Quantcast
Channel: Cisco Talos Blog
Viewing all 2012 articles
Browse latest View live
↧

Beers with Talos EP 16: Strong Copy - Bad Rabbit and the Nyetya Connection

November 3, 2017, 8:06 am
$
0
0


Beers with Talos (BWT) Podcast Episode 16 is now available.  Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast

EP16 Show Notes: 

The crew takes on Apache OpenOffice vulns and when you need one CVE versus one hundred. We spend a lot of time discussing signal to noise ratio and Twitter canaries getting things wrong. Of course, we also discuss Bad Rabbit, its relationship to Nyetya, and why OpenOffice vulns are a worry, even to businesses that are run like hippie communes. As per usual, we mostly just make bad jokes.

Mitch also fails miserably at uploading podcasts to the website, making people work at midnight. Make sure to subscribe on iTunes, Google Play, or Stitcher to make sure you don't miss an episode!


Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
Hosted by Mitch Neff (@MitchNeff)
Posted on the website amazingly by Nick Herbert

Find all episodes:
http://cs.co/talospodcast

Subscribe via iTunes (and leave a review!)
http://cs.co/talositunes

Check out the Talos Threat Research Blog:
http://cs.co/talosresearch

Subscribe to the Threat Source newsletter:
http://cs.co/talosupdate

Follow Talos on Twitter:
http://cs.co/talostwitter

Give us your feedback and suggestions for topics:
beerswithtalos@cisco.com
↧
Search

Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras

November 13, 2017, 7:43 am
$
0
0
These vulnerabilities were discovered by Claudio Bozzato of Cisco Talos.

Executive Summary


The Foscam C1 Indoor HD Camera is a network-based camera that is marketed for use in a variety of applications, including use as a home security monitoring device. Talos recently identified several vulnerabilities present in these devices, and worked with Foscam to develop fixes for them, which we published the details for in a blog post here. In continuing our security assessment of these devices, Talos has discovered additional vulnerabilities. In accordance with our responsible disclosure policy, Talos has worked with Foscam to ensure that these issues are resolved and that a firmware update is made available for affected customers. These vulnerabilities could be leveraged by an attacker to achieve remote code execution on affected devices, as well as upload rogue firmware images to the devices, which could result in an attacker being able to completely take control of the devices.

Foscam IP Video Camera webService DDNS Client Code Execution Vulnerabilities


Foscam C1 Indoor HD Cameras are vulnerable to several buffer overflow vulnerabilities on devices with Dynamic DNS (DDNS) enabled. On devices with DDNS enabled, an attacker could leverage a rogue HTTP server to exploit these vulnerabilities. When the device boots, a thread is spawned that routinely checks the configured DDNS server for updates or changes to the IP address associated with the DDNS server. In cases where the device is configured to use the DDNS, the device will send requests to the DDNS server and write the associated responses to the buffer, without performing proper bounds checking. This could be exploited by an attacker controlled server returning a specially crafted response larger than the allocated buffer, resulting in an overflow that could be leveraged to obtain remote code execution on affected devices. The following advisories and CVEs are associated with this vulnerability.

Foscam IP Video Camera CGIProxy.fcgi Firmware Upgrade Unsigned Image Vulnerability (TALOS-2017-0379 / CVE-2017-2872)


Foscam C1 HD Indoor cameras allow for firmware upgrades to be performed via the web management interface present on the devices. These devices lack sufficient security verification of firmware images provided by users. This functionality and lack of verification could be leveraged by an attacker to upload and execute custom firmware images on affected devices. In order to perform the firmware upgrade process, an attacker would require access to an account with administrative privileges on the device. TALOS-2017-0379 has been assigned CVE-2017-2872. For additional information, please see the advisory here.

Foscam IP Video Camera CGIProxy.fcgi SoftAP Configuration Command Injection Vulnerability (TALOS-2017-0380 / CVE-2017-2873)

 

Foscam C1 HD Indoor cameras provide the ability to configure a SoftAP using the web management interface. The SoftAP configuration facilitates connecting to the device over wireless to perform initial device setup and configuration. These devices are vulnerable to a command injection vulnerability present in the 'devMng' binary that is reachable via the 'setSoftApConfig' command. This vulnerability could be leveraged to execute arbitrary operating system commands. Exploitation of this vulnerability would require access to an account with administrative privileges on the affected device. TALOS-2017-0380 has been assigned CVE-2017-2873. For additional information, please see the advisory here.

Foscam IP Video Camera devMng Multi-Camera Port 10000 Command 0x0000 Information Disclosure Vulnerability (TALOS-2017-0381 / CVE-2017-2874)


Foscam C1 HD Indoor cameras allow device-to-device communications over UDP/10000 and UDP/10001. These communications are designed to allow users to display video streams from multiple devices within a centralized web management interface. These devices are vulnerable to an information disclosure vulnerability. An unauthenticated remote attacker could leverage this vulnerability to obtain sensitive device information such as MAC address, camera name, and firmware version. TALOS-2017-0381 has been assigned CVE-2017-2874. For additional information, please see the advisory here.

Foscam IP Video Camera devMng Multi-Camera Port 10000 Command 0x0002 Username Field Code Execution Vulnerability (TALOS-2017-0382 / CVE-2017-2875)


Foscam C1 HD Indoor cameras allow device-to-device communications over UDP/10000 and UDP/10001. These communications are designed to allow users to display video streams from multiple devices within a centralized web management interface. These devices are vulnerable to a buffer overflow condition that can be leveraged by an unauthenticated remote attacker to obtain remote code execution on affected devices. This vulnerability is due to a lack of proper bounds checking on the contents of the username parameter that is submitted during authentication requests. TALOS-2017-0382 has been assigned CVE-2017-2875. For additional information, please see the advisory here.

Foscam IP Video Camera devMng Multi-Camera Port 10000 Command 0x0002 Password Field Code Execution Vulnerability (TALOS-2017-0383 / CVE-2017-2876)


Foscam C1 HD Indoor cameras allow device-to-device communications over UDP/10000 and UDP/10001. These communications are designed to allow users to display video streams from multiple devices within a centralized web management interface. These devices are vulnerable to a buffer overflow condition that can be leveraged by an unauthenticated remote attacker to obtain remote code execution on affected devices. This vulnerability is due to a lack of proper bounds checking on the contents of the password parameter that is submitted during authentication requests. TALOS-2017-0383 has been assigned CVE-2017-2876. For additional information, please see the advisory here.

Foscam IP Video Camera devMng Multi-Camera Port 10001 Command 0x0064 Empty AuthResetKey Vulnerability (TALOS-2017-0384 / CVE-2017-2877)


Foscam C1 HD Indoor cameras allow device-to-device communications over UDP/10000 and UDP/10001. These communications are designed to allow users to display video streams from multiple devices within a centralized web management interface. These devices are vulnerable to a condition in which an unauthenticated attacker could reset user accounts configured on the devices to factory defaults by sending a specially crafted network packet over UDP/10001 to affected devices. Due to a lack of error checking, it is possible to reset these user accounts without ever having to specify a valid 'authResetKey' value within the request to reset the accounts. TALOS-2017-0384 has been assigned CVE-2017-2877. For additional information, please see the advisory here.

Foscam IP Video Camera CGIProxy.fcgi logOut Code Execution Vulnerability (TALOS-2017-0385 / CVE-2017-2878)


Foscam C1 HD Indoor cameras are vulnerable to a buffer overflow condition that is reachable via the 'logOut' command present within the web management interface. This vulnerability could be leveraged by an attacker to obtain remote code execution on affected devices. Exploitation of this vulnerability would require an attacker to authenticate to the device, even with a limited "Visitor" account. TALOS-2017-0385 has been assigned CVE-2017-2878. For additional information, please see the advisory here.

Foscam IP Video Camera UPnP Discovery Code Execution Vulnerability (TALOS-2017-0386 / CVE-2017-2879)


Foscam C1 HD Indoor cameras utilize a UPnP implementation that is designed to enable the devices to communicate with the network gateway to facilitate remote access for the web management interface of the device. The UPnP implementation used by the Foscam C1 is vulnerable to a buffer overflow condition that could be leveraged by an attacker to obtain remote code execution on affected devices. By sending a specially crafted UPnP Discovery response to affected devices, a remote attacker could trigger this vulnerability. TALOS-2017-0386 has been assigned CVE-2017-2879. For additional information, please see the advisory here.

Versions Tested


Talos has tested and confirmed that the following Foscam firmware versions are affected:

Foscam Indoor IP Camera C1 Series
System Firmware Version: 1.9.3.18
Application Firmware Version: 2.52.2.43
Plug-In Version: 3.3.0.26

Conclusion


One of the most commonly deployed IP cameras is the Foscam C1. In many cases these devices may be deployed in sensitive locations. They are marketed for use in security monitoring and many use these devices to monitor their homes, children, and pets remotely. As such, it is highly recommended that the firmware running on these devices be kept up-to-date to ensure the integrity of the devices, as well as the confidentiality of the information and environments that they are monitoring. Foscam has released a firmware update, available here to resolve these issues. Users of the affected devices should update to this new version as quickly as is operationally feasible to ensure that their devices are not vulnerable.

Coverage


The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.

Snort Rules: 42432 - 42434, 43080 - 43082, 43555 - 43558, 43713, 43717.

↧
↧

Microsoft Patch Tuesday - November 2017

November 14, 2017, 11:54 am
$
0
0
Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 53 new vulnerabilities with 19 of them rated critical, 31 of them rated important and 3 of them rated moderate. These vulnerabilities impact Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, and more.

In addition, an update for Adobe Reader was released which addresses CVE-2017-16367 / TALOS-2017-0356 - Adobe Acrobat Reader DC PDF Structured Hierarchy ActualText Structure Element Code Execution Vulnerability which was discovered by Aleksandar Nikolic of Cisco Talos. This vulnerability manifests as a type confusion vulnerability in the PDF parsing functionality for documents containing marked structure elements. A specifically crafted PDF document designed to trigger the vulnerability could cause an out-of-bounds access on the heap, potentially leading to arbitrary code execution. More details regarding this vulnerability are available here.

