Threat Round Up for Feb 9 - Feb 16

MalBot · February 16, 2018, 8:00pm

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between February 9 and February 16. As with previous round-ups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

Win.Packer.VBashcan-6450053-1
Packer
VBashcan is a packer written in Visual Basic and has been used with trojans such as Umbra and Bozok.
Win.Ransomware.Gandcrab-6450061-1
Ransomware
Gandcrab is ransomware that encrypts documents, photos, databases and other important files, and adds the file extension “.GDCB”.
Win.Ransomware.Godju-6450274-0
Trojan
This ransomware appends the extension “cypher” to the files and deletes them. It also creates a file called “encryption_key” in %AppData%. Like other ransomware families, it uses Tor for its command and control communications.
Win.Trojan.DNSLock-6449722-0
Trojan
This family changes the DNS settings and redirect traffic to malicious website as well as insert additional advertisements on the victim’s browser. Moreover, it contacts domains to notify the infection and gets commands. The main process also attempts to inject code in another address space and executes PowerShell commands.
Win.Trojan.Generic-2-6449654-0
Trojan
Win.Trojan.Generic-2 is a malicious sample that can perform different nefarious actions. This sample steals passwords from web-browser password stores and exfiltrates them through a legitimate SMTP service. Note that this domain is listed in this report but our products do not block it since it is legitimately used by many users.
Win.Virus.VMProtBad-6450060-0
Virus
VMProtBad is a packed file infector, equipped to detect several VM environments. VMProtBad is known for installing web browser toolbars & generating unwanted ad traffic.

Threats

Win.Packer.VBashcan-6450053-1

Indicators of Compromise

Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

Value: internat.exe

<HKCU>\SOFTWARE\MICROSOFT\SLAYER616WASD

Value: UID

<HKU>\Software\Microsoft\Windows\CurrentVersion\Run
<HKLM>\SOFTWARE\Microsoft\slayer616wasd
<HKCU>\SOFTWARE\MICROSOFT\slayer616wasd

Mutexes

\BaseNamedObjects\slayer616wasd
Local\ZonesCacheCounterMutex
slayer616wasd
DBWinMutex

IP Addresses

N/A

Domain Names

ilovetehpussay[.]host4star[.]com

Files and or directories created

%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.txt
%AppData%\SystemWindows\WindowsService.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.bat

File Hashes

014cd0a944bebca326a3bb496667c29f5670858e67238ff4c074e789a07204d9
01cd6fc630c195ea59fb7755e530923f1cae383c57221a73bf3b6178e5d1a06d
0301c54ae3d98f0c84e03c6a64eced91f2b1130a861fd38cdd5488c25cc9844c
0333951a3a4d82639d620afbd43b2ba689970f68e29626ed15dcdbb2d7832829
03a5edbab584f197d5c6075fd2b825ad94fa8896988b1d3b77dce03aac586bfa
044898d63b8386f2d02ebbfd3f73997cf5731dfa1f3e27b55401e55901e512c6
048c444cf63f2afd1fdb07bc036141d93bb924f6abc1cbd39fb31fcaf2cef2b5
0515b6cb220f4db2154315eb57a8ca7703a481f5e5a9016a32cbae98425a4492
06a30d49fc05ef2cdbc4aed1db26020a7b1ec81a6b953f44e0c62d2a3e3e3531
07c5bea52f4e5a671b58b4061fc5721bb491682dafc25b06ef8692395d1012d1
07f21a783ce8944c9f0c40d9459a2ffdf7c15fc0c5ce0639584035655ebff7f0
0833aa53278f36a75131a2534db0d28bb833fa922579383e530469adb41d3478
08da00c849bd1aca5321e06f0e750e4d984f042d63f91db98b91f4967349b842
0cfc1788d54d5073d445cad67edf2ee76a9228f44734ed1341148b1cc82ee89b
16fc9a2c379c9e6664d668614a8e4df0f4c48170a9044288aab835c08fef5f0b
181dcac94cc3df4312a36af18a9d5ae0f25b5d718116d2b7af6f4d0aaa261c2c
1c2ab5729f056f3aa5f06c8cd342f7f543d3b30c1baf2ccd1dbdf5f15234d553
1d5173fee0e02d7df5c586871e0be2f30d7e88220d77bfb63caf505c1d671045
1da5e6084bd897b84b21b787b54f17a1b8cd88c388a13f3dcf9cec6395bb28a9
1f85629cd0d0b97d5a3372dd28062068e41bb8a74a70ab336dcf4ba8bb47b930

