Cisco Talospublished Apr 27, 19:40 UTC (Apr 27, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for April 20

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article814 words · extracted from blog.talosintelligence.com · click to collapse

Friday, April 27, 2018 15:40

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 20 and 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

PUA.Win.Adware.Multiplug-6518212-0
Adware
Multiplug delivers a large number of files used to display advertisements.
PUA.Win.Adware.Linkury-6518171-0
Adware
Linkury is another browser-hijacking adware, which comes bundled with other software.
Win.Dropper.Temonde-6517997-0
Dropper
This is a trojan compiled in .Net. It performs code injection on another process to avoid detection and extend its control.
Win.Dropper.Chapak-6517991-0
Dropper
Chapak is a trojan, which makes itself persistent on the host system and contacts a server to fetch commands and potentially download other malware.
PUA.Win.Adware.Itorrent-6517988-0
Adware
This is a bundler, which installs adware and other potentially unwanted applications.
Win.Dropper.Vabushky-6518142-0
Dropper
This is a dropper, which unloads Vabushky, a ransomware, onto the local system. Vabushky encrypts local files.
PUA.Win.Downloader.Downloadguide-6517985-0
Downloader
Yet another malware that installs potentially unwanted programs and browser hijackers.
PUA.Win.Adware.Browsefox-6518209-0
Adware
Browsefox modifies the browser to display ads and change the search behavior. This adware is typically bundled with other products.
Win.Dropper.Gandcrab-6518210-0
Dropper
Gandcrab is a ransomware that was particularly prevalent this week. Samples were delivered via Word documents. While the documents were different, the executable fetched by them was the same for each campaign.

THREATS

PUA.Win.Adware.Multiplug-6518212-0

INDICATORS OF COMPROMISE

Registry Keys

<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
Value: ServerExecutable
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TYPELIB
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
Value: DefaultConnectionSettings
<HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
<HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\VERSION
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value: PnpInstanceID
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
Value: CachePrefix
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
<HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
<HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\WIN32
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
Value: CachePrefix
<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
Value: Version
<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: UNCAsIntranet
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
<HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
Value: CachePrefix
<HKCU>\SOFTWARE\WEBAPP\STYLES
Value: MaxScriptStatements
<HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
<HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
Value: Version
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: ProxyBypass
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value: IntranetName
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
<HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32
<HKCU>\Software\Microsoft\Internet Explorer\Main
<HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version
<HKCU>\Software\WebApp\Styles
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
<HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
<HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
<HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP
<HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
<HKCU>\Software\WebApp
<HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0
<HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable

Mutexes

IP Addresses

45[.]77[.]226[.]209

Domain Names

R2[.]JOBURNT[.]NET
R1[.]JOBURNT[.]NET
r2[.]joburnt[.]net
r1[.]joburnt[.]net
c2[.]allocal[.]info
c1[.]allocal[.]info

Files and or directories created

images\progressbar.gif
%LocalAppData%\Temp\2eB3B1f\steps\1.ini
%LocalAppData%\Temp\2eB3B1f\steps\3.ini
%LocalAppData%\Temp\2eB3B1f\images
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\SCREEN0[1]
%LocalAppData%\Temp\2eB3B1f\steps
%LocalAppData%\Temp\2eB3B1f
images\loader.gif

File Hashes

93289f85a27f71089eddea6f139d7c41344d318f411850126d75ea51aff6733c
3c2c480d23acacf31423e2b78520f88bd3bb0b481d2f43840aed1d16d0987f93
598c1ca12fb83aaeade0b19ad6d18ed680c011ee085c0798eda44b97aa38644b
fbfe94ed1d3d11dff22ebccf7a80028f3052e863aae2b095bd700773a4d5d123
a9eb76def683a0ffba1ab2704c40715d133fb6884121849096fcbaf8b3e65541
ee92af9885b7b962d550b5c559001b71d3a5186c63edc2b84c6ee0a3d11f6038
1c6c368211a29b5f69ff64da32147ba4241f62fc77d02e66e98873b024bb2046
d0424200836fda85e802c7c0e16aa1bcff1f9dacbc7524586244bf0c55b4c83b
f5d97121664e2df180bb286d808c899ff085bf67ff42e8cf4573f5a14be52b72
14aee87a92ec1fc11211f5b52f6fe0c8f94c724a5a14b6ea0957ca25dedb0892
b8688655f68b5d395cb4914e711e1995b4123688412d7fe06372cc3c0c8267a7
74ef0193265e7ca2e353a75f51fc81324669352775db867030b77687e65316f3
5de9d6ebd6d3c90d5819259d4c2f8bd646a861c36d090cc955c2408d7924ee9d
35a21ae4f4cdcf2681697cab80dae2a19cdd27f978e2e4875199967b100bb69c
0cf84cd5e553946d61bba2ec1e0c6b988c63dda6fdfe55bb70d0e742781bdb15
e1a04d38648a472cfd5a87fdfaa480d2e38bcc88bda3b3e5181bbc1a2bcbba9d
b193e85ec1b01e95d0a4575093868f92b0179ace355b78d7f6c87541fe68b370
ac605db020addf7d28c6f919aca656cc97df7771801748b78d68a34fc2c07721
5afa83ca67022bc19477b014e20b4613e93b3a595dfa5f317ec9d602135aa21d
68fb06e263e78d0993d69c574c8508ee9fab8289310ec22542c4a686c2fbbc11
632e9c757e6a7ff18b8d382161af1fd6491eb8650fc12079cbcb617d624423ae
cc80abc53d7720b98517f8a2321f457cd7b7a250f7ae8cd45846bab1c2558a50
16878f5289a2acda314ede318c644f4a3c271f1495e6d4bea1493aa2e3a88a36
1caeb8b04af0bffe857f6f7617f01d82f20177fb1a6913d46b974f62aa20ce2a
f8abce29ef422582ed920d36d26be5357041ceca2297442c931f70a7e4f9c8e0

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella