Cisco Talospublished Mar 31, 21:18 UTC (Mar 31, 2017)ingested Sep 10, 06:19 UTC

Threat Round-up for Mar 24

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,131 words · extracted from blog.talosintelligence.com · click to collapse

Friday, March 31, 2017 17:18

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 24 and March 31. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

Win.Ransomware.Cerber-6162243-1
Windows ransomware
Cerber is a popular ransomware family that continues to undergo active development to continue being dropped in the wild. It still drops multiple ransom notes, including a desktop wallpaper as a warning post. Unfortunately, these recent samples are protected with heavy crypters.
Win.Trojan.Wabot-6113548-0
Backdoor
This is an IRC worm written in Delphi. The code is not obfuscated. It drops several files in the system32 directory, and a text file with the word "marijuana" written in ASCII art to the root of the system drive. After waiting for some time, it will try to connect to an IRC server and join the channel '#HelloThere'. From there it receives backdoor commands.
Doc.Macro.HeuristicReplaceFuncs-6169546-0
Macro Obfuscation Technique
To prevent quick understanding and basic detection of malicious macros developers use different obfuscation techniques to hide the macro's functionality
Doc.Macro.ReplaceFuncs-6171292-0
Macro
This sample is a Microsoft Word document that uses a macro to launch a PowerShell script to download and execute another executable payload. Unfortunately, this secondary payload was unavailable at the time of this execution report.
Js.Trojan.Diplugem
Adware
This family installs browser extensions in your browsers without your permission. It's main functionality is to show advertisements in different ways, such as opening tabs, potentially interfering with usual navigation.
Doc.Macro.ObfuscatedObj
Macro Obfuscation Technique
This obfuscation technique utilizes macro string operations to prevent direct static detection of the string WSCRIPT.SHELL, which is the object used to execute commands outside of the Office system. As an obfuscation technique, these droppers are being discovered delivering payloads of all sorts and sizes.
Win.Trojan.VBCryptLaser
Trojan/Info stealer
This malware is mainly an information stealer and it is able to detect an instrumented environment such as a sandbox. Moreover, the malware injects itself in legitimate processes and it persists reboot by invoking either Javascript or mshta . This family is highly obfuscated and considering its behavior is a variant of the infamous Kovter trojan.
Win.Virus.Virut-6171773
Virus
This is a virus which is well know for opening back door on TCP Port 80 using the irc server ircd.zief.pl allowing remote attacker to download and execute additional files. It's looking for firewall and antivirus instances, as well modifying host file and internet explorer proxy settings.
Win.Ransomware.Spora-6172235
Ransomware
This ransomware is encrypting files and not adding any specific extensions. It's also deleting volume shadow copy to avoid system restore point. It install a startup link and modify internet explorer proxies and create an html file with a dynamic filename. One difference with other ransomware is that no network traffic is generated as everything is done locally.

Win.Ransomware.Cerber-6162243-1

Indicators of Compromise Registry Keys

N/A Mutexes
N/A IP Addresses
54.87.5.88 Domain Names
api[.]blockcypher[.]com
hjhqmbxyinislkkt[.]1efxa8[.]top Files and or directories created
%APPDATA%\Microsoft\Outlook\<RANDOM_FILENAME>.8a2a
%APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_1YI7CF_.hta
%APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_2NN4UMV_.png
%USERPROFILE%\Desktop\_HELP_HELP_HELP_J81LBSA_.hta
%USERPROFILE%\Desktop\_HELP_HELP_HELP_L1JAF_.png
%APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_6MTGJWJ_.png
%APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_LKCGK3Y_.hta File Hashes
dc184001af08dd043150c350c94304041b2c8e995ce62f05f846d776b450f80f
57288de46d603910b1d6eb88390a4b7083b3f060e75bd76023a8a13f7c40633f
c0ab4ccdef7ad4fb6b1af396a29cbb4220dc720acfec091fa5d6484656fec63f
ca7d955a40f2d7a969245884fffd0189402b05af3f9896d10e476cbdaa1b0829

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware screenshot(s)

Win.Trojan.Wabot-6113548-0

Indicators of Compromise Registry Keys

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
is changed to point to the malware binary Mutexes
\BaseNamedObjects\sIRC4 IP Addresses
N/A Domain Names
uk[.]undernet[.]org Files dropped
%System32%\sIRC4.exe
%SystemDrive%\marijuana.txt
%System32%\DC++ Share (several files are created in this directory)
%SYSTEM32%\xdccPrograms (several files are created in this directory)