Coverage

Screenshots of Detection

AMP

ThreatGrid

Win.Ransomware.Gandcrab-6450061-1

Indicators of Compromise

Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE

Value: isnnswathsi

<HKU>\Software\Microsoft\Windows\CurrentVersion\RunOnce

Mutexes

\BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4
Global\pc_group=WORKGROUP&ransom_id=4a6a799098b68e3c

IP Addresses

95[.]142[.]39[.]101
66[.]171[.]248[.]178
193[.]0[.]179[.]152
94[.]103[.]82[.]89

Domain Names

nomoreransom[.]bit
nomoreransom[.]coin
gandcrab[.]bit

Files and or directories created

\Win32Pipes.00000490.00000017
%AppData%\Microsoft\bkxmfm.exe
%AppData%\Microsoft\kqrnbq.exe

File Hashes

022024c7db211df7da83d533d24c795eb4178f5a7b9a27acf752874bcdbd5477
02e90fb6cd303ebced661c5c7c9af249241835285e0e64b1092731485584ab8a
03c8bece3db3e2d6b26cc9769d2a694071117cbcf21830aa143507b03b402681
04ef7221209f5ea957312704743139e6000e24dc4399ccc46d5e102ecf2ab3db
052a7544e45619190ee911406cdaff1708951c9d0a4070a5f7a69cc541f2e558
0664a3cca1d5c0c9f2b7f0e6b2f0f20e99b3f902e98e9e709f0bb8ac1cadb867
075c9b925c8a0c5cea4d26b1f3c23666c99cede647c9769503f8e35a96c098b9
084d5c8161764da9af2b1dde0146a7f9b51491c562d8036aa28b85a4a1a32aaa
0a2ebbf4d5ba25049b8225cb253f7f99423b706f9a239c877595eaf696058f56
14426a13dc4620932fd0af40005fb3f508d6a6d69eca897ef5af4f58f7761d3c
15b3a69b86710122a8824ce17996c3301e96b1c629b7db3d9919012954903c85
15b705ee101e26b1ba39d62d6c816409e059f395de8a1a5bfdd35d0e20b705da
1bbee00688a4632749b40312e4109fdc58afa0b5a9e8603718d386fca095a015
1cbcecc05259b821d7d82f6b2e779de2f4d4dd1561445a213a91db8617e61c4c
1f941ec87c3d98827d051ae46d626702960a690bf1f62645828b0ea5cbd6c5ec
22ddc024bf53ae71ff42cb79564f1bf8c9eb4f59d7c2ce3bc378c70ce067b250
261fd62f71e3b566c8ae77e44760f0346c4f353a25f879ee5401e4755745ba10
289d660ede22b4062d102307d5830a2af10da669ce573c279db8e055e6fbdaaa
299edfd4bbf81f20fb8f8e2dd9d0fc4d26c925dbd1cf4372d9172bc2644d3ca5
29a86b3a5c2f1a7a5ad325ccf5c906b532bb2275b79071e2ec98a281a290aadb

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Ransomware.Godju-6450274-0

Indicators of Compromise

Registry Keys

<HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E

Value: LanguageList

<HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E

Value: LanguageList

<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK{4D36E972-E325-11CE-BFC1-08002BE10318}{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION

Value: PnpInstanceID

Mutexes

N/A

IP Addresses

185[.]100[.]85[.]150

Domain Names

kdvm5fd6tn6jsbwh[.]onion[.]to

Files and or directories created

$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I0Y9SM6.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I0Y9SM6.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I0ZU5JT.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I0ZU5JT.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I478AKJ.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I478AKJ.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4FI238.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4FI238.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4FKVBH.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4FKVBH.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4QK3KJ.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I4QK3KJ.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I5QX7W9.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I5QX7W9.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I77RW1L.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I77RW1L.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I7J37KF.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I7J37KF.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I9NSD58.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$I9NSD58.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IANXEE8.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IANXEE8.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IBC53OO.xml
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IBC53OO.xml.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IC5NB1M.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IC5NB1M.txt.cypher
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$ID60W3E.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$ID60W3E.txt.cypher
%AppData%\encryption_key
%AppData%\lock_file
%AppData%\uuid_file