Vulnerabilities Rated Critical


The following vulnerabilities are rated "Critical" by Microsoft:


Multiple CVEs - Scripting Engine Memory Corruption Vulnerability


Multiple vulnerabilities have been identified in the scripting engine of Microsoft Edge that could allow an attacker to execute arbitrary code. These vulnerabilities manifest due to Microsoft Edge improperly handling objects in memory. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit these vulnerabilities. Successful exploitation of these vulnerabilities could allow an attacker to execute code within the context of the current user.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11836
  • CVE-2017-11839
  • CVE-2017-11840
  • CVE-2017-11841
  • CVE-2017-11861
  • CVE-2017-11862
  • CVE-2017-11866
  • CVE-2017-11870
  • CVE-2017-11871
  • CVE-2017-11873

Multiple CVEs - Scripting Engine Memory Corruption Vulnerability


Multiple remote code execution vulnerabilities have been identified affecting the scripting engine in Microsoft browsers. These vulnerabilities manifest due to the scripting engine improperly handling objects in memory. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of the current user. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit these vulnerabilities or, in some cases, opens a Microsoft Office document containing an embedded ActiveX control marked "safe for initialization."

The following is a list of CVEs related to these vulnerabilities.
  • CVE-2017-11837
  • CVE-2017-11838
  • CVE-2017-11843
  • CVE-2017-11846
  • CVE-2017-11858

CVE-2017-11845 - Microsoft Edge Memory Corruption Vulnerability


A remote code vulnerability has been identified that affects Microsoft Edge. The vulnerability is related to the way Microsoft Edge accesses objects in memory. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the same access rights as the current user. Scenarios where this vulnerability would likely be exploited include web-based attacks where a user navigates to a malicious webpage designed to exploit this vulnerability, or via the use of a malicious email attachment that the user is convinced to open.

Multiple CVEs - Internet Explorer Memory Corruption Vulnerability


Two remote code vulnerabilities have been discovered that affect Internet Explorer. These vulnerabilities are related to the way Internet Explorer accesses objects in memory. Successful exploitation of these vulnerabilities could result in the execution of arbitrary code with the same access rights as the current user. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where a user navigates to a malicious webpage designed to exploit this vulnerability, or via the use of a malicious email attachment that the user is convinced to open.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11855
  • CVE-2017-11856

CVE-2017-11869 - Scripting Engine Memory Corruption Vulnerability


A vulnerability has been identified in the scripting engine of Internet Explorer that could allow an attacker to execute arbitrary code. These vulnerability manifest due to Internet Explorer improperly accessing objects in memory. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit these vulnerabilities. Successful exploitation of these vulnerabilities could allow an attacker to execute code within the context of the current user.

Vulnerabilities Rated Important


The following vulnerabilities are rated "Important" by Microsoft:

CVE-2017-11768 - Windows Media Player Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects Windows Media Player. This vulnerability manifests due to Windows Media Player improperly disclosing file information. In order to exploit this vulnerability an attacker would need to authenticate to an affected system and execute a program designed to exploit this vulnerability. Successful exploitation of this vulnerability would allow an attacker to enumerate the existence of files stored on an affected system.

Multiple CVEs - ASP.NET Core Denial Of Service Vulnerability


Multiple denial of service vulnerabilities have been identified that affect ASP.NET Core. These vulnerabilities manifest due to .NET Core improperly handling web requests. These vulnerabilities could be exploited remotely by an unauthenticated attacker. Successful exploitation could result in a denial of service condition.

The following CVEs are related to these vulnerabilities:

CVE-2017-11788 - Windows Search Denial of Service Vulnerability


A denial of service vulnerability has been identified that affects Windows Search. This vulnerability manifests due to Windows Search improperly handling objects in memory. This vulnerability could be exploited by sending specially crafted messages to the Windows Search service. Additionally this vulnerability could be exploited by an unauthenticated remote attacker via Server Message Block (SMB). Successful exploitation of this vulnerability could result in a denial of service condition on affected systems.

CVE-2017-11791 - Scripting Engine Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects Microsoft browsers. This vulnerability manifests due to Microsoft browsers improperly handling objects in memory. This vulnerability could be leveraged by an attacker to obtain information that could be used for subsequent attacks against an affected system. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability.

Multiple CVEs - Microsoft Edge Information Disclosure Vulnerability


Two information disclosure vulnerabilities have been identified that affect Microsoft Edge. These vulnerabilities manifest due to Microsoft Edge improperly handling objects in memory. These vulnerabilities could be leveraged by an attacker to obtain information that could be used for subsequent attacks against an affected system. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11803
  • CVE-2017-11844

CVE-2017-11827 - Microsoft Browser Memory Corruption Vulnerability


A remote code execution vulnerability has been identified that affects Microsoft browsers. This vulnerability manifests due to the way in which Microsoft browsers access objects in memory. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the same privileges as the current user. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability or convincing a user to open a malicious email attachment.

CVE-2017-11830 - Device Guard Security Feature Bypass Vulnerability


A security feature bypass vulnerability has been identified that affects Device Guard. This vulnerability manifests due to the way in which Device Guard incorrectly validates untrusted files. Successful exploitation of this vulnerability could allow an attacker to make an unsigned file appear as if it is signed, allowing an attacker to execute malicious files on affected systems.

Multiple CVEs - Windows Information Disclosure Vulnerability


Multiple information disclosure vulnerabilities have been identified that affect the Windows kernel. These vulnerabilities manifest due to the Windows kernel failing to properly initialize memory addresses. These vulnerabilities could be leveraged by an attacker to obtain information that could be used for subsequent attacks against an affected system. Exploiting these vulnerabilities would require an attacker to authenticate to an affected device and execute an application designed to exploit this vulnerability.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11831
  • CVE-2017-11880

Multiple CVEs - Windows EOT Font Engine Information Disclosure Vulnerability


Two information disclosure vulnerabilities have been identified that affect Microsoft Windows Embedded OpenType (EOT). These vulnerabilities manifest due to the way in which the font engine parses embedded fonts. Successful exploitation of these vulnerabilities could allow an attacker to obtain information that could be used for subsequent attacks against an affected system.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11832
  • CVE-2017-11835

CVE-2017-11833 - Microsoft Edge Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects Microsoft Edge. This vulnerability manifests due to the way in which Microsoft Edge handles cross-origin requests. This vulnerability could be leveraged by an attacker to determine the origin of webpages within an affected browser. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability.

CVE-2017-11834 - Scripting Engine Information Disclosure Vulnerability


An information disclosure vulnerability was identified that affects Internet Explorer. This vulnerability manifests due to the scripting engine in Internet Explorer not properly handling objects in memory. This vulnerability could be leveraged by an attacker to obtain information that could be used in additional attacks. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability.

Multiple CVEs - Windows Kernel Information Disclosure Vulnerability


Multiple information disclosure vulnerabilities were identified that affect the Windows Kernel-Mode Drivers. These vulnerabilities manifest due to the Windows Kernel failing to properly initialize memory addresses. These vulnerabilities could be leveraged by an attacker to obtain information that could be used in subsequent attacks to further compromise an affected system. Exploitation of these vulnerabilities would require an attacker to log in and execute a program specifically designed to exploit them.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11842
  • CVE-2017-11849
  • CVE-2017-11853

CVE-2017-11847 - Windows Kernel Elevation of Privilege Vulnerability


A privilege escalation vulnerability has been identified that affects the Windows Kernel. This vulnerability manifests due to the Windows Kernel failing to properly handle objects in memory. Successful exploitation of this vulnerability would require an attacker to log on to a system and execute a program specifically designed to exploit this vulnerability and could allow an attacker to run arbitrary code in kernel memory.

CVE-2017-11850 - Microsoft Graphics Component Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects the Microsoft Graphics Component. This vulnerability manifests due to the Windows GDI component disclosing kernel memory addresses. An attacker could leverage this vulnerability to obtain information that could be used for additional attacks against an affected system. Successful exploitation of this vulnerability would require an attacker to log on to a system and execute a program specifically designed to exploit this vulnerability.

CVE-2017-11851 - Windows Kernel Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects the Microsoft Graphics Component. This vulnerability manifests due to the Windows GDI component disclosing kernel memory addresses. An attacker could leverage this vulnerability to obtain information that could be used for additional attacks against an affected system. Successful exploitation of this vulnerability would require an attacker to log on to a system and execute a program specifically designed to exploit this vulnerability.

CVE-2017-11852 - Windows GDI Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects the Microsoft Graphics Component. This vulnerability manifests due to the Windows GDI component disclosing kernel memory addresses. An attacker could leverage this vulnerability to obtain information that could be used for additional attacks against an affected system. Successful exploitation of this vulnerability would require an attacker to log on to a system and execute a program specifically designed to exploit this vulnerability.

CVE-2017-11854 - Microsoft Word Memory Corruption Vulnerability


A remote code execution vulnerability has been identified that affects Microsoft Office. This vulnerability manifests due to Microsoft Office improperly handling objects in memory. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code within the context of the current user. In order to exploit this vulnerability, an attacker would need to create a specially crafted file and convince a user to open it within an affected version of Microsoft Office.

CVE-2017-11863 - Microsoft Edge Security Feature Bypass Vulnerability


A security feature bypass has been identified in Microsoft Edge that could allow an attacker to load a page containing malicious content without the user's knowledge or consent. This vulnerability manifests in the Edge Content Security Policy where certain specially crafted documents are improperly validated. An attacker could exploit this vulnerability by convincing a user to navigate to a malicious page or by injecting malicious content into page, such as an advertisement, thereby bypassing the Content Security Policy.