Coverage

Screenshots of Detection AMP

ThreatGrid

Malware Screenshot

Doc.Macro.HeuristicReplaceFuncs-6169546-0

Indicators of Compromise Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
www[.]cleverdotl[.]top Files and or directories created
N/A File Hashes
d183f2200ed5f510888a80e95d99aa5a3c8408dee7f0c9b8330fc52fb0592dce
ee6284d966eb9f510a1b44ef6ba435048729c8ce8a741fb33575d5b1b6d347f5
bafa3a9e5b2f290eabce23811c6309209d281f31bc6eee25b4eb739bce1800ce
1480d45ed9841d055e4e04ade87f7785b3006fb62c8060616ed7507185df2b77
13d61439ede67b78a536ea3c510534db0ab7d295ef1275645b7981814909d0db
b70497f0e50fcbfe83a7b92021db30e14f3fd6a829ab9948f828d46048cdbdd6
42ddcf96146d3be84bf36abe71fd6780abf79aa1ccb2ba65093c9b46a3d76b03
1fdb9f23b2d7dbe849f38f79f88449fe3f327e76585b202d914718036245c469
9948928059c4676f6b6f8519fc39eaab89a027159577dbc3ceac4833ef35167f
3fd05d08c135075d2f4a72652746bc42e359b9d1658d4f3b41d5f95bb7216649
db7d22c806ca4a305a317df58a65bef8e2195bb0a8ac223313a8a18c37f5c143
5ee9f3b87db48f41eaaffd9a7fc9cc76920dd498237a23e1ad7585f4e2be02d8
6dfb35527b23ca769510228498c8de68cfc93d5c2b83246d8e9b338d2717481f
fe257b7da01cfc247564f2e7b36b19b8af548c2f3ffbee2b9d8d552a71502d78
dec3c2f1b1de6d70fc566f036ab320decc88ed5418e429feae45189e458bf5e4
d4175848a03cab54f856d41c51ac4ede18c01382a5ebc4ed40c4e27f2e45244b
c19a7af6c3846bd433765c027149ff838482a55624a5e603d395ad83d6f24129

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware Screenshot

Doc.Macro.ReplaceFuncs-6171292-0

Indicators of Compromise

IP Addresses

35.166.163.174Domain Names
otweeytl[.]bid File Hashes
77bccf5e4175d11971399f89abe0256c230e1757a3d0804737b14a0ac839890b

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware Screenshot

Js.Trojan.Diplugem

Indicators of Compromise Registry keys

USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit\command
USER\$UUID$\Software\Classes\__aHTML\shell\Edit\command
USER\$UUID$\Software\Classes\__aHTML\shell
USER\$UUID$\Software\Classes\__aHTML\shell\Edit\ddeexec
USER\$UUID$\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aHTML
USER\$UUID$\Software\Classes\__aHTML\shell\Edit
USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit
USER\$UUID$\Software\Classes\SystemFileAssociations
USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML
USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit\ddeexec
USER\$UUID$\Software\Classes\.aHTML\OpenWithProgids
USER\$UUID$\Software\Classes\.aHTML
USER\$UUID$\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aHTML\OpenWithProgids
USER\$UUID$\Software\Classes\__aHTML
USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell Domain Names
getlikemobj[.]info Files and or directories created
0doGTj9XEZ5tbV5.dat
0doGTj9XEZ5tbV5.exe
UtE5FnEWw87hxH.dll
UtE5FnEWw87hxH.tlb
UtE5FnEWw87hxH.x64.dll
background.html
content.js
lsdb.js
manifest.json
uui.js
bootstrap.js
chrome.manifest
bg.js
Install.rdf Installed services
regsvr32.exe /u /s ".\\UtE5FnEWw87hxH.x64.dll" File Hashes
0333de69ebe7ef58889c39c6ee10b33e8fa4299849c760e6f018bac5ae2212aa
9eb18b9091281aa25afa4ced079024a043913e179a03947f73dabe121f36dc2b
07e32a2e78410eb73f525032636894e82193d5806c85a132c7efd31a76abc862
a441bf44fec8d08481920e240281afccdcef2f0cfadb681b7b6ce50be495fc01
0aa8272fc12da7273cdc3573ee4e78849fe187f01eca9cda4b7941de99d8bb83
a6ac9b2e5211f3feb41a91a5c82992de483b56c142dc35e84439a965c8250f50
0591e02001c57dccc0062765240c0766fd24a2fb0af37a6e32a211ea202074b3

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Doc.Macro.ObfuscatedObj

Indicators of Compromise File Hashes

Please note this is not an exhaustive list.

