encryption_key" in %AppData%. Like other ransomware families, it uses Tor for its command and control communications.
  
• Win.Trojan.DNSLock-6449722-0
  Trojan
  This family changes the DNS settings and redirect traffic to malicious website as well as insert additional advertisements on the victim's browser. Moreover, it contacts domains to notify the infection and gets commands. The main process also attempts to inject code in another address space and executes PowerShell commands.
  
• Win.Trojan.Generic-2-6449654-0
  Trojan
  Win.Trojan.Generic-2 is a malicious sample that can perform different nefarious actions. This sample steals passwords from web-browser password stores and exfiltrates them through a legitimate SMTP service. Note that this domain is listed in this report but our products do not block it since it is legitimately used by many users.
  
• Win.Virus.VMProtBad-6450060-0
  Virus
  VMProtBad is a packed file infector, equipped to detect several VM environments. VMProtBad is known for installing web browser toolbars & generating unwanted ad traffic.
  

Threats

Win.Packer.VBashcan-6450053-1

Indicators of Compromise
Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• Value: internat.exe
• <HKCU>\SOFTWARE\MICROSOFT\SLAYER616WASD
• Value: UID
• <HKU>\Software\Microsoft\Windows\CurrentVersion\Run
• <HKLM>\SOFTWARE\Microsoft\slayer616wasd
• <HKCU>\SOFTWARE\MICROSOFT\slayer616wasd Mutexes
  
• \BaseNamedObjects\slayer616wasd
• Local\ZonesCacheCounterMutex
• slayer616wasd
• DBWinMutex IP Addresses
  
• N/A Domain Names
  
• ilovetehpussay[.]host4star[.]com Files and or directories created
  
• %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.txt
• %AppData%\SystemWindows\WindowsService.exe
• %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.bat File Hashes
  
• 014cd0a944bebca326a3bb496667c29f5670858e67238ff4c074e789a07204d9
• 01cd6fc630c195ea59fb7755e530923f1cae383c57221a73bf3b6178e5d1a06d
• 0301c54ae3d98f0c84e03c6a64eced91f2b1130a861fd38cdd5488c25cc9844c
• 0333951a3a4d82639d620afbd43b2ba689970f68e29626ed15dcdbb2d7832829
• 03a5edbab584f197d5c6075fd2b825ad94fa8896988b1d3b77dce03aac586bfa
• 044898d63b8386f2d02ebbfd3f73997cf5731dfa1f3e27b55401e55901e512c6
• 048c444cf63f2afd1fdb07bc036141d93bb924f6abc1cbd39fb31fcaf2cef2b5
• 0515b6cb220f4db2154315eb57a8ca7703a481f5e5a9016a32cbae98425a4492
• 06a30d49fc05ef2cdbc4aed1db26020a7b1ec81a6b953f44e0c62d2a3e3e3531
• 07c5bea52f4e5a671b58b4061fc5721bb491682dafc25b06ef8692395d1012d1
• 07f21a783ce8944c9f0c40d9459a2ffdf7c15fc0c5ce0639584035655ebff7f0
• 0833aa53278f36a75131a2534db0d28bb833fa922579383e530469adb41d3478
• 08da00c849bd1aca5321e06f0e750e4d984f042d63f91db98b91f4967349b842
• 0cfc1788d54d5073d445cad67edf2ee76a9228f44734ed1341148b1cc82ee89b
• 16fc9a2c379c9e6664d668614a8e4df0f4c48170a9044288aab835c08fef5f0b
• 181dcac94cc3df4312a36af18a9d5ae0f25b5d718116d2b7af6f4d0aaa261c2c
• 1c2ab5729f056f3aa5f06c8cd342f7f543d3b30c1baf2ccd1dbdf5f15234d553
• 1d5173fee0e02d7df5c586871e0be2f30d7e88220d77bfb63caf505c1d671045
• 1da5e6084bd897b84b21b787b54f17a1b8cd88c388a13f3dcf9cec6395bb28a9
• 1f85629cd0d0b97d5a3372dd28062068e41bb8a74a70ab336dcf4ba8bb47b930
  

Coverage

Screenshots of DetectionAMP

ThreatGrid

Win.Ransomware.Gandcrab-6450061-1

Indicators of Compromise
Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
• Value: isnnswathsi
• <HKU>\Software\Microsoft\Windows\CurrentVersion\RunOnce Mutexes
  