CVE-2017-11872 - Microsoft Edge Security Feature Bypass Vulnerability


A security feature bypass vulnerability has been identified in Microsoft Edge that could allow an attacker to bypass Cross-Origin Resource Sharing restrictions. This vulnerability manifests as a result of Edge improperly handling redirect requests and following redirect requests that should otherwise be ignored. An attacker could exploit this vulnerability by creating a specially crafted web page designed to exploit this vulnerability and convincing a user to visit the web page. Attackers could also leverage vulnerable or compromised web pages exploit this vulnerability.

CVE-2017-11874 - Microsoft Edge Security Feature Bypass Vulnerability


A security feature bypass vulnerability has been identified in Microsoft Edge that could allow an attacker to bypass the Control Flow Guard. This vulnerability manifests as a result of the Edge Just-In-Time compiler incorrectly handling memory operations in compiled code. An attacker could exploit this vulnerability by creating a specially crafted web page designed to exploit this vulnerability and convincing a user to visit the web page.

CVE-2017-11877 - Microsoft Excel Security Feature Bypass Vulnerability


A security feature bypass vulnerability has been identified that affects Microsoft Office. The vulnerability is related to Microsoft Office failing to enforce macro settings on Excel documents. Exploitation of this vulnerability does not result in code execution and requires an attacker to create a specially crafted file that is opened in an affected version of Microsoft Excel.

CVE-2017-11878 - Microsoft Excel Memory Corruption Vulnerability


A remote code execution vulnerability has been identified that affects Microsoft Office. The vulnerability is related to Microsoft Office not properly handling objects in memory. Successful exploitation of this vulnerability could result in an attacker gaining the ability to execute arbitrary code within the context of the current user. Exploitation of this vulnerability requires an attacker to create a specially crafted file that is opened in an affected version of Microsoft Office.

CVE-2017-11879 - ASP.NET Core Elevation Of Privilege Vulnerability


An open redirect vulnerability has been identified at affects ASP.NET Core. Exploitation of this vulnerability could result in privilege escalation. In order to exploit this vulnerability an attacker would need to create a specially crafted URL which could be used to redirect the victim's browser session to a malicious site and obtain login session information.

Multiple CVEs - Microsoft Office Memory Corruption Vulnerability


Multiple remote code execution vulnerabilities have been identified that affect Microsoft Office. These vulnerabilities are related to Microsoft Office not properly handling objects in memory. Successful exploitation of these vulnerabilities could result in an attacker gaining the ability to execute arbitrary code within the context of the current user. Exploitation of this vulnerability requires an attacker to create a specially crafted file that is opened in an affected version of Microsoft Office.

The following is a list of CVEs related to these vulnerabilities:
  • CVE-2017-11882
  • CVE-2017-11884

Vulnerabilities Rated Moderate


The following vulnerabilities are rated "Moderate" by Microsoft:

CVE-2017-11848 - Internet Explorer Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects Internet Explorer. This vulnerability manifests due to the way in which Internet Explorer handles page contents. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability. Successful exploitation of this vulnerability could allow an attacker to detect navigation of a user leaving a malicious web page.

CVE-2017-11876 - Microsoft Project Server Elevation of Privilege Vulnerability


A privilege escalation vulnerability has been discovered affecting Microsoft Project. It is related to the way in which Microsoft Project Server improperly manages user sessions. The victim must be logged in to the target site in order for this vulnerability to be exploited. Scenarios where this vulnerability would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of this vulnerability. Successful exploitation of this vulnerability could allow an attacker to access content that the attacker is not authorized to access or impersonate the user within the web application. It could also enable the attacker to inject malicious contents into the victim's browser.

CVE-2017-8700 - ASP.NET Core Information Disclosure Vulnerability


An information disclosure vulnerability has been identified that affects ASP.net Core. This vulnerability could enable an attacker to bypass Cross-Origin Resource Sharing (CORS) configurations. Successful exploitation of this vulnerability could allow an attacker to access content that they are not authorized to access from within a web application.

Coverage


In response to these vulnerability disclosures, Talos is releasing the following Snort rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Snort Rules:
  • 43120-43121
  • 44809-44834
  • 44838-44839
  • 44843-44846
For other vulnerabilities Talos has disclosed, please refer to our Vulnerability Report Portal:http://www.talosintelligence.com/vulnerability-reports/



To review our Vulnerability Disclosure Policy, please visit this site:

http://www.cisco.com/c/en/us/about/security-center/vendor-vulnerability-policy.html



↧

Vulnerability Spotlight: Multiple Remote Code Execution Vulnerabilities Within libxls

November 15, 2017, 7:36 am
$
0
0
Vulnerabilities discovered by Marcin Noga of Cisco Talos

Talos is releasing seven new vulnerabilities discovered within the libxls library: TALOS-2017-0403, TALOS-2017-0404, TALOS-2017-0426, TALOS-2017-0460, TALOS-2017-0461, TALOS-2017-0462, and TALOS-2017-0463. These vulnerabilities result in remote code execution using specially crafted XLS files.

Overview

libxls is a C library supported on Windows, Mac and Linux which can read Microsoft Excel File Format (XLS) files ranging from current versions of XLS files down to Excel 97 (BIFF8) formats. 
The library is used by the `readxl` package which can be installed in the R programming language via the CRAN repository. The library is also part of the ‘xls2csv’ tool. The library can also be used to successfully parse Microsoft XLS files.

Please note that the update is only available via svn currently.

Details

TALOS-2017-0403

An exploitable out-of-bounds write vulnerability exists in the  xls_mergedCells function of libxls 1.4  A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

Full technical advisory is available here.

TALOS-2017-0404

An exploitable out-of-bounds write vulnerability exists in the read_MSAT function of libxls 1.4. 
A specially crafted XLS file can cause a memory corruption resulting in remote code execution. 
An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

Full technical advisory is available here.

TALOS-2017-0426

An exploitable stack based buffer overflow vulnerability exists in the  xls_getfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.  

NOTE: This vulnerability does not affect the readxl package that can be installed in the R programming language.

Full technical advisory is available here.

TALOS-2017-0460

An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

Full technical advisory is available here.

TALOS-2017-0461

An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

Full technical advisory is available here.

TALOS-2017-0462

An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

Full technical advisory is available here.

TALOS-2017-0463

An exploitable out-of-bounds vulnerability exists in the xls_addCell function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability, this could be sent as part of a phishing campaign using email to compromise the victim’s machine.

NOTE: This vulnerability does not affect the readxl package that can be installed in the R programming language.

Full technical advisory is available here.

Product Website:

Coverage

The following Snort IDs have been released to detect these vulnerabilities: 44101-44102, 44092-44093, 44163-44164, 44520-45523, 44593-44594, 44589-44590

↧

Threat Round Up for Nov 10 - Nov 17

November 17, 2017, 8:07 am
$
0
0
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between November 10 and November 17. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

  • Doc.Macro.Downloader-6360616-1
    Downloader
    This wave of malicious office documents uses obfuscated macros to launch powershell. The powershell process then downloads and executes a malicious payload executable or VBS script.
     
  • Doc.Macro.Emotet-6374344-0
    Office Macro
    Emotet's initial attack vector is an Office document with obfuscated macro code. The obfuscation includes junk code, randomly generated variable names, function reassignment, redirection, additional code that overwrites data if not executed in the proper sequence, etc.
     
  • Win.Ransomware.Kovter-6376319-1
    Ransomware
    Kovter is a malware family which has been around since 2013. Currently it is delivering ransomware.
     
  • Win.Trojan.BitCoinMiner-6374577-0
    Miner
    This 64-bit Cryptocurrency miner requires a CUDA-enabled GPU in the infected computer to execute. CUDA (Compute Unified Device Architecture) is a platform for parallel computing developed by NVIDIA.
     
  • Win.Trojan.CosmicDuke-6376318-0
    Trojan
    This family is a known trojan and it is directly related to the infamous MiniDuke APT. The dynamic analysis failed because some DLLs were missing in the instrumented environment. The program, if executed, collects all the credentials stored on the victim's disk and it contacts a remote server.
     
  • Win.Trojan.MSILTrojan-6376261-0
    Trojan
    This MSIL trojan will take screenshots and place keyboard hooks in order to spy on the user's activity. Later, it will send emails via legitimate email services such as smtp.live.com, which could be used to exfiltrate the information or propagate the malware. It will also check the external IP of the infected machine using the checkmyip.dyndns.org service. Note that the network IOCs included in this report belong to legitimate services.
     