00151e030408a5183d92132652d5a0c5eb2f9e073209cb7ee12060312c5f400c
01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403
033f7a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c172be4
03ade17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26c9fdf
08aed8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c991b4
0a3693404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7540ff
0cb8d7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546b7ab8
0d1fd8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335db7966
0d69b76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1aa96e
125df53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41df237
12b9b3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495cba580
19642ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2350dd
1c438d063a759da25a2517d4ca81f92606225d372143c978fa30cd4769025863
1d4d3da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c11de4
1e316a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421c09a1
1e7ffa8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdceaacb7a
1f49b218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a37f9f
25d93ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3fb776
2bcd02fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac2f4b8
2ca2cc8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d2635f260
2d8900fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b21881
2fe88a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c46abd2
3393ddf44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445a9ecb
348aee4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d7236d
35582cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8ed32d2
368fc1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab2d9ff
3739cb9ef330544fc349da2c9cbc66151205904f625acda85bbe16152943830d
3a01219542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253abf94
3becf2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d02416
48b565b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98fa281
53c50bf3bdfa58b66565071e82bb7ba40ac3cc344893b0aeeaa15502483ec3f6
54b5776a210ac4b6a00eca3efa2f0b665616f706a813cf29fe2ecf19cd90887c
5549e374040cd995939b24a8095c74e9fec188a04ca9a0189a289d3be0bfdc37
5617e4b5e25a41d5a491b3e36fcd165a1a7b999ea0de567ca63baec40b757ddf
5854de47ff6fedc84cc6fb73760763b8e427164bf3369e89d3e4b3b42483103d
5b34c3c2ec780258644c3245693dfef254cb91716c35ae33937f637bd8e04978
5d996e33e92e6f7b83867ccad52be72274bfd79d964bc4988043d91231369650
60979006e12a42b7f781adb2b1f8fe05836db0683abe0efc05b822dad5d1a9f7
6556d7052f3c3fafe15aa3ee81dbbb4b1caee88fd7e65788c1f90bfd940be7b0
69e7d856dc8e0b5508b8a4050c36451a0dc0164b856e1bd1efdbc6f8ec6de66e
709fe7d54e5ba52f2e45c4c62fdf1636ed64be0ae367bd992eb212aa234200cc
7120ecc9c04b8f9d93829210f3168b14cfecd45dec52478ff87d0ee86324cc0c
71715f32e3cb54756b39716f8dd33c503eabbb054f4a4e82d5e2b9a9b96ed46f
77d049ad71ea81f13e89d82ed398e59e95085d10cb0041eb6ef5ed48c0fd95e2
77d11af8d4b7f9e48764d285e801f1db3d7dffcd6a0ba17bb9bb75c178227b96
7dc0651c4258b079fe68acbddfcbedd89a94448bffbf4ca93c231fca171dda09
805d74474a13e5a3be13c73bb1d0dbb1b33dfc9dcaf067b4aea5d2a8584a29eb
80a05b5499539e7bbdd3dd34f04a940c5d36f8d44d7725c6530bf3872966a27a
85d95919960cab3788b587008fa49b61c230bbbe28cd9d000f0cb179abbbb0f5
896dc5b55cd8c0e160dc52ac9b21ed4c46da22ed3c369eb5dee856edb88f46e1