File Hashes

36bba27b1fffbecb4f37400ec3368995e39dfabbce61422531a55a36c7696c33
0622fcb172773d8939b451c43902095b0f91877ae05e562c60d0ca0c237a2e9c
412ce2fea4821c63074f3cd6223c9e9d7f074f18d5cd88dc1d7a36a1bb2f919c
4f888e9b613765653355f7dc2be015e7f32d677ae25fa7ff0298dc252339dce4
7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069
9690fec193714171652f8e0c7498d8ee3581fd0b074693a3a0ba07e5d95a141e
9a1794d3ae09b0a8c7a36fb27514760bb0227943d1ee37a7e81ffdfa9f36ec48

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Trojan.DNSLock-6449722-0

Indicators of Compromise

Registry Keys

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: AddressType

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: Lease

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpDomain

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: LeaseObtainedTime

<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES

Value: 26D9E607FFF0C58C7844B47FF8B6E079E5A2220E

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpNameServerList

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{C2614C30-28EE-47BC-B044-C1025E72F15A}

Value: Hash

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}

Value: DynamicInfo

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\43191B4E617CFE98

Value: 1

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job.fp

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}

Value: Hash

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618

Value: config

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}

Value: Triggers

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE{3B84A94B-68D0-41DF-9C58-9CD44ABFE648}

Value: data

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{C2614C30-28EE-47BC-B044-C1025E72F15A}

Value: DynamicInfo

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP

Value: Collection

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS

Value: Start

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpNameServer

<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK{4D36E972-E325-11CE-BFC1-08002BE10318}{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION

Value: PnpInstanceID

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL{B3797BAB}

Value: nt

<HKLM>\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER

Value: PendingFileRenameOperations

<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E

Value: Blob

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS

Value: NameServer

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{C2614C30-28EE-47BC-B044-C1025E72F15A}

Value: Path

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618

Value: rs

<HKCU>\CONSOLE%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE

Value: WindowPosition

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{050B0847-7A0B-787D-0511-780E0C7E1109}

Value: Index

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpInterfaceOptions

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS

Value: DhcpNameServer

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\11598763487076930564

Value: 0

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618

Value: rd

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{C2614C30-28EE-47BC-B044-C1025E72F15A}

Value: Triggers

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: NameServer

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: T1

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}

Value: Hash

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpSubnetMaskOpt

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DHCPNameServer

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET

Value: {9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}

Value: Path

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job.fp

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}

Value: DynamicInfo

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\43191B4E617CFE98

Value: 0

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpConnForceBroadcastFlag

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {050B0847-7A0B-787D-0511-780E0C7E1109}.job.fp

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpClassIdBin

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{BD2E97E1-0A85-204A-AB40-40B403D0844F}

Value: Id

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: IsServerNapAware

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL{B3797BAB}

Value: 0

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{4797FAD9-D20B-54DC-98FE-7C614E1B1943}

Value: Index

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{050B0847-7A0B-787D-0511-780E0C7E1109}

Value: Id

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: LeaseTerminatesTime

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{1C8E1F51-8675-4AF0-A985-1A0086FCB8EA}

Value: Path

<HKCU>\CONSOLE%SYSTEMROOT%SYSTEM32_WINDOWSPOWERSHELL_V1.0_POWERSHELL.EXE

Value: WindowPosition

<HKLM>\SYSTEM\ControlSet001\Services\Tcpip\Parameters
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpServer

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: T2

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{4797FAD9-D20B-54DC-98FE-7C614E1B1943}

Value: Id

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES

Value: {050B0847-7A0B-787D-0511-780E0C7E1109}.job

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS

Value: DhcpDomain

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpIPAddress

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE{BD2E97E1-0A85-204A-AB40-40B403D0844F}

Value: Index

<HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E

Value: LanguageList

<HKCU>\CONSOLE\TASKENG.EXE

Value: WindowPosition

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpNetbiosOptions

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\BITS

Value: StateIndex

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\3013565826223049618

Value: jc

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpSubnetMask

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS

Value: DHCPNameServer

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS

Value: DhcpScopeID

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS{553E2A9B-C5DC-4F54-9BDD-0DC2B010EC33}