Threats

Doc.Macro.Downloader-6360616-1


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • procuratorkn[.]top
  • touchlifefoundation[.]biz
  • www[.]bobnew[.]com[.]br
Files and or directories created
  • C:\Users\ADMINI~1\AppData\Local\Temp.exe
  • C:\Users\ADMINI~1\AppData\Local\Temp\S5c.vbs
File Hashes
  • 0b8bcc0c7281c9ad5e2c03b08c881b48015d064906deeccbe7bf944f4ef6d532
  • 1e2833b296489c39f605de502f5c9527270f1a55ce5d0d8ed4453b299ea5840f
  • 4d9f3de7aeca86a1ba1a653e04994eb69d31c6afc5802691ee9178bf8d593ed5
  • 7372b2b16620b1a35fa83f4bd31af1f78fbb3fe7d3235b06c064c4d617461f69
  • 7684aa4355b4992a8e168956e54424f03acca1cab32d0c62a4c87e6b5522d991
  • 7c056f1a930943cd3afcba96555185cb598210f96c1b098b321a6e7d087599a8
  • bac652b6a5cb65db95afdd9628c389f34c0e5609ed60d96f5598e43ebb151b73
  • dd8bd175e95c9bdc963f6b7a188f9a0e4184411097123e2bb76111c9550b12dd
  • e849be0adc49da7cc9b82c7a6ab45a0d082302dddd33c7c04824d14f968ba2cd
  • ecdeeda6b71b88d0367bfb63291afe5ab5e34a5a43244791604c28d43323f59a
  • f1231de08447a85356afedfdad5262e7ebba32bc68d23e73e5385164caf2182b
  • f3fb2e9dcc0544751fb66d9325b5328d59298e7578c877924bc26944cbadb078

Coverage


Screenshots of Detection

AMP



ThreatGrid


Umbrella






Doc.Macro.Emotet-6374344-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • MC8D2645C
  • MF349C666
  • Global\I98B68E3C
  • Global\M98B68E3C
  • M167D3CCB
IP Addresses
  • 77[.]220[.]64[.]49
  • 45[.]73[.]17[.]164
  • 103[.]247[.]96[.]21
  • 195[.]16[.]207[.]211
  • 148[.]251[.]33[.]195
  • 213[.]192[.]1[.]170
  • 95[.]163[.]86[.]154
  • 5[.]63[.]14[.]41
  • 78[.]47[.]56[.]164
Domain Names
  • liansamaneh[.]ir
  • conceptttb[.]in
Files and or directories created
  • \Users\Administrator\Documents\20171117\PowerShell_transcript.PC.w9wNiwMK.20171117113000.txt
File Hashes
  • f93095be43a52d749c6d4dc605958e6ff32ffc37ab117734c61deebbee0fdc28
  • 6d0d7e3180a65517917e9d46f13a0ab6d54bc194edc950130aff9f3bec564d95
  • 201e15ced36c0840b80fc6bb314b404868988155920a19098fb815e4b391f352
  • a2bf120258c17c7153f7b05cc8cb8d74bd10645b472a18bc75dca1f04ae5cff1
  • 6e999d2626bb074d7f5df5b97cdd8b21faa050233b608d4d8395ab941569cd50
  • 81425c15025f0fe9f4314c0130b00fd974f4522eb622f030f613e7940111f8bf
  • 04745cf34ca1dbfee1b638d41675e1ccf6ed65059f839ed8734f34f14b989ee6
  • 7cca822e0fdfeca033762213bf16a3f04d7cac8c345f84a0d740324d97f671c0
  • 9ce688608f54dcedd2497715359c9b19b0c5fc7e5ce441c55f897082b9f1ccae
  • f5142c005f1ebd6c1769b77d58e3614cd9d7bfa28cfcbd64660ef73e392ecd09
  • 3b5df8063fa79a19c231b8d019e150a1821d6ecbf27855ba4aef4bfb3c0f0d77

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella






Win.Ransomware.Kovter-6376319-1


Indicators of Compromise


Registry Keys
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyServer
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyOverride
Mutexes
  • Global\M98B68E3C
  • MC8D2645C
  • MA008EE15
  • Global\I98B68E3C
  • M772FF100
IP Addresses
  • 77[.]220[.]64[.]57
  • 185[.]94[.]252[.]102
  • 213[.]192[.]1[.]170
  • 78[.]47[.]56[.]190
Domain Names
  • N/A
Files and or directories created
  • N/A
File Hashes
  • c4e37130cc1688d204ef34f8762d9c3182552622bbf61b127b22c0b733a3b700
  • da973bebb2c14bcd3f493ffc1cc2cd6225f3b49fe77c1189de35f2dcfa72bbf8
  • fa0577e117929e21a3881b615a0a3cb087f5bbda6628b7612f036d0753c1b24b
  • 36d5cee0fd6862ae64e0074e12ca1599be7953d7cdfa93ca3993c5f83c9cf1b2
  • b0d41c21e5d8396f711e1224f190b3281bb04d3f797ceb9c77558a5f567e3fe4
  • 6e445be806032f4a73d17d73cb00639f632b23f2731ac0c2267a4bb34237fd32
  • cc714cbf5aac23f09bcc9eea1b8577d2e1673d9fe1433f5658eecc818a2f8469
  • be11330dfb54a48734679f458381d69059c037bd45deb69f70148f9c2e36fc0d
  • e0467fca9d07a69a53cb436d7962499bc25be34295dacf5a5d19ae9596ad2d98
  • 468fdeeba11609d222b9554616dcb8b1ab10f565dcb6291bc5360dda3a97ab08

Coverage


Screenshots of Detection

AMP


ThreatGrid







Win.Trojan.BitCoinMiner-6374577-0


Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{36B75FF8-A007-46F0-8EEE-76A6D3513381}
    • Value: Path
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
    • Value: winupdate.job.fp
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
    • Value: TB_DEADLINE_START.job
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6C1DC24A-11D8-4DD7-A934-6C033C5CB501}
    • Value: DynamicInfo
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{36B75FF8-A007-46F0-8EEE-76A6D3513381}
    • Value: DynamicInfo
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\TB_DEADLINE_START
    • Value: Index
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WINUPDATE
    • Value: Index
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{36B75FF8-A007-46F0-8EEE-76A6D3513381}
    • Value: Hash
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
    • Value: TB_DEADLINE_START.job.fp
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6C1DC24A-11D8-4DD7-A934-6C033C5CB501}
    • Value: Path
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\TB_DEADLINE_START
    • Value: Id
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
    • Value: winupdate.job
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6C1DC24A-11D8-4DD7-A934-6C033C5CB501}
    • Value: Triggers
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WINUPDATE
    • Value: Id
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6C1DC24A-11D8-4DD7-A934-6C033C5CB501}
    • Value: Hash
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{36B75FF8-A007-46F0-8EEE-76A6D3513381}
    • Value: Triggers
Mutexes
  • Local\MSCTF.Asm.MutexDefault1
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • %System32%\winupdate.xml
  • %System32%\Tasks\winupdate
  • \TEMP\fdfe3ab063fd7dad96a6492cc1b7f43c169e270868a3541a89e177b8dacaf16b.exe
  • %System32%\cudart32_80.dll
  • %System32%\wsus.exe
  • %System32%\cudart64_80.dll
  • %System32%\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf
  • %System32%\Tasks\TB_DEADLINE_START
  • %System32%\TB_DEADLINE_START.XML
File Hashes
  • fdfe3ab063fd7dad96a6492cc1b7f43c169e270868a3541a89e177b8dacaf16b
  • 3df78335904328db44168cfda613d0aff3761b6d767824476c6d34b582bf7a73
  • 82bbc279515e29a63b38752d3532e6f9e5e36ffb6b4f1dd783c370eb68667b76
  • 019538248027b51c92cef1cc2e8cff4577c30508e0aa06a65adfdcc125c6846c
  • 0487114a1df2852b2f3ba69aaa49930055e04c81ffc1e68dad6b47bec7ba2faa
  • 0e92444bdc28dbd0e645cedb0c7f1d81708e2073b7c7567956b7bc665cb6b648
  • 1814256a36032c226ddd8263395ecbe6fad92b4b11e62120ee4d35354cb670fe
  • 1a736b816b476800c1adb87169100192e503a1737ebedef5b1f14d695a100011
  • 293548f39cdaeac4d59fb55efbce7ac214349aa5ae46df0f905a0ab5cc1ae5ee
  • 29b4419555c41019e98c3a0e5ffa69733b9a1d71d48f0b9879a21581ab548c1e
  • 314fa254bd1da034501300e8766d000aa0ab306bbd19f42e243f9d2370473712
  • 3bcd92e4b5d1961e6b85f140d83698c37f0eba71993e41fc62c80a32e1a091c2
  • 3daa009acb66af54564e8dd02da9f2ec1fbebb8c86382c461600cca5ca63ce20
  • 459a5346ac350d03b7e5fd5b9882afee243f2d1f838ead99ab06a2cde783c522
  • 5927953796300be0c5778fc9e9d6bb52a8640f33cae1c684d5225eed327d547d
  • 63544397a0cfbf53588ad8792a870e6b7ff2fa0cf16dc6a3796a3ea4805776d6
  • 714069902c8b82e636cda415148847f5867a32706eaf4a3a04fcb0efac7cc03a
  • 7a6d865285069c90fcf5b8b3671b6daa7c9e6a9e39a37d4854ab630c6f094178
  • 7b4fbaabf1374e4f6c817f0ed5a359f65eabbda7cbd970cb427d57a8a44773d6
  • 7f783789ba87d344bf6450be97b0466c9b73e8cd1d320c08df8cb3636f09fbff
  • 84dd02debbf2b0c5ed7eebf813305543265e34ec98635139787bf8b882e7c7b4
  • 9d6b9fa1861b72f348a4fa8b209eb7f40f4a497bcf98204ba5fd389f7fa82b93
  • 9dd467e34763c06e251c25d5c679e291030564a0b95b6a23a35bbe5a86889c01
  • a23bdb4e3973bc0a4e746038df90e5834efbd521a59df4d488f226a956144da5
  • a3d46a4fb9c6fa286c5dec80dd70a43c9ad70770b5d1540dea13e16b15d2ad26
  • aecfcd163d2665720b7b63288b6964dcab57960c2c3cd77e7674445c282c3188
  • bc9a756357e8a0d29931d1d9ec1747bb73855cdac99021abe99b444e5332a749
  • cc9e68134aab06089ec5b7404d5b54c572b56b04e61053d068cc8b4e67625cce
  • e9a76ace7562d53aaa889caf517b827427162f8512c01ced0657cb08df4121f2
  • ed78e63401ee4290fb334cb0b159b1e94d86de345706f4fc30a4c1df0bd606f7
  • f26e6efc015b0dc9982b88fa02e3f2b2601173aaa300feb558104ef453c94941
  • ee4a6876f192c6a43f1475fbe16e4c4315282e2bc9165ba4dcdf45f07275ec0d
  • cc075ad3073992532759ac2a31b3c57e25bd3a24f1d5a35958d25afa703d7b26
  • 02ec6e8adf56df5bb0cda19ddd04327658c36d493c6cbe6fba42ab0f25034c88
  • f5b88f4034f9c1e0c2f246b8dc21f7fd875638aba63c133f925b8a03b7078657
  • 3ca1fc58bbe212f901523f9ba8800a8bcc47cd054f0648a571abda66c2cbc9c7
  • 2888cc28bac5a432b2a819e08420e8f7e59f28d56ce8168c5865e6c3cd875776
  • de7d4019549e2f018789c902afe9552bd9127328dc439bbe59d8b79a8565569c
  • 70de06f4911513162eb141787027f2cbe463e4382905e80724ad52ca6bae17bb