8caf0f703a108a6fec8d55e8f1a028814a3f26afb2f8a58a96576e1042f99874
8e8cd4aefc8422ba176d009d90ddcd65f72161a2576ab443f69480bb30050825
8f9292e116fb2a07838724e648e17d2a5e5e3e074232dbd83bfe624391acafee
9009b9ad9547af92f68b01f09200a043da6be1a65b274129a7c47532f3f966b0
99d311cef89fade4d29e3e33df256029841d59d2ee06579dbeac2c9519ef7cb3
9a80fde74d9e7674be309f44f6fa7b5e53f34a0d6f2fcc084d733c42bf95c4a5
9ba0d666293490f051b1612e6c8bd635dc382ae4e931fff5fe9ba7fa926d6b82
a32c4d11737b59236b47b73fe20952a3827593b52f241100ba77648e60e1d42c
a49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62
a69f4d4eddbd656a6ae061cc001ae245db87eced67015365cca1834179845290
a8a449812c89915a1872aeed6424abdf7fc1f4b8d8ae35deee3f3c04104c2a79
a9e9af82ef11cc51091426afd0784ad62c57dbeeecccd566f8cdf6be2fd8258e
adb6155ed8d5b3e7c4a2c6fc58108382313b05f171336c52cb1ae7119dfee540
ae01487921a5e8538f1599c3b0d467328992b32aace53b776180c6071bbae2fb
aeb6e8a86ce9c7a9cfc0efe82038932ec1c9ca150279f151574233777b4ee69f
b3551d5d465a7e7315a5c5ad15c99393f1dd77732ff2ddcbd96c0907c3b6e84b
b402f8acfdbfd194baa2736b45b6529dbc2a6e523f7a7f15470765019387eb6d
b47ba806ce07000e7fc3365da81afcd6783308e2077391f80e3a272d8090d95c
b4d192f5122872145142b32a8c11253d70c83a5c23963da0c7f3408593e81238
b55375ea1eac3f1967483e18c6b32cb5332d281975d54913c6fd3156129574f0
b5df216db89067df157bab2c5e0042985e03aba5d1807551a069cf800b21d385
b5ea73190ced08e3694d27d298a69f040cf70b05f21812f60334444102eb875e
b798f6c32168e8c598af8b795924d42334dc1dbe9d5888125e39c0d3f03cda69
b831e804d52760572bb4f77d9b62a2da6bbd6c7c4f5ddb0f1b5731e47fa784e7
b9dd997c2f141fc0dea676b42dd962050f2886f2a1398a14f8e91498486eac90
bbcf611f3d1da4aa31cd953d7372c50d8ce9a49af8664a86eb804adad390f0e6
bcdd7ae916d59519521e9c3e96980092c0ad84db98b1f1301eee6899fa599769
c3a0e9b007795db909245c18f597b4ece53dea011b088abd4f0717208dd3253c
c3abbd74785fa3d8eb51f0f99fa568e566f864244ea2f4fda9971cda661036da
ca4607f2cabdd6d3693ad3405085abd1e92112cf7a9fe56a2e52615778bfe79a
cb10ef20a93542eb0e8ec1e9c921ad120454156c8ec5e431b3b1afa27afd8bbc
cf0ee89b626684ed9f9f60823531dd1ed38cfd46395036209a274cadaf123575
d10fa5c1a6bd4da0a3f9d0ee605fa906db9a7e0fe2cc213339d5af8cbee80855
d20e3bad471429f04e0ca1b28fcf1177cac689394f39dcb20379935dbea883cc
d314d825d85787833886b1a8c4cf882f8b25f268206e23372cdf3cc67d15e162
d543f49808fc093e31f8282407d2b520678f041a5c43646b235116743b2e0eaf
dafaa5c3d3ef49d1f17027cd33a6172b4ac35defaa12f136503200104eebfa1c
db5e3b35e653690b164bb3aa7f9e8caa9e77f9233d846fbda27f616eb7334aff
dccc34da745ee2d9464a643be8b4239f3f592498d5362b29dedb30c259878404
dd926e46cf871d98cfb025896bbcb5a5c71025f5573f5ad1eb0ee77aa3bf5546
ddc9d38524dc6f2ac918c5f0cb251cc2916f063835414bf34a58cc0c997acccf
e4921ad4b0561e8c4dfbe0f72aff53d9bc06eaf177a9dbca7e538a6f1312ba1d
e49328097b3531fb8981531e931b3cd1e2adcc22c8a89781260e0bd779705143
e96d823ab4de0dde23a564e327d610d933051d6664df685278f85e6d096e25a5
f3f8905a5ddc3074a367095a51662d4ac434dbe9e680d0b94bfa71f6b5875329
f6c8e3c90fbc309e3d25c7b08609684e7ca16d93d7a568b702910222af9a4d4f
f8ca6ffd131b738a30c90b486a839010a85a31d7675e090ea1c850529962bdfd
f969874b93e7cd1fc2b14a750e4cc8fc778f70e9991a3109ace4e188d568442a
fbeed70655a2eaf30ca878e1ddf4985a99a767a014adcd00a2150cc270315fe7
fcc6f903c83a63e8579d1db1940d23294a13a288960d9d07052d978dff9b9e8c
fe592fb50f84f5a8f10fd14a2a01a0c167a11c1c2242196e2b626a581ca5ac28
ff198bf3509d1ff43c5529fdd16b160505117bec958363e7e385b4ca1bb4dc73