Value: Triggers

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}

Value: DhcpDefaultGateway

<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
<HKLM>\System\CurrentControlSet\Control\Session Manager
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\3013565826223049618
<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\BITS
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
<HKLM>\SYSTEM\ControlSet001\services\NetBT
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{b3797bab}
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{29017980}
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\Interfaces
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE{3B84A94B-68D0-41DF-9C58-9CD44ABFE648}
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
<HKU>\Console%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe
<HKCU>\Console%SystemRoot%_System32_svchost.exe
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
<HKU>\Console%SystemRoot%_System32_svchost.exe
<HKLM>\SYSTEM\ControlSet001\Control\Session Manager
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\15233773854796355610
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\Intranet
<HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\ROOT
<HKCU>\Console%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6aead233391fa002
<HKLM>\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET</b>
<HKCU>\Console\taskeng.exe
<HKU>\Console\taskeng.exe
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs

Mutexes

X29d2562703480b92

IP Addresses

54[.]236[.]192[.]172
81[.]171[.]14[.]67
52[.]77[.]199[.]193
52[.]206[.]149[.]50
18[.]220[.]249[.]233
82[.]163[.]143[.]176

Domain Names

zambi[.]info
amous[.]net
listcool[.]info
monoset[.]info
riyah[.]net
dyn[.]com
listcool[.]net
www[.]hostgator[.]com
dynarunner[.]info
passportinfo[.]info
bubblesetter[.]info
hostgator[.]com

Files and or directories created

%AppData%{39C4A9FA-8E6F-1E51-87DB-35E186454CDD}\B063E134-07C8-569F-D402-4219FE2A8B75.exe
%System32%\Tasks{050B0847-7A0B-787D-0511-780E0C7E1109}
%System32%\Tasks{BD2E97E1-0A85-204A-AB40-40B403D0844F}
%WinDir%\Tasks{ED590CE3-5AF2-BB48-A127-A8DCDA9B22BE}.job
%AllUsersProfile%\617cfe98-5007-0\BITBA2F.tmp
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\72909457.t.exe
%AllUsersProfile%{BB098D39-0CA2-3A92-C225-C429A39F94EC}\61CC9F6E-D667-28C5-AA39-29C86F125189.exe
%AllUsersProfile%\b3797bab\9c3ac369.dll
%AllUsersProfile%{37454187-212c-0}\BITA113.tmp
%WinDir%\AppCompat\Programs\RecentFileCache.bcf
%AllUsersProfile%{769e331d-612c-1}\BITA0B4.tmp
%AppData%\29017980\2fff851b.dll
%System32%\Tasks{4797FAD9-D20B-54DC-98FE-7C614E1B1943}
%WinDir%\Tasks{780B0A47-790C-7D0A-0F11-080D7808110D}.job
%System32%\config\TxR{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf
%TEMP%{006714f4}
%WinDir%\Tasks{67D0E6A3-41D4-1B09-02A0-1F3933D2EA6A}.job

File Hashes

4d675c5cd24ad1fb31b0e7f69527ff5bee4fb456f981cd71423bc967af6eed38
1886e03f7c9fa7160333467eb61afd49521477c246db67a4cd77eb328315bbe7
b0c8ca8e4d3ecaa3f77760b7e7cac04185a96ed9001b563f969b8f24378da737
99b86f98266db8238315609f850af04f32967782f78470ab655217da79ade490
bb448628a9c7f39f1704705c8bd27bf3b01ecca76ad1e540e511dbd72c520ae3
1749e2cac4f7c526e1dc32f0e96093cc823c581954e25ace5a479f1e19ef222d
f9e0b981c4e51303f4b6f0199222e95b1d9a822dcf28f6d8ed27733d70e5448d
e59262af5fa77645cb9c081efd5c9f95dc929a5211624528289413bdf21e86b1
871a9d8a090dc17a0f7f49e2aa382aadf7633530c53b4b9e77318d0dc7464d6b
e802bb930657a5fad11f6f493f081f11c12b88859037636ab6aa5595af53a371