Coverage


Screenshots of Detection

AMP


ThreatGrid






Win.Trojan.CosmicDuke-6376318-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • Local\MSCTF.Asm.MutexDefault1
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • %WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb
  • \EVENTLOG
  • %WinDir%\SoftwareDistribution\DataStore\DataStore.edb
  • %WinDir%\WindowsUpdate.log
File Hashes
  • 792536894069dc265ae05a25f86a358a10011fa3d32ccf972e5867f862997925
  • 496220acf4b44f5564898533636dc3f19304d86ef7d223fbeedfb858e1570fd3
  • 457bd4b9ad2c422f91fc5bcf74c52d392d32ace50f244d1beb624f42eebbaec8
  • eababe6f24e25622d795bde97ccfc32c51c1d0ee346a3c345f26b8e191d54664
  • 98e5bc8b136f2aafc7b46308f71ceeb675f057f3220a44e90e7498e226d746d3

Coverage


Screenshots of Detection

AMP


ThreatGrid






Win.Trojan.MSILTrojan-6376261-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • 40[.]97[.]169[.]146
  • 40[.]97[.]120[.]66
  • 40[.]97[.]120[.]226
  • 40[.]97[.]113[.]162
  • 40[.]97[.]24[.]2
  • 91[.]198[.]22[.]70
  • 40[.]97[.]145[.]146
  • 40[.]97[.]142[.]210
  • 40[.]97[.]170[.]2
  • 216[.]146[.]43[.]71
  • 216[.]146[.]43[.]70
  • 40[.]97[.]49[.]18
  • 216[.]146[.]38[.]70
  • 40[.]97[.]85[.]34
Domain Names
  • outlook-nameast2[.]office365[.]com
  • checkip[.]dyndns[.]com
  • smtp[.]live[.]com
  • checkip[.]dyndns[.]org
Files and or directories created
  • %AppData%\ScreenShot\screen.jpeg
File Hashes
  • 365505f8969a04992e5e3d835dbb6987a368439b2c757c24e59dc6daa13d60e6
  • 47c364ac3d539ac0874e66b3f7cb0c5a87e3c67323156b082575fc926d1ecb13
  • 6707d3ed970ced8091d64bbd0bc742e2d4d8f192e1e6c64ee9037451c04bca13
  • 987cdbc17259f87a9e6b04c1d6c3c971f23c380f7da1a0d93ff79584230e5b7c
  • b793ca990b4ebad46758253f8b3065334f923a7c077ce57c3b71308b6bd38422
  • c78b70c786d299ecb97021fa4b989455852084ec3afc45f6e348a8a0489263df
  • db8c2fa78a2751bafd2d1a95f778a725735d42854c901e42976d1599f75deef5

Coverage


Screenshots of Detection

AMP


ThreatGrid


↧
↧

This Holiday Season - Buy One IoT Device, Get Free CVEs

November 20, 2017, 9:14 am
$
0
0
As the Internet of Things gains steam and continues to develop, so are adversaries and the threats affecting these systems. Companies throughout the world are busy deploying low cost Internet-connected computing devices (aka the Internet of Things) to solve business problems and improve our lives. In tandem, criminals are developing their methods for abusing and compromising vulnerable and poorly defended IoT devices.

In the past year, we have seen criminals recruit vulnerable IoT devices to form the Mirai botnet, capable of launching the largest denial of service attack in history, and more recently witnessed the emergence of further IoT botnets, which consist of many thousands of infected devices performing the bidding of a criminal owner. These networks of devices can be instructed to simultaneously bombard websites with network traffic bringing down systems under the strain of the coordinated denial of service attack.

Talos researches and monitors the threat environment in order to protect Cisco customers against emerging threats. We strive to make the wider community aware of the issues of poorly secured IoT devices, and actively hunt for vulnerabilities. In recent weeks, Talos has published reports on vulnerabilities which we have resolved in home security cameras, a Disney branded home IoT device designed to increase security, and in software designed to run on embedded systems, such as those used in IoT systems.

Many of these vulnerabilities allow attackers to execute unauthorised computer code on devices, permitting attackers to read data, launch attacks at other systems, or render the compromised device inoperable. Not only may an unsecure device leak information that should never be released, but an unprotected vulnerable device is at the mercy of attackers.

As with all vulnerabilities discovered by Talos, we follow our published responsible disclosure policy to ensure that vendors have the time to release patches to fix the vulnerabilities. We understand that in the field applying patches to a vulnerable system is not always easy, or even possible. This is why when we disclose the presence of a vulnerability, we release open-source Snort signatures to detect and block attempted exploitation of the vulnerability.

Protecting potentially vulnerable IoT devices with Intrusion Prevention System (IPS) network security defenses forms only part of the full suite of IoT protection available from Cisco. Cisco also offers cybersecurity and Internet of Things training courses through the Cisco Networking Academy. The goal of these programs is to increase skill levels among current workers, and enable new employees to enter the workforce with the knowledge necessary to succeed.

Securing the Internet of Things begins with an awareness of the problem. Awareness of the issues and the risks, as well as the solutions to the problem, are vital first steps to resolving the issue. We are committed in our research to identify the vulnerabilities and the techniques that may be used by criminals to subvert the Internet of Things, and committed to ensuring that everyone can reap the benefits that this new frontier offers.
↧

Beers with Talos EP 17: Greek Gods, Trojans, and the Spice Girls as Spirit Animals

November 21, 2017, 11:05 am
$
0
0


Beers with Talos (BWT) Podcast Episode 17 is now available.  Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast

EP17 Show Notes: 

Matt hijacks the Roundtable to tell us which Spice Girl each host is, because where else does a PR gimmick from KFC lead? Also, what’s worse than clicking a search result and getting a slideshow listicle? Getting a trojan payload when searching for banking forms (but that is the only thing that is worse - ARE YOU LISTENING BUZZFEED?). We also discuss the misnaming of troll farms and how patching and proper network segmentation are your friends - unlike anyone who publishes clickbait slideshows - STILL LOOKING AT YOU, BUZZFEED)

For your consideration - Did Joel intentionally break the uploader to delay the episode by several days? Why would he do such a thing?  Discuss.
Make sure to subscribe on iTunes, Google Play, or Stitcher to make sure you don't miss an episode!


Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
Hosted by Mitch Neff (@MitchNeff)

Find all episodes:
http://cs.co/talospodcast

Subscribe via iTunes (and leave a review!)
http://cs.co/talositunes

Check out the Talos Threat Research Blog:
http://cs.co/talosresearch

Subscribe to the Threat Source newsletter:
http://cs.co/talosupdate

Follow Talos on Twitter:
http://cs.co/talostwitter

Give us your feedback and suggestions for topics:
beerswithtalos@cisco.com
↧

Talos Wins The 5th Volatility Plugin Contest With Pyrebox

November 22, 2017, 5:18 am
$
0
0

Talos has won this year's 5th Volatility plugin contest with Pyrebox. Volatility is a well-known open-source framework designed to analyze operating system memory. The framework has existed since 2007. For the previous 5 years they have run a plugin contest to find the most innovative, interesting, and useful extensions for the Volatility framework. Pyrebox is an open-source Python scriptable Reverse Engineering sandbox developed by Talos. Based on QEMU, its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. In this context, Pyrebox is able to interact with Volatility in order to collect information from the memory of the analysed system.


Here is a snippet of this capability:


You can find more information concerning Pyrebox in our blog post.

Talos supports many open-source projects that can be found in our Github repository. We are delighted to share tools with the broader security community and to support thriving open-source communities. In addition to the quantity of projects, this 1st place further demonstrates the excellence of our open source projects.

↧
Search

ROKRAT Reloaded

November 27, 2017, 9:52 pm
$
0
0
This post was authored by Warren Mercer, Paul Rascagneres and with contributions from Jungsoo (Jason) An.

Executive Summary


Earlier this year, Talos published 2 articles concerning South Korean threats. The first one was about the use of a malicious HWP document which dropped downloaders used to retrieve malicious payloads on several compromised websites. One of the website was a compromised government website. We named this case "Evil New Years". The second one was about the analysis and discovery of the ROKRAT malware.

This month, Talos discovered a new ROKRAT version. This version contains technical elements that link the two previous articles. This new sample contains code from the two publications earlier this year:

  • It contains the same reconnaissance code used;
  • Similar PDB pattern that the "Evil New Years" samples used;
  • it contains the same cloud features and similar copy-paste methods that ROKRAT used;
  • It uses cloud platform as C&C but not exactly the same. This version uses pcloud, box, dropbox and yandex.



We also discovered that this new version of ROKRAT shares code with Freenki, a downloader used in the FreeMilk campaign.

The campaign started, unsurprisingly, with a malicious HWP document. This document was alleged to be written by a lawyer who claims to represent the "Citizens' Alliance for North Korean Human Rights and Reunification of Korean Peninsula". It mentions a meeting of this group that took place the 1st of November at Seoul. Due to the content of this malicious document we can assume that the targets are interested by the situation in North Korea. This malicious document drops and executes a new version of ROKRAT.

HWP Malicious Document


As with the previous ROKRAT campaigns we described the infection vector used with this actor is a malicious HWP document. The HWP files are created using Hangul Word Processor, a popular alternative to Microsoft Office for South Korean users developed by Hancom. Here is a screenshot of the malicious document:

The malicious document mentions the "Community of North Korean human right and unification". We first observed his campaign during November 2017. The document was alleged to be written by a lawyer who has been representing the community known as '올인통 (올바른북한인권법과통일을위한시민모임)'.