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Trojan.VBCryptLaser

Indicators of Compromise Registry Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DisableOSUpgrade
This key is created and set to 1. In this way, the malware prevents any OS upgrade
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\OSUpgrade\ReservationsAllowed
Key necessary to disable any OS update. It is set to 0.
HKEY_USERS\Software\[a-z]{8}\[a-z]{10}
This registry key contains an encrypted copy of the malware binary.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The persistance method invokes at every login Javascript code. Mutexes
N/A IP Addresses
185.117.72.90
12.190.56.53
104.193.109.67
133.28.94.49
19.131.186.114
109.152.13.49
46.248.138.70
36.150.95.154
151.126.133.167
49.117.103.250
145.85.32.96
244.159.110.110
8.19.53.244
218.255.128.133
110.200.102.30
161.133.250.103
216.115.112.112
93.10.53.55
214.28.222.43
194.59.147.179
206.213.193.26
140.192.50.4
170.54.3.5
202.161.197.181
3.166.202.197
187.23.153.218
69.81.37.149
138.142.156.77
97.207.252.167
153.74.137.236
32.144.23.231
203.4.193.199
193.212.108.131
27.32.23.117
116.67.48.94
236.43.120.190
248.100.151.74
140.178.134.108
71.40.250.251
2.170.194.13
188.121.121.90
103.182.107.224
238.44.206.248
185.196.78.227
241.117.137.46
27.184.52.156
17.100.187.246
142.159.223.136
53.154.160.76
74.112.68.147
150.158.250.75
153.11.186.249
83.172.78.89
89.50.100.129
252.84.7.113
112.84.131.231
156.116.8.163
109.137.79.244 Domain Names
puresourcecollective[.]com
appollobafh[.]com Files and or directories created
N/A File Hashes
2acfab58519552eaed08a1a40cf92368e28b3a665b7d6851b47e38f2bd8f598e
3e2f71a4dd6bc8e866325ccee3d780b029532e83d5aef69825d1a583205a6f4c
455f53b882d1648694d8b8cbcc625c2ee2a5f7400f0db70bd7385284304751f4
56ded612854f90cf5ba70daba78308a9e46198444ea3b63b0c2707c6776a1b4d
58f3fd45631a08818d44c8c7f555f46d2817d4ef804a8faf80c47faa388e436f
68f3ed6d61556fd899e95d2b5b43a266cd23fb763b6e1f02dff2e2d62a27a41f
6a9b132e407edec1c06ebec33a47ff0a1f44968679f88c2584c380d033b748e3
c2bacb6a9ddf8eca886f083c9f52d8979cfd29b3f0b97fbb0c76ca86373562a8
Faa87134b84133b85c42cb1997c96b04021b2848369599e555b100981fbc7cad