• \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4
• Global\pc_group=WORKGROUP&ransom_id=4a6a799098b68e3c  IP Addresses
  
• 95[.]142[.]39[.]101
• 66[.]171[.]248[.]178
• 193[.]0[.]179[.]152
• 94[.]103[.]82[.]89 Domain Names
  
• nomoreransom[.]bit
• nomoreransom[.]coin
• gandcrab[.]bit Files and or directories created
  
• \Win32Pipes.00000490.00000017
• %AppData%\Microsoft\bkxmfm.exe
• %AppData%\Microsoft\kqrnbq.exe File Hashes
  
• 022024c7db211df7da83d533d24c795eb4178f5a7b9a27acf752874bcdbd5477
• 02e90fb6cd303ebced661c5c7c9af249241835285e0e64b1092731485584ab8a
• 03c8bece3db3e2d6b26cc9769d2a694071117cbcf21830aa143507b03b402681
• 04ef7221209f5ea957312704743139e6000e24dc4399ccc46d5e102ecf2ab3db
• 052a7544e45619190ee911406cdaff1708951c9d0a4070a5f7a69cc541f2e558
• 0664a3cca1d5c0c9f2b7f0e6b2f0f20e99b3f902e98e9e709f0bb8ac1cadb867
• 075c9b925c8a0c5cea4d26b1f3c23666c99cede647c9769503f8e35a96c098b9
• 084d5c8161764da9af2b1dde0146a7f9b51491c562d8036aa28b85a4a1a32aaa
• 0a2ebbf4d5ba25049b8225cb253f7f99423b706f9a239c877595eaf696058f56
• 14426a13dc4620932fd0af40005fb3f508d6a6d69eca897ef5af4f58f7761d3c
• 15b3a69b86710122a8824ce17996c3301e96b1c629b7db3d9919012954903c85
• 15b705ee101e26b1ba39d62d6c816409e059f395de8a1a5bfdd35d0e20b705da
• 1bbee00688a4632749b40312e4109fdc58afa0b5a9e8603718d386fca095a015
• 1cbcecc05259b821d7d82f6b2e779de2f4d4dd1561445a213a91db8617e61c4c
• 1f941ec87c3d98827d051ae46d626702960a690bf1f62645828b0ea5cbd6c5ec
• 22ddc024bf53ae71ff42cb79564f1bf8c9eb4f59d7c2ce3bc378c70ce067b250
• 261fd62f71e3b566c8ae77e44760f0346c4f353a25f879ee5401e4755745ba10
• 289d660ede22b4062d102307d5830a2af10da669ce573c279db8e055e6fbdaaa
• 299edfd4bbf81f20fb8f8e2dd9d0fc4d26c925dbd1cf4372d9172bc2644d3ca5
• 29a86b3a5c2f1a7a5ad325ccf5c906b532bb2275b79071e2ec98a281a290aadb
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Ransomware.Godju-6450274-0

Indicators of Compromise
Registry Keys

• <HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
• Value: LanguageList
• <HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
• Value: LanguageList
• <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
• Value: PnpInstanceID Mutexes
  
• N/A IP Addresses
  
• 185[.]100[.]85[.]150 Domain Names
  
• kdvm5fd6tn6jsbwh[.]onion[.]to Files and or directories created
  
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0Y9SM6.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0Y9SM6.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0ZU5JT.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0ZU5JT.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I478AKJ.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I478AKJ.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FI238.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FI238.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FKVBH.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FKVBH.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4QK3KJ.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4QK3KJ.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I5QX7W9.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I5QX7W9.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I77RW1L.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I77RW1L.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I7J37KF.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I7J37KF.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I9NSD58.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I9NSD58.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IANXEE8.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IANXEE8.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IBC53OO.xml
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IBC53OO.xml.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IC5NB1M.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IC5NB1M.txt.cypher
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ID60W3E.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ID60W3E.txt.cypher
• %AppData%\encryption_key
• %AppData%\lock_file
• %AppData%\uuid_file File Hashes
  