The purpose of the document is to arrange a meeting to discuss about items which are related to 'North Korean Human Rights Act' and 'Enactment of a law' which passed in last 2016 in South Korea.

Based on the meeting date (1st Nov 2017), this decoy document could be delivered to the stakeholders in the community '올인통' by pretending to be a request to join the discussion for finding better ideas/ways to let more people be interested in their activity before Nov 2017.

The HWP file contains an OLE object named BIN0001.OLE. Once extracted and uncompressed (zlib), we obtain the following script:
const strEncode = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hV[...redacted...]AAAAAAAAAAAAAAAAAAAAAA="
DIM outFile
DIM base64Decoded
DIM shell_obj
SET shell_obj = CreateObject("WScript.Shell")
DIM fso
SET fso = CreateObject("Scripting.FileSystemObject")
outFile = "c:\ProgramData\HncModuleUpdate.exe"
base64Decoded = decodeBase64(strEncode)
IF NOT(fso.FileExists(outFile)) then
writeBytes outFile, base64Decoded
shell_obj.run outFile
END IF
WScript.Quit()
private function decodeBase64(base64)
DIM DM, EL
SET DM = CreateObject("Microsoft.XMLDOM")
SET EL = DM.createElement("tmp")
EL.DataType = "bin.base64"
EL.Text = base64
decodeBase64 = EL.NodeTypedValue
end function
private Sub writeBytes(file, bytes)
DIM binaryStream
SET binaryStream = CreateObject("ADODB.Stream")
binaryStream.Type = 1
binaryStream.Open
binaryStream.Write bytes
binaryStream.SaveToFile file, 1
End Sub
The purpose is to decode, using the base64 algorithm, the content of the strEncode variable. The decoded data is stored in the c:\ProgramData\HncModuleUpdate.exe file and executed. The binary is the ROKRAT dropper. The specific filename 'HncModuleUpdate' may fool a user into thinking this is a Hancom software.

Stage 1: Dropper


The purpose of the dropper is to extract the resource named SBS. This resource contains malicious shellcode. Additionally, the dropper executes a new cmd.exe process, injects the extracted resource and executes it. The code injection is performed by the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() APIs:

Once executed, the shellcode will decoded a PE file, will load it in the memory of cmd.exe and finally will execute it. This payload is a new variant of ROKRAT.

Additionally, one of the analysed droppers displays a picture to the user:

The people in the pictures are about the Korean war and people related to independence troops during the "independence movement". The image on the top left comes from Wikipedia. The picture in the middle left comes from this blog. And the bottom left image comes from this news website. The decoy image seems to be a set of public pictures.

Stage 2: ROKRAT

Similarities With the "Evil New Years" MalDoc


This variant of ROKRAT contains similar code with the "Evil New Years" downloader. The information collected during the reconnaissance phase is similar. The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData. The "System manufacturer" value is used to identify the type of machine. Here is the graph flow of the "Evil New Years" downloader:

The graph flow of the ROKRAT variant:

The graph flows are 99% similar. Additionally, the machine type is described with the following strings:

The code appears to be based on this forum post describing the use of the Win32 APIs used. The source code only considers the following type:
default:   lpString = "(Other)";               break;
case 0x02: lpString = "(Unknown)";             break;
case 0x03: lpString = "(Desktop)";             break;
case 0x04: lpString = "(Low Profile Desktop)"; break;
case 0x06: lpString = "(Mini Tower)";          break;
case 0x07: lpString = "(Tower)";               break;
case 0x08: lpString = "(Portable)";            break;
case 0x09: lpString = "(Laptop)";              break;
case 0x0A: lpString = "(Notebook)";            break;
case 0x0E: lpString = "(Sub Notebook)";        break;
Notice the () used by the ROKRAT author too. Some values are ignored as we can see from the SMBIOS documentation:

The missing values are also omitted from the forum post.

Another similarity is the PDB path. The "Evil New Year" sample contained the following PDB path: 
  • e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdb
This new ROKRAT variant contains the following PDB:
  • d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb
We clearly have the similar pattern.

Anti-Sandbox


This ROKRAT variant contain anti-sandbox tricks. This is performed by checking if the following libraries are loaded:

  • SbieDll.dll (sandboxie library)
  • Dbghelp.dll (Microsoft debugging tools)
  • Api_log.dll (threatAnalyzer / GFI SandBox)
  • Dir_watch.dll (threatAnalyzer / GFI SandBox)

Anti-Debug


This ROKRAT version contains anti-debug tricks. For example it uses the following NOP technique:

nop dword ptr [eax+eax+00h] is a 5 bytes NOP: 0x0F1F440000. But this opcode is not correctly supported by Immunity Debugger, the assembly is replaced by "???" in red in the screenshot:

Screenshots Feature


The two ROKRAT versions performed screenshots. It's interesting to note similarities between the two versions. Especially the filename of the saved screenshot, here is the April ROKRAT version:

And the code of the November version:

The pattern is exactly the same: %s%04X%04X.tmp. The two %04X are random values. And the %s contains a temporary path (obtained with GetTempPath()). In both sample, the string length is 0x12C (300). This part is clearly a copy-paste.

Browser Password Stealer


One of the analysed November ROKRAT samples contained a browser stealing capability. The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password:

Additionally, ROKRAT supports the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer. Here is the initialization of the Vault APIs:

The ROKRAT implementation is largely based on the following project. This is a change of tactic for ROKRAT when compared with previous samples/versions. This time the actor is specifically targeting information which would be used for additional compromises and maybe even on potential personal accounts. The method used by the ROKRAT actors was also out of the ordinary as they embedded the whole SQLite library into their executable to allow the SQLite browsing attempts used for Firefox & Google Chrome.

During our investigation, we discovered that the browser password stealer code is exactly the same as the code used during the FreeMilk campaign described by Unit 42. In this article, the author already noticed C2 infrastructure overlap between FreeMilk and ROKRAT. In addition, we can add that some code overlap is present between the 2 samples:

On the left, we have the ROKRAT sample and on the right the FreeMilk sample. We can notice that in addition to the code, the author copy-pasted English typos such as "IE Registery".

Cloud Platforms Used As C&C


Finally, this ROKRAT version uses cloud platforms in exactly the same way as our previous analysis. This time, the author did not use social network platforms, but different cloud providers:

  • pcloud



    • Box


    • Dropbox

    • Yandex


    Conclusion


    This campaign shows that the actor behind ROKRAT is still active. Based on the PDB, it could be the 13th version of this malware. This actor made the decision only to use legitimate cloud platforms, but changed some from the last incarnation. From an attacker's perspective it's an interesting choice, the flow is encrypted by default with HTTPS and the malicious flow can be difficult to find in the middle of legitimate traffic to these platforms. We can also determine that the actor likes to use code already available on the internet in various repositories we mentioned throughout this post ie; GitHub, Code Project and other public forums.

    Based on source code copy-paste, we remain highly confident that the author of ROKRAT is also behind, or working with those behind, the FreeMilk spear phishing campaign. This is further proven by the fact that ROKRAT shares code with Freenki downloader used in the FreeMilk campaign.

    Moreover, the actor is always interested by the same pattern of targets, the decoy documents refer to precise elements related to the geopolitical situation between North and South Korea. Generally, the documents reference the Ministry of Unification or the situation of North Korean citizens. They frequently contain specific references to real meetings or conferences, showing a high knowledge of current events in North and South Korea.

    Together this information helps us to understand the profile of the targeted systems and the interests of the threat actor.

    Coverage


    Additional ways our customers can detect and block this threat are listed below.
    Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

    CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks.

    Email Security can block malicious emails sent by threat actors as part of their campaign.

    Network Security appliances such asNGFW,NGIPS, andMeraki MX can detect malicious activity associated with this threat.

    AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

    Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

    Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

    IOCs


    Path: c:\ProgramData\HncModuleUpdate.exe
    MalDoc: 171e26822421f7ed2e34cc092eaeba8a504b5d576c7fd54aa6975c2e2db0f824
    Dropper #1: a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037
    Dropper #2: eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14
    Dropper #3: 9b383ebc1c592d5556fec9d513223d4f99a5061591671db560faf742dd68493f
    ROKRAT: b3de3f9309b2f320738772353eb724a0782a1fc2c912483c036c303389307e2e
    Freenki: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5
    ↧
    ↧

    Vulnerability Walkthrough: 7zip CVE-2016-2334 HFS+ Code Execution Vulnerability

    November 30, 2017, 7:00 am
    $
    0
    0
    This blog post was authored by Marcin Noga of Cisco Talos.

    Introduction


    In 2016 Talos released an advisory for CVE-2016-2334, which was a remote code execution vulnerability affecting certain versions of 7zip, a popular compression utility. In this blog post we will walk through the process of weaponizing this vulnerability and creating a fully working exploit that leverages it on Windows 7 x86 with the affected version of 7zip (x86 15.05 beta) installed.

    Analysis


    First a quick look at the vulnerable portion of the 7zip code. Additional technical details regarding this vulnerability can be found in the aforementioned advisory report.
    The vulnerability manifests during the decompression of a compressed file located on an HFS+ filesystem. It is present within the CHandler::ExtractZlibFile function. As can be observed in Fig. A, on line 1575, the ReadStream_FALSE function gets the number of bytes to read from the `size` parameter and copies them from the file into a buffer called buf. The buf buffer has a fixed size of 0x10000 + 0x10 and is defined in the CHandler::Extract function. The problem is that the size parameter is user controlled, and is read directly from the file (line 1573) without any sanity checks being performed.