Coverage

Screenshots of DetectionAMP

ThreatGrid

Umbrella

Win.Virus.Virut-6171773

Indicators of Compromise Registry Keys

N/AMutexes
N/A IP Addresses
N/A Domain Names
jl[.]chura[.]pl
sys[.]zief[.]pl Files and or directories created
Modify host files File Hashes
a477f53caa2a04835db7e3e02238fd90b92930738e6d512543bb4b6114b28d81
ef1070106dbad598487ddd22a8fe7d40d8cc30a49e8c48d19ea02c76497a062c
7075a7fb70a46dc02460abc92b890b6e9f43ab20e4d47d16435dc133c218cd42
128debd4fa18c3ad5ff49925ea3d8a3ccd013e82950cde429b09e8d58878f27c
1319090b4d1d8b9815005585ee3fa15ac1df4f2eca0e22e22bc317e52a520c4e
bd92f8a83f0fbebc76749c41916fa212b75b386386c25e1203f53657adf07aac
6d71a5594dc5adc2bab1fd2ead630a705c7c0e02e2a5a20994584a1fb1effa4f
ba9cdbb4b0f43daa78bd8cb9cc4f842fb970bdbf0ed012760a55e2df34778232
fbb151befa1d287d49870fa9fc6254036452c4ca3e80da7bb19d529a8a4382ea
6f1cebb94490adcd133bba22a6ba9aafce96d84c76dc4007bbe5ff0c83431462
1f6984b9f0dc7009a91577b3868d8980c5ee47a161559f56878e5e80424e01a7
a2d5c82fe41f613c159d6952c9ff3aa2a1b059ce4692e20292ba2e01effb2e9e
62796ad8ede80f59beb4f4b40d68cc4e5477cecd10f2b7993d25cdeac9535bd0
1c752622d01064f0adf1962e1d5671cff249be495bea9bbaf200fdfd2124f9b2
db97b4f3aa56a8111d007c2581379d827e97994843d0d7b4d461ba151db52988
b0b0ae2afa85dac9f3d289059a06cde24e33308dae64f11fa3ee68a93f8a6b67
6e27d1b6622efc68e98acc87e9356a78af7d942e0cba0d3aa97809cecec6bdf9
2a0ea00ae1634818d3d84d699a54ad9cb28c71dddf24b0340c9a6b1449d2d966
348713e66c6ddc09dbcf95ca50cfe384987031fc787249fa14d10aacdb3b7e1c
d754e1fac2ae13b1cbc6d7beec8f37c1f304a52120e6e6878b06d8183f659c17
0e653eb48d3718b3abd3459386795a3802bde8aad920a33cc2d8d632138b0a61
8e431f2bf003132434c5fca097c60240fee7f1e9ca30bc7a063dabcd7d902841
683192a27d4316eb1073522de5fb3fa1e3923b5e7d6cdb979d4bd82ed317fa47
8f0058f2fa085a4cf8ee5dc01250aa18dd624187d527b5521438cfcda2a4fbe4
b89927a14e2e54b2bd917904b38737ce96f3bc004215c5a0486fc0a96a6c47d5
ebf6f32cf12e0839338564a6edef3d8ec8b7ebd1d93bc09c3359a69a4803460d
68ef4a3024eeadab44169cb292f897e66e57342dd65c9b63fda5fad6cb517e53

Coverage

Screenshots of Detection AMP

Umbrella

ThreatGrid

Malware Screenshot

Win.Ransomware.Spora-6172235

Indicators of Compromise Registry Keys

N/AMutexes
\Sessions\1\BaseNamedObjects\m[0-9]{9} IP Addresses
N/A Domain Names
N/A Files and or directories created
%APPDATA%\[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z]{5}-[A-Z]{5}-[A-Z]{5}.html File Hashes
f8bf2eb6481164e4a8cae0dc1114044a9ba81d41350edd1be19021e2cbdab749
5e7a7f4ef9ba326e3650c4ee58bdfafb3661fa50f680d78d5868240120c553be
b64639ae67147ff584507627713db60baf8050cedb9a7e4d3b68b521ca54ad36
e849051316cc2cf869f80f66cd2b48b436d51cc7544bad3309774aebf101c889
81cc065fc899b98f774708d8176ad4319311ff8643138705b24fbeb439f6e0d0
6c191a684907ec323516c837f66cd7331acbdad65220b73dba9307dffaa284f9
8a8ebf400b190a6fabf6d0e5f6756dfd1d856395161e522a7efe43342531894e
ec31d44d1c2eae34897001c41e14ed26c03d8acaabf00ee31183021f7a2fd141
e1a3784ef065cea4a8c8402015028494c18e3cd235cbb13785d269452376b2f1
9232ac662ebf2460bc2eb68875b548eb2547f62c5f7799861cfc0bebf5bf1e53
23a91bb1cf1019f1b6aabfc249df42b57a76d78d09a33b39441206d62f416fc8
b3b489585e8d6714ac05b79ae3e01cf3c93e51ebb5d16ccec2a6afcf4eb4c325
c0f7e40dd057ab32aaecad7df71b22433ef7474a57e5a2e58ec7fd613dfc30b5
a25bafcf74304d56beeb5395a0f801a743e27381ca95626f4720a48c966e3129
66449dde7d12706fb9ab6aafd690e077f5f37f11aa8b372a95d9e962763c7bc1
e1f992137562f1cfe5d38f57f36ffac76dda729e102b6abaedda89970ba8c493
6072804f727f1f237b4fcdeec9428449311d3cc54d9e0d284a68d300f3c858f6
2432fad4d84816155ea80075d686896de32304c8f453c01b029ad21e7eb17b13
9c93758e4b5767edaebb8bb39e0b7566715e2b610d2117bc6e1acf2578c973f5
67342ca4bada435d4e8d03d65342434f70909f54d4951412e18c49aeb72dcf47
346cf5120e5d1512f879d14111254ba68e3eaa3d3ea6f02977cd835725521984
288384c983496978fdda879847525e26194761394d62febeb922284cbeba0c9d
722b92a1f10fd2cac878ab7f9e3a120d656a245e40cc13a0bc619eb63362768d
5a011ceb0bf539ac5cc7e89b85dd7b742d94093fe84153d647fa18f16e7cac06
0304ce1dbaf1cf933f7d63dc559101b5899af7e07fef52abc38de430a428fce2
1f63371f2b2a5f340ea3c4d211b1fe0d6197e3a00e87cae49e873ae8964e8810