• 36bba27b1fffbecb4f37400ec3368995e39dfabbce61422531a55a36c7696c33
• 0622fcb172773d8939b451c43902095b0f91877ae05e562c60d0ca0c237a2e9c
• 412ce2fea4821c63074f3cd6223c9e9d7f074f18d5cd88dc1d7a36a1bb2f919c
• 4f888e9b613765653355f7dc2be015e7f32d677ae25fa7ff0298dc252339dce4
• 7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069
• 9690fec193714171652f8e0c7498d8ee3581fd0b074693a3a0ba07e5d95a141e
• 9a1794d3ae09b0a8c7a36fb27514760bb0227943d1ee37a7e81ffdfa9f36ec48
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Trojan.DNSLock-6449722-0

Indicators of Compromise
Registry Keys

• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: AddressType
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: Lease
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpDomain
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: LeaseObtainedTime
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES
• Value: 26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpNameServerList
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A}
• Value: Hash
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}
• Value: DynamicInfo
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\43191B4E617CFE98
• Value: 1
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job.fp
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}
• Value: Hash
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618
• Value: config
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}
• Value: Triggers
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{3B84A94B-68D0-41DF-9C58-9CD44ABFE648}
• Value: data
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A}
• Value: DynamicInfo
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
• Value: Collection
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS
• Value: Start
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpNameServer
• <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
• Value: PnpInstanceID
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{B3797BAB}
• Value: nt
• <HKLM>\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER
• Value: PendingFileRenameOperations
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
• Value: Blob
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
• Value: NameServer
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A}
• Value: Path
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618
• Value: rs
• <HKCU>\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE
• Value: WindowPosition
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{050B0847-7A0B-787D-0511-780E0C7E1109}
• Value: Index
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpInterfaceOptions
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
• Value: DhcpNameServer
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\11598763487076930564
• Value: 0
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618
• Value: rd
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A}
• Value: Triggers
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: NameServer
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: T1
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}
• Value: Hash
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpSubnetMaskOpt
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DHCPNameServer
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET
• Value: {9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}
• Value: Path
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job.fp
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}
• Value: DynamicInfo
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\43191B4E617CFE98
• Value: 0
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpConnForceBroadcastFlag
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {050B0847-7A0B-787D-0511-780E0C7E1109}.job.fp
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpClassIdBin
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{BD2E97E1-0A85-204A-AB40-40B403D0844F}
• Value: Id
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: IsServerNapAware
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{B3797BAB}
• Value: 0
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{4797FAD9-D20B-54DC-98FE-7C614E1B1943}
• Value: Index
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{050B0847-7A0B-787D-0511-780E0C7E1109}
• Value: Id
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: LeaseTerminatesTime
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}
• Value: Path
• <HKCU>\CONSOLE\%SYSTEMROOT%_SYSTEM32_WINDOWSPOWERSHELL_V1.0_POWERSHELL.EXE
• Value: WindowPosition
• <HKLM>\SYSTEM\ControlSet001\Services\Tcpip\Parameters
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpServer
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: T2
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{4797FAD9-D20B-54DC-98FE-7C614E1B1943}
• Value: Id
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
• Value: {050B0847-7A0B-787D-0511-780E0C7E1109}.job
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
• Value: DhcpDomain
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpIPAddress
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{BD2E97E1-0A85-204A-AB40-40B403D0844F}
• Value: Index
• <HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
• Value: LanguageList
• <HKCU>\CONSOLE\TASKENG.EXE
• Value: WindowPosition
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpNetbiosOptions
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\BITS
• Value: StateIndex
• <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618
• Value: jc
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpSubnetMask
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
• Value: DHCPNameServer
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
• Value: DhcpScopeID
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}
• Value: Triggers
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• Value: DhcpDefaultGateway
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
• <HKLM>\System\CurrentControlSet\Control\Session Manager
• <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\3013565826223049618
• <HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\BITS
• <HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
• <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
• <HKLM>\SYSTEM\ControlSet001\services\NetBT
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
• <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{b3797bab}
• <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29017980}
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\Interfaces
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{3B84A94B-68D0-41DF-9C58-9CD44ABFE648}
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
• <HKU>\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe
• <HKCU>\Console\%SystemRoot%_System32_svchost.exe
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
• <HKU>\Console\%SystemRoot%_System32_svchost.exe
• <HKLM>\SYSTEM\ControlSet001\Control\Session Manager
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
• <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\15233773854796355610
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\Intranet
• <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\ROOT
• <HKCU>\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe
• <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
• <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6aead233391fa002
• <HKLM>\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET\
• <HKCU>\Console\taskeng.exe
• <HKU>\Console\taskeng.exe
• <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs Mutexes
  