    A quick summary:
    • size parameter - A 32-bit value fully controlled by the attacker.
    • buf parameter - A fixed buffer with a length of 0x10010 bytes.
    • ReadStream_FALSE - A wrapper function for the ReadFile function, in other words, the content that is overflowing the `buf` buffer is coming directly from the file and is not restricted to any characters.
    Note: In situations where the heap overflow is triggered by a function like read/ReadFile, generally the part of the code which is finally executed in the kernel, the overflow won't appear if we turn on page heap. Kernel awareness of the unavailable page (free/protected/guarded) causes the system call to simply return an error code. Keep this in mind before turning on page heap.

    We need to create a base HFS+ image which we will modify later to trigger the vulnerability. We can do this using either Apple OSX or with the python script available here if using the Windows platform. On OSX Snow Leopard 10.6 and above, you can use the DiskUtil utility with the --hfsCompression option to create the base image. Later we will walk through the technical details of how modify the image to trigger the vulnerability. For now, the modified version of the image should look like this.
    c:\> 7z l PoC.img

    Scanning the drive for archives:
    1 file, 40960000 bytes (40 MiB)
    Listing archive: PoC.img
    --

    Path = PoC.img
    Type = HFS
    Physical Size = 40960000
    Method = HFS+
    Cluster Size = 4096
    Free Space = 38789120
    Created = 2016-07-09 16:41:15
    Modified = 2016-07-09 16:59:06

    Date      Time    Attr         Size   Compressed  Name
    ------------------- ----- ------------ ------------  ------------------------
    2016-07-09 16:58:35 D....                            Disk Image
    2016-07-09 16:59:06 D....                            Disk Image\.fseventsd
    2016-07-09 16:41:15 D....                            Disk Image\.HFS+ Private Directory Data
    2016-07-09 16:41:16 .....       524288       524288  Disk Image\.journal
    2016-07-09 16:41:15 .....         4096         4096  Disk Image\.journal_info_block
    2016-07-09 16:41:15 D....                            Disk Image\.Trashes
    2014-03-13 14:01:34 .....       131072       659456  Disk Image\ksh
    2014-03-20 16:16:47 .....         1164          900  Disk Image\Web.collection
    2016-07-09 16:41:15 D....                            Disk Image\[HFS+ Private Data]
    2016-07-09 16:59:06 .....          111         4096  Disk Image\.fseventsd\0000000000f3527a
    2016-07-09 16:59:06 .....           71         4096  Disk Image\.fseventsd\0000000000f3527b
    2016-07-09 16:59:06 .....           36         4096  Disk Image\.fseventsd\fseventsd-uuid
    ------------------- ----- ------------ ------------  ------------------------

    2016-07-09 16:59:06             660838      1201028  7 files, 5 folders

    Preparing the Test Environment

    Building 7zip 15.05 beta


    To make our exploitation analysis easier we can build 7zip from source code and add debugging features to the build. Change the build file (Build.mak) as follows to enable debugging symbols:
    Standard:

    - CFLAGS = $(CFLAGS) -nologo -c -Fo$O/ -WX -EHsc -Gy -GR-
    - CFLAGS_O1 = $(CFLAGS) -O1
    - CFLAGS_O2 = $(CFLAGS) -O2
    - LFLAGS = $(LFLAGS) -nologo -OPT:REF -OPT:ICF

    With debug: 

    + CFLAGS_O1 = $(CFLAGS) -Od
    + CFLAGS_O2 = $(CFLAGS) -Od
    + CFLAGS = $(CFLAGS) -nologo -c -Fo$O/ -W3 -WX -EHsc -Gy -GR- -GF -ZI
    + LFLAGS = $(LFLAGS) -nologo -OPT:REF -DEBUG
    Once 7zip has been compiled from source, we can perform a test run using our PoC and see what the heap layout looks like before the overflow occurs.
    "C:\Program Files\Windows Kits\10\Debuggers\x86\windbg.exe" -c"!gflag -htc -hfc -hpc" t:\projects\bugs\7zip\src\7z1505-src\CPP\7zip\installed\7z.exe x PoC.hfs
    Note: Remember to turn off all heap options for the debugging session using the !gflag command.
    Let's check the memory chunks after this buffer :
    The heap listing looks promising. We found a couple of objects with a vftable. We can potentially use them to manipulate the control flow of the code. By overwriting the vftables with our data, we can bypass the heap overflow mitigation techniques present in modern operating systems and take over control of the code execution.

    Let's do a test without changing the PoC by just overwriting the object inside the debugging session and continue with execution:
    It appears that the overwritten object was called after the overflow and it happened quickly enough that no other memory operation (e.g. alloc/free) affected the corrupted heap prior to the call. Had this not been the case the application would have crashed. Now we need to confirm that the heap layout is the same with the standard version of 7zip. It is important to keep in mind that the debug version could have a significantly different heap layout.

    Finding the ExtractZLibFile Function


    To determine what the heap layout looks like in the standard build of 7zip, we need to find the ExtractZLibFile function where the ReadStream_FALSE function is called.

    To localize this function we can look for one of the constants used in its body and search for it in IDA. 
    0x636D7066
    *(Function was renamed in IDA before)

    Jumping into the .text1001D9D9 location shows that we found what we were looking for.
    We can then set a breakpoint on 0x1001D7AB which contains the call to ReadStream_FALSE in our debugger to analyze the heap layout around `buf`.
    Hint: See that edx is pointing to the `buf` buffer address

    The heap layout should look like this:
    Unfortunately, it appears that using the standard 7zip build results in a different heap layout. For instance, following our `buf` buffer [size 0x10010 ] there is no object containing a vftable.

    Note: WinDBG shows objects with a vftable via the !heap -p -h command even when no debugging symbols or RTTI are loaded. For example :
    013360b0 0009 0007  [00]   013360b8    0003a - (busy)
    013360f8 0007 0009  [00]   01336100    00030 - (busy)     ←-- object with vftable

    ? 7z!GetHashers+246f4

    01336130 0002 0007  [00]   01336138    00008 - (free)
    01336140 9c01 0002  [00]   01336148    4e000 - (busy)
    * 01384148 0100 9c01  [00]   01384150    007f8 - (busy)
    Our goal is to write a real world exploit, so we need to find a way to manipulate the heap and reorder it in a better way to facilitate this.

    Building Our Strategy


    Our PoC.hfs file contents and its internal data structures have the biggest influence on the structure of the heap. If we want to change the current heap layout we need to create a reasonably reliable HFS+ image file generator, which will allow us to add HFS+ parts into the file image in a way that allows us to reorder heap allocations so that we can ensure that objects with a vtable appear after our `buf` buffer.

    There is no need to build a super advanced HFS+ image file generator implementing all possible structures, configurations and functionalities. It simply needs to support the elements that will enable us to reorder the heap and trigger the vulnerability.

    For details regarding the HFS+ file format, you can consult the documentation here. A decent understanding of the HFS+ file format will help during this debugging session.

    Identifying Elements That Change the Heap Layout


    First we need to identify places where the data from our file is written on the heap and its size is variable. We will begin our search in the part of the code that is responsible for parsing the HFS+ format.

    Note: Remember that 7zip might execute several instructions before it begins parsing a particular format. An example of this are actions that relate to "dynamic" format detection,etc.

    By debugging the code of our PoC.hfs example step by step, we can find all of the functions that are responsible for writing our data to the heap during the file parsing process.

    Mapping it to the source code, we start here:
    To later dive into:
    After some testing, we can identify a perfect candidate inside the following function:
    LoadName function body:
    Each attribute has a name which is a UTF-16 string with a variable size allocated on the heap. This looks like a perfect candidate. We can add as many attributes as we want using their name as a spray. The only constraint is that the `attr.ID` must be set to anything except the corresponding `file.ID`

    Writing the HFS+ Generator


    The file which we want to generate is supposed to look like this:
    The 7zip author did not directly follow the standard HFS+ documentation, when the HFS+ file system parser was implemented by him. This requires us to first analyse 7zip to determine how HFS+ parsing was specifically implemented in 7zip. We are releasing a file generation script to create the specially crafted file required to exploit this vulnerability. The script can be obtained here.
    010 Editor template used during the file format reversing process.
    As mentioned above, our generator is limited to only generating the necessary structures in the file to trigger the specific vulnerability covered in this post. By setting the `OVERFLOW_VALUE` (the size of the buffer used to overflow the `buf` buffer) to 0x10040, we can generate a file that triggers the vulnerability and generates the following result in our debugging session:
    Let's single step through the code execution and analyze where the overflow occurs:
    We have confirmed that our HFS+ generator works. Let's increase the OVERFLOW_VALUE variable to 0x10300 which should be enough to overflow the following free chunk with the size of 0x310 bytes. In other words the chunk that contains an object with a vftable. Let's walk through this below.
    What we find is that the free chunk following the `buf` buffer grew up, preventing us from successfully overflowing the next object with a vftable. It appears that there was a memory allocation somehow related to the content of our file. To search for the location where that instruction occurred we can set the following conditional breakpoint: 
    bp ntdll!RtlAllocateHeap "r $t0=esp+0xc;.if (poi(@$t0) > 0xffff) {.printf \"RtlAllocateHeap hHEAP 0x%x, \", poi(@esp+4);.printf \"Size: 0x%x, \", poi(@$t0);.echo}.else{g}"
    To simplify this task we can use the 7zip version with debugging symbols which we built earlier.
    The debugger hit the breakpoint where buffer with same size as our file size is allocated. After quick analysis it turned out that we have landed in the portion of the code that is responsible for the heuristic detection of the file format.