Coverage

Screenshots of Detection AMP

ThreatGrid

Malware Screenshot

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0324-0331/

Type	Indicator	Context
sha256	00151e030408a5183d92132652d5a0c5eb2f9e073209cb7ee12060312c5f400c	ise File Hashes Please note this is not an exhaustive list. 00151e030408a5183d92132652d5a0c5eb2f9e073209cb7ee12060312c5f400c 01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd51
sha256	01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403	e030408a5183d92132652d5a0c5eb2f9e073209cb7ee12060312c5f400c 01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403 033f7a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c1
sha256	0333de69ebe7ef58889c39c6ee10b33e8fa4299849c760e6f018bac5ae2212aa	regsvr32.exe /u /s ".\\UtE5FnEWw87hxH.x64.dll" File Hashes 0333de69ebe7ef58889c39c6ee10b33e8fa4299849c760e6f018bac5ae2212aa 9eb18b9091281aa25afa4ced079024a043913e179a03947f73dabe121f3
sha256	033f7a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c172be4	4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403 033f7a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c172be4 03ade17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26
sha256	03ade17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26c9fdf	a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c172be4 03ade17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26c9fdf 08aed8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c
sha256	0591e02001c57dccc0062765240c0766fd24a2fb0af37a6e32a211ea202074b3	b2e5211f3feb41a91a5c82992de483b56c142dc35e84439a965c8250f50 0591e02001c57dccc0062765240c0766fd24a2fb0af37a6e32a211ea202074b3 Coverage Screenshots of Detection AMP ThreatGrid Umbrella D
sha256	07e32a2e78410eb73f525032636894e82193d5806c85a132c7efd31a76abc862	b9091281aa25afa4ced079024a043913e179a03947f73dabe121f36dc2b 07e32a2e78410eb73f525032636894e82193d5806c85a132c7efd31a76abc862 a441bf44fec8d08481920e240281afccdcef2f0cfadb681b7b6ce50be49
sha256	08aed8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c991b4	17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26c9fdf 08aed8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c991b4 0a3693404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7
sha256	0a3693404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7540ff	8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c991b4 0a3693404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7540ff 0cb8d7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546
sha256	0aa8272fc12da7273cdc3573ee4e78849fe187f01eca9cda4b7941de99d8bb83	f44fec8d08481920e240281afccdcef2f0cfadb681b7b6ce50be495fc01 0aa8272fc12da7273cdc3573ee4e78849fe187f01eca9cda4b7941de99d8bb83 a6ac9b2e5211f3feb41a91a5c82992de483b56c142dc35e84439a965c82
sha256	0cb8d7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546b7ab8	3404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7540ff 0cb8d7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546b7ab8 0d1fd8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335d
sha256	0d1fd8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335db7966	7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546b7ab8 0d1fd8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335db7966 0d69b76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1
sha256	0d69b76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1aa96e	8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335db7966 0d69b76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1aa96e 125df53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41
sha256	125df53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41df237	76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1aa96e 125df53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41df237 12b9b3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495c
sha256	12b9b3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495cba580	53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41df237 12b9b3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495cba580 19642ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2
sha256	13d61439ede67b78a536ea3c510534db0ab7d295ef1275645b7981814909d0db	45ed9841d055e4e04ade87f7785b3006fb62c8060616ed7507185df2b77 13d61439ede67b78a536ea3c510534db0ab7d295ef1275645b7981814909d0db b70497f0e50fcbfe83a7b92021db30e14f3fd6a829ab9948f828d46048c
sha256	1480d45ed9841d055e4e04ade87f7785b3006fb62c8060616ed7507185df2b77	a9e5b2f290eabce23811c6309209d281f31bc6eee25b4eb739bce1800ce 1480d45ed9841d055e4e04ade87f7785b3006fb62c8060616ed7507185df2b77 13d61439ede67b78a536ea3c510534db0ab7d295ef1275645b798181490
sha256	19642ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2350dd	3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495cba580 19642ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2350dd 1c438d063a759da25a2517d4ca81f92606225d372143c978fa30cd47690
sha256	1c438d063a759da25a2517d4ca81f92606225d372143c978fa30cd4769025863	ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2350dd 1c438d063a759da25a2517d4ca81f92606225d372143c978fa30cd4769025863 1d4d3da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c
sha256	1d4d3da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c11de4	d063a759da25a2517d4ca81f92606225d372143c978fa30cd4769025863 1d4d3da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c11de4 1e316a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421