• X29d2562703480b92 IP Addresses
  
• 54[.]236[.]192[.]172
• 81[.]171[.]14[.]67
• 52[.]77[.]199[.]193
• 52[.]206[.]149[.]50
• 18[.]220[.]249[.]233
• 82[.]163[.]143[.]176 Domain Names
  
• zambi[.]info
• amous[.]net
• listcool[.]info
• monoset[.]info
• riyah[.]net
• dyn[.]com
• listcool[.]net
• www[.]hostgator[.]com
• dynarunner[.]info
• passportinfo[.]info
• bubblesetter[.]info
• hostgator[.]com Files and or directories created
  
• %AppData%\{39C4A9FA-8E6F-1E51-87DB-35E186454CDD}\B063E134-07C8-569F-D402-4219FE2A8B75.exe
• %System32%\Tasks\{050B0847-7A0B-787D-0511-780E0C7E1109}
• %System32%\Tasks\{BD2E97E1-0A85-204A-AB40-40B403D0844F}
• %WinDir%\Tasks\{ED590CE3-5AF2-BB48-A127-A8DCDA9B22BE}.job
• %AllUsersProfile%\617cfe98-5007-0\BITBA2F.tmp
• %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\72909457.t.exe
• %AllUsersProfile%\{BB098D39-0CA2-3A92-C225-C429A39F94EC}\61CC9F6E-D667-28C5-AA39-29C86F125189.exe
• %AllUsersProfile%\b3797bab\9c3ac369.dll
• %AllUsersProfile%\{37454187-212c-0}\BITA113.tmp
• %WinDir%\AppCompat\Programs\RecentFileCache.bcf
• %AllUsersProfile%\{769e331d-612c-1}\BITA0B4.tmp
• %AppData%\29017980\2fff851b.dll
• %System32%\Tasks\{4797FAD9-D20B-54DC-98FE-7C614E1B1943}
• %WinDir%\Tasks\{780B0A47-790C-7D0A-0F11-080D7808110D}.job
• %System32%\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf
• %TEMP%\{006714f4}
• %WinDir%\Tasks\{67D0E6A3-41D4-1B09-02A0-1F3933D2EA6A}.job File Hashes
  
• 4d675c5cd24ad1fb31b0e7f69527ff5bee4fb456f981cd71423bc967af6eed38
• 1886e03f7c9fa7160333467eb61afd49521477c246db67a4cd77eb328315bbe7
• b0c8ca8e4d3ecaa3f77760b7e7cac04185a96ed9001b563f969b8f24378da737
• 99b86f98266db8238315609f850af04f32967782f78470ab655217da79ade490
• bb448628a9c7f39f1704705c8bd27bf3b01ecca76ad1e540e511dbd72c520ae3
• 1749e2cac4f7c526e1dc32f0e96093cc823c581954e25ace5a479f1e19ef222d
• f9e0b981c4e51303f4b6f0199222e95b1d9a822dcf28f6d8ed27733d70e5448d
• e59262af5fa77645cb9c081efd5c9f95dc929a5211624528289413bdf21e86b1
• 871a9d8a090dc17a0f7f49e2aa382aadf7633530c53b4b9e77318d0dc7464d6b
• e802bb930657a5fad11f6f493f081f11c12b88859037636ab6aa5595af53a371
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Trojan.Generic-2-6449654-0