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Trojan.Generic-2-6449654-0

Indicators of Compromise

Registry Keys

N/A

Mutexes

N/A

IP Addresses

173[.]194[.]175[.]108
173[.]194[.]175[.]109

Domain Names

smtp[.]gmail[.]com

Files and or directories created

N/A

File Hashes

41d52ddff7d3b2135ba379f7988aba7ae535dc7e628f450aff841503b020efc4
63695a0a294612e6666006283c90fd86f64eff0f244cf559bdf488f2e4193041
69c10d78fd6a4accfd7533cab25068fc85113431445227ad9847ec3ca42f949b
75818e658a9a4b02897a5808a2ccea33cdb7afe8c6827b13b2b4e8805de1ce2b
787de9917c7871afb7c5b13ed54adc98a0b1507d104ccd25ef8573740ae08919
7ee01720f1c00dc3ed39d6cccc1a99cfb6f5d249f0df24a4669f2f729f9d8c31
93685a69cb9a78b6b86bfce0250019f8c08c6ee429b4effa895d1d84da2c0d0d
aed337b11888de4ec146551c1bcae46e62c3d14b20e7387ed72d0f72bbe49c61
b16228fa8feae74e5e751110b23ebb1c6aacc36cb6f2511d7e38f55c40703fd0
ce510906b105627044b9f35845e75897f94f6530dcc1155eae1b1eb2edd49c4f
d3a8088cd1796240c66110bc6fd964abac305d77071bda7f9040c88a45f6965e
d48fd05d443a1552e6affab7cfc65eb7d804a0ebe80f4b7056b8685dd9e9c70a
f3c143fe7856d71ea5a91c2d8bb96ddd4cb3c4c3dc7898d766be716cb4852da6
f9ec96f821fe757421b1934675cce312e2bf42df4446416bcd0908653af7415d

Coverage

Screenshots of Detection

AMP

ThreatGrid

Win.Virus.VMProtBad-6450060-0

Indicators of Compromise

Registry Keys

N/A

Mutexes

N/A

IP Addresses

N/A

Domain Names

N/A

Files and or directories created

$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$RUI79S5.html
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$RANXEE8.txt
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$IDBK7UZ.html
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$R9SCMWR.lnk
$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500$R7QS1I3.lnk

File Hashes

66c9cd00579297128b36295f8c13cffb5a6d805f73e3086cabceaedfb361c37c
8ee03ed6082b418b4ea91cc8e63848ac8113ed29c65ec9e3403e8f1f90c41b4a
a6660d922577539a08e5dc02984affea031b7bfea22b6bba53113fe2177fab06
7312bd55e79b5813ae8b064e0f1bc11592a79494a79e854626391e26dd2b6b7e
a4cc65474efd0b0e3aeaee8614b397dbc9bd3ecf7a95a8526d8ac84ed3848ee4
4e2624a133a42107d3def6ae7ffcb5e1a5c372ca2d8638438a03a4a040802517
b2e43a6ac8301d5304715b8528c40da58c5e2f473995738178d9f5444d52785a
135f254c202229f708d7e4d0eb36d4d14ed8b43029b994a0401327efb9f63461
f9225972bdc9d23e545a4f530f79760913eba49f8a78e53fc6b361cee499547e
246569246bb8a4694f7b48e9c7abdc6e732b7e1c73b2c802c045d5cda03ef3da
67694e083c8b54090afe2a580da0242d9d05746953832b34af1c11290efe544e
ecb1e4e860ea7612793420677588c7411fc5717825470c956f1e21c30b5325d6
59880ac464244c14deea6569d4d79377fec91f63b7951f137bd457985528f3f7
e70aa134607b6e5c85dad94749e382afd11052d789dad93027756a8ad9c1b5cf
fd7fe9120abfd3da2124357680acaf010d1768fdaa570e471b30207a4e8d9dae
28d599079555f858bb7496dc8fe8fec7fb450aa083f039e90a1c9e11ed7d9094
2e20f3dc237275d5579b96c46195aa05f79b206a356918a0e1bc990a42979111
aeab4107c498f7ebb963452b3157c70fa36f7c0c6936067b89d6d2f2fdd7dd09
c55447abc07f82e59c4573b50038117d494bc8069bd868e2f4755cea405ec104
81e852b22956bea616f384424f2ccbc60224bd497e0885b3472e1019ecd941aa
5aad686faa09afc69b067b67cb3db992820f96d3cadb5e160878255510194dc5
09c953e9fcc681daee3f311513308988048049bc687f3d10d9ae4e6462cdd4b8
0507d30d8ae08a46acbfd85e6c945530505509df8b4658a5d7b846c8eec51d0a
e8e31878a125c47e835ceea2f783fe7938bc9882869a98d9d2cb67c756c8cf97
0412d1da28e300a2677e46ea1af64d664ee47f845336d1081d15df58d3e9016a

Coverage

Screenshots of Detection

AMP

ThreatGrid

Article Link: http://feedproxy.google.com/~r/feedburner/Talos/~3/mjTsRgtldKg/threat-round-up-0209-0216.html