sha256	1e316a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421c09a1	da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c11de4 1e316a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421c09a1 1e7ffa8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdcea
sha256	1e7ffa8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdceaacb7a	a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421c09a1 1e7ffa8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdceaacb7a 1f49b218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a
sha256	1f49b218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a37f9f	a8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdceaacb7a 1f49b218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a37f9f 25d93ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3
sha256	1fdb9f23b2d7dbe849f38f79f88449fe3f327e76585b202d914718036245c469	f96146d3be84bf36abe71fd6780abf79aa1ccb2ba65093c9b46a3d76b03 1fdb9f23b2d7dbe849f38f79f88449fe3f327e76585b202d914718036245c469 9948928059c4676f6b6f8519fc39eaab89a027159577dbc3ceac4833ef3
sha256	25d93ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3fb776	218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a37f9f 25d93ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3fb776 2bcd02fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac
sha256	2bcd02fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac2f4b8	ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3fb776 2bcd02fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac2f4b8 2ca2cc8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d263
sha256	2ca2cc8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d2635f260	2fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac2f4b8 2ca2cc8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d2635f260 2d8900fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b
sha256	2d8900fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b21881	c8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d2635f260 2d8900fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b21881 2fe88a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c4
sha256	2fe88a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c46abd2	0fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b21881 2fe88a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c46abd2 3393ddf44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445
sha256	3393ddf44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445a9ecb	a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c46abd2 3393ddf44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445a9ecb 348aee4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d
sha256	348aee4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d7236d	df44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445a9ecb 348aee4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d7236d 35582cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8e
sha256	35582cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8ed32d2	e4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d7236d 35582cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8ed32d2 368fc1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab
sha256	368fc1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab2d9ff	cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8ed32d2 368fc1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab2d9ff 3739cb9ef330544fc349da2c9cbc66151205904f625acda85bbe1615294
sha256	3739cb9ef330544fc349da2c9cbc66151205904f625acda85bbe16152943830d	1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab2d9ff 3739cb9ef330544fc349da2c9cbc66151205904f625acda85bbe16152943830d 3a01219542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253
sha256	3a01219542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253abf94	b9ef330544fc349da2c9cbc66151205904f625acda85bbe16152943830d 3a01219542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253abf94 3becf2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d
sha256	3becf2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d02416	19542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253abf94 3becf2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d02416 48b565b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98
sha256	3fd05d08c135075d2f4a72652746bc42e359b9d1658d4f3b41d5f95bb7216649	28059c4676f6b6f8519fc39eaab89a027159577dbc3ceac4833ef35167f 3fd05d08c135075d2f4a72652746bc42e359b9d1658d4f3b41d5f95bb7216649 db7d22c806ca4a305a317df58a65bef8e2195bb0a8ac223313a8a18c37f
sha256	42ddcf96146d3be84bf36abe71fd6780abf79aa1ccb2ba65093c9b46a3d76b03	7f0e50fcbfe83a7b92021db30e14f3fd6a829ab9948f828d46048cdbdd6 42ddcf96146d3be84bf36abe71fd6780abf79aa1ccb2ba65093c9b46a3d76b03 1fdb9f23b2d7dbe849f38f79f88449fe3f327e76585b202d91471803624
sha256	48b565b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98fa281	2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d02416 48b565b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98fa281 53c50bf3bdfa58b66565071e82bb7ba40ac3cc344893b0aeeaa15502483
sha256	53c50bf3bdfa58b66565071e82bb7ba40ac3cc344893b0aeeaa15502483ec3f6	5b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98fa281 53c50bf3bdfa58b66565071e82bb7ba40ac3cc344893b0aeeaa15502483ec3f6 54b5776a210ac4b6a00eca3efa2f0b665616f706a813cf29fe2ecf19cd9