Indicators of Compromise
Registry Keys

• N/A Mutexes
  
• N/A IP Addresses
  
• 173[.]194[.]175[.]108
• 173[.]194[.]175[.]109 Domain Names
  
• smtp[.]gmail[.]com Files and or directories created
  
• N/A File Hashes
  
• 41d52ddff7d3b2135ba379f7988aba7ae535dc7e628f450aff841503b020efc4
• 63695a0a294612e6666006283c90fd86f64eff0f244cf559bdf488f2e4193041
• 69c10d78fd6a4accfd7533cab25068fc85113431445227ad9847ec3ca42f949b
• 75818e658a9a4b02897a5808a2ccea33cdb7afe8c6827b13b2b4e8805de1ce2b
• 787de9917c7871afb7c5b13ed54adc98a0b1507d104ccd25ef8573740ae08919
• 7ee01720f1c00dc3ed39d6cccc1a99cfb6f5d249f0df24a4669f2f729f9d8c31
• 93685a69cb9a78b6b86bfce0250019f8c08c6ee429b4effa895d1d84da2c0d0d
• aed337b11888de4ec146551c1bcae46e62c3d14b20e7387ed72d0f72bbe49c61
• b16228fa8feae74e5e751110b23ebb1c6aacc36cb6f2511d7e38f55c40703fd0
• ce510906b105627044b9f35845e75897f94f6530dcc1155eae1b1eb2edd49c4f
• d3a8088cd1796240c66110bc6fd964abac305d77071bda7f9040c88a45f6965e
• d48fd05d443a1552e6affab7cfc65eb7d804a0ebe80f4b7056b8685dd9e9c70a
• f3c143fe7856d71ea5a91c2d8bb96ddd4cb3c4c3dc7898d766be716cb4852da6
• f9ec96f821fe757421b1934675cce312e2bf42df4446416bcd0908653af7415d
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Virus.VMProtBad-6450060-0

Indicators of Compromise
Registry Keys

• N/A Mutexes
  
• N/A IP Addresses
  
• N/A Domain Names
  
• N/A Files and or directories created
  
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$RUI79S5.html
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$RANXEE8.txt
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IDBK7UZ.html
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R9SCMWR.lnk
• \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R7QS1I3.lnk File Hashes
  
• 66c9cd00579297128b36295f8c13cffb5a6d805f73e3086cabceaedfb361c37c
• 8ee03ed6082b418b4ea91cc8e63848ac8113ed29c65ec9e3403e8f1f90c41b4a
• a6660d922577539a08e5dc02984affea031b7bfea22b6bba53113fe2177fab06
• 7312bd55e79b5813ae8b064e0f1bc11592a79494a79e854626391e26dd2b6b7e
• a4cc65474efd0b0e3aeaee8614b397dbc9bd3ecf7a95a8526d8ac84ed3848ee4
• 4e2624a133a42107d3def6ae7ffcb5e1a5c372ca2d8638438a03a4a040802517
• b2e43a6ac8301d5304715b8528c40da58c5e2f473995738178d9f5444d52785a
• 135f254c202229f708d7e4d0eb36d4d14ed8b43029b994a0401327efb9f63461
• f9225972bdc9d23e545a4f530f79760913eba49f8a78e53fc6b361cee499547e
• 246569246bb8a4694f7b48e9c7abdc6e732b7e1c73b2c802c045d5cda03ef3da
• 67694e083c8b54090afe2a580da0242d9d05746953832b34af1c11290efe544e
• ecb1e4e860ea7612793420677588c7411fc5717825470c956f1e21c30b5325d6
• 59880ac464244c14deea6569d4d79377fec91f63b7951f137bd457985528f3f7
• e70aa134607b6e5c85dad94749e382afd11052d789dad93027756a8ad9c1b5cf
• fd7fe9120abfd3da2124357680acaf010d1768fdaa570e471b30207a4e8d9dae
• 28d599079555f858bb7496dc8fe8fec7fb450aa083f039e90a1c9e11ed7d9094
• 2e20f3dc237275d5579b96c46195aa05f79b206a356918a0e1bc990a42979111
• aeab4107c498f7ebb963452b3157c70fa36f7c0c6936067b89d6d2f2fdd7dd09
• c55447abc07f82e59c4573b50038117d494bc8069bd868e2f4755cea405ec104
• 81e852b22956bea616f384424f2ccbc60224bd497e0885b3472e1019ecd941aa
• 5aad686faa09afc69b067b67cb3db992820f96d3cadb5e160878255510194dc5
• 09c953e9fcc681daee3f311513308988048049bc687f3d10d9ae4e6462cdd4b8
• 0507d30d8ae08a46acbfd85e6c945530505509df8b4658a5d7b846c8eec51d0a
• e8e31878a125c47e835ceea2f783fe7938bc9882869a98d9d2cb67c756c8cf97
• 0412d1da28e300a2677e46ea1af64d664ee47f845336d1081d15df58d3e9016a
  

Coverage

Screenshots of Detection AMP

ThreatGrid