    7zip allocates a buffer large enough to handle the size of the entire file contents then it attempts to determine the format of the file before finally freeing the previously allocated buffer. The freed buffer memory is later used during the allocation of the `buf` buffer. This is why we see a gap after its chunk which grows when we increase the payload size. Does that mean the exploitation won't be possible? No, did you notice the file extension we used to save the generated file? If we want to avoid the heuristic file detection functions in 7zip, we simply need to use proper file extension, .hfs in this case. If we use this extension, 7zip does not execute the heuristic functions and the heap looks like this:

    Building Our Strategy


    Let's take a moment to summarize what we now know and try to figure out a strategy we can use to create a working exploit.
    • Our target buffer (`buf`) has a fixed size: 0x10010.
    • Due to this buffer size, it will always be allocated by heap-backend. Additional details regarding this can be found here.
    • We can allocate any number of objects with any size before the overflow occurs.
    • We can't perform or trigger any free action on the heap.
    • We are unable to perform any alloc/free operation following the overflow.
    Given the situation described above, being limited to the aforementioned operations and considering all of the heap mitigations implemented in Windows 7, a sound approach is described below:
    • We should locate an object with vftable that is called as soon as possible following the overflow. This is important because if the call to vftable that is overflowed by us is far from memory location where overflow took place, the likelihood that the code will call an alloc/free operation increase, causing the program to crash.
    • Spray the heap with attributes (name) with the same size the interesting objects we identified. The assumption is that allocating objects with the same size as the target object with an amount greater than 0x10 and an object size of less than 0x4000 (the Low Fragmentation Heap maximum object size) we will activate LFH and allocate free chunks for objects with that size. This should result in free slots being allocated after the overflowed buffer and the objects will be stored within them.

    Identifying Interesting Objects


    Now that we have defined our strategy, we need to locate a suitable object to overwrite. To find it, we can use a simple JS script for WinDBG that is responsible for printing an object with vftable as well as its stack trace.

    The script that performs these actions is located here.
    This should result in the following:
    First we will try to look for objects allocated in the same function where overflow occurs, `ExtractZlibFile` because they will likely be used quickly following the overflow. We can identify two candidates based on the previous screenshot.

    The aforementioned objects are defined in the following locations:
    Line 1504  CMyComPtr<ISequentialInStream> inStream;
    (...)
    Line 1560  CBufInStream *bufInStreamSpec = new CBufInStream;
    Line 1561  CMyComPtr<ISequentialInStream> bufInStream = bufInStreamSpec;
    Their destructors (release virtual method) are called as soon as the function exits. The fastest way to trigger this is to set the first byte in our overflowed buffer to `0xF`.

    Moving the Objects


    Now that we have identified the object we would like to overflow, we need to spray the heap with attribute structures containing `name` strings with the same length as the objects, which are:

    0x20 and 0x30.

    We can accomplish this using the following:
    We can either write a script which will control WinDBG and increase the number of attribute structures until our target objects are allocated after overflowing the buffer or do it manually.

    We chose to take a manual approach, simply increasing the numbers by 10, 20, 30 and observing the heap. As the object locations began to reach the buf location, we simply switched to increasing it by one.

    A few attempts later we reached the value of 139:

    139 * (0x20 + 0x30 + 2* 0x18)

    At this point the heap layout looks as follows:
    This heap structure looks promising. Subtracting the address of the `buf` buffer, which is 0x12df9c8 subtracted by 8 bytes due to the offset in the call instruction (0x12df9d0) from the address after the object located at 0x12efdf8 will help us determine how many bytes we need to overwrite the targeted object. In order to identify how much space is available for our payload, I maximized this size choosing nearly the last address available on the heap (not visible in the screenshot above). Using that information, we can update the OVERFLOW_VALUE variable with value 0x12618.

    Now we can regenerate our file again and execute the application to confirm that vftable is successfully overwritten:
    Now that we have confirmed that, we can specifically focus on weaponizing our exploit.

    Checking Available Mitigations


    Further development of our exploit depends on mitigations implemented in the version of 7zip we are analyzing. Below we can see the mitigations implemented in version 10.05 of 7zip:
    As identified in the screenshot below, 7zip does not support Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP). We had hoped that this would change following the publication of an advisory last year related to this vulnerability but this still appears to be the case.
    If you are using the 64-bit version of 7zip, then DEP is forced by operating system.

    Finding The Payload


    Before we start looking for gadgets let's identify all registers and pointers on the stack pointing to our payload.
    As you can see in the above screenshot, there are a few places pointing to different parts of our payload :
    • ESI
    • EDX
    • ESP
    • ESP-C
    • ESP+30
    • EBP+40
    • EBP-2C
    • EBP-68
    We need to determine the exact offset from our buffer to the vftable object. Since ESI points to the vftable object and EDX points to our buffer, we can simply subtract EDX from ESI to obtain this offset. 
    0:000> ?esi - edx 

    Evaluate expression: 66608 = 00010430
    Putting the value that is stored at that offset into our payload results in the following:
    The value has changed because `8` has been added. Now we can start identifying gadgets keeping in mind the aforementioned elements.

    Pointer on Pointer


    Since we will be overwriting the pointer to the vftable we will need to identify both gadgets as well as pointers to this gadgets.

    To perform this task you can use the following tools:
    Using multiple tools is a good way to maximize the number of interesting gadgets that are discovered during this type of analysis.

    First using RopGadgets let's generate the list of gadgets for 7z.exe and 7z.dll:
    Now using these lists with Mona we can find pointers to these gadget addresses.

    Abusing Lack of DEP


    Since DEP is not supported in this 7zip version, one of the easiest ways to exploit this vulnerability is to simply redirect code execution to our buffer located on the heap. Reviewing the list of pointers we previously enumerated among the others which will meet these requirements reveals the following candidates:
    So there are multiple addresses which contain the same pointer value. They will be very useful because in our gadget we will redirect code execution to our buffer using the pointer stored in the address pointed to by the ESP register. It contains the same value pointed to by ESI which is where we will put the address of our pointer to our fake vftable.

    Keeping this in mind, we need to identify what instruction it will disassemble to.
    As you can see the `POP ES` instruction causes an exception. Additionally, we do not have any influence on the value on the stack being "popped" to `ES`. Fortunately, one of the additional gadget addresses disassembles to a less problematic instruction:
    0x1007c748 - 8  = 0x1007c740
    `EDI` points to a writable area of memory, so we should be able to execute these instructions.

    Also notice that the bytes we use to fill the buffer (`0xcc`) have been used in this instruction.

    With that in mind, we will omit 3 bytes when setting the offset for our shellcode in the buffer.

    Adding Shellcode


    Now we are ready to add our shellcode which should be located at offset:
    fake_vftable_ptr_offset = 0x00010430 + 3 ("0xCC")
    To generate the shellcode we can use msfvenom which is included with Metasploit :
    The updated script including our shellcode should look like this:

    Testing the Exploit


    Now that we have everything in place we can generate our HFS file and test our exploit:



    Now we have confirmed that our shellcode operates as intended.

    Exploit Stability


    We have confirmed that our strategy of spraying the heap with objects with sizes of 0x20 and 0x30 is effective but what about stability?

    The same version of 7zip parsing exact same HFS file should contain same heap layout at certain points but we need to consider variable artifacts allocated on the heap like environment variables, command line argument strings, the path to the file containing our payload, etc. These elements could change the heap layout and differ across systems.

    Unfortunately those variable artifacts are allocated on the same heap as our overflowed buffer in this case, at least in the case of the command line version of 7zip which we created our exploit to target. Analyzing the heap memory used to allocate our target buffer we can see the following:
    Inspecting the heap, we can see a string which is actually the path to the location of the HFS file to unpack. The variable length of this single string can significantly impact the amount of free/allocated space on the heap which can impact the heap spray object composition and result in failed exploitation.

    One way to account for the difference in free heap space is to create a large enough allocation to exhaust the potential free space on heap, taking into account system limitations with regards to file path and environment variable length, etc. That exercise as well as investigating how the heap layout in the 7zip GUI version is presented is left for interested readers.

    Summary


    Heap based buffer overflow vulnerabilities in applications like archive utilities or general file parsers are still exploitable on modern systems, even if we do not have such flexible influence on the heap like during web browser exploitation. Lacking the option to use corruption of heap metadata to successful exploit the vulnerability forces us to overwrite application data and leverage that to take control of code execution flow. Still lack of current standard mitigations in some products makes exploitation significantly easier.

    ↧

    Recam Redux - DeConfusing ConfuserEx

    December 6, 2017, 8:02 am
    $
    0
    0
    This post is authored by Holger Unterbrink and Christopher Marczewski


    Overview

    This report shows how to deobfuscate a custom .NET ConfuserEx protected malware. We identified this recent malware campaign from our Advanced Malware Protection (AMP) telemetry. Initial infection is via a malicious Word document, the malware ultimately executes in memory an embedded payload from the Recam family. Recam is an information stealer. Although the malware has been around for the past few years, there's a reason you won't see a significant amount of documentation concerning its internals. The authors have gone the extra mile to delay analysis of the sample, including multiple layers of data encryption, string obfuscation, piecewise nulling, and data buffer constructors. It also relies on its own C2 binary protocol which is heavily encrypted along with any relevant data before transmission.




    Technical Details

    The Dropper
    The word document (see above) uses common malware techniques, such as embedded VB code, to drop a .NET executable. We will not discuss these techniques further, but concentrate on the deobfuscation of the .NET malware dropper. The dropper is heavily obfuscated with a custom version of ConfuserEx, a free .NET Framework protector. On opening the binary in a .NET decompiler like dnSpy it is initially unreadable (see Fig. 1).

    Fig. 1

    There are a number of free deobfuscators available for ConfuserEx protected binaries; however, none of them are effective for this malware. Only some parts are able to be deobfuscated using these automated tools, leaving important sections of the binary unchanged, and breaking execution. This means we have no choice but to do it the hard way and deobfuscate it manually. There is documentation for manually unpacking ConfuserEx, but unfortunately, we hit bad luck again. The available documentation doesn't work with this version.

    To get started, we first load the binary into dnSpy. We go to the <Module>. cctor and set a breakpoint on the last method (Fig 2). Now we can run the sample in our debugger and see that it has unpacked the first DLL ("ykMTM…" see Fig.2 )

    Fig. 2

    We single step into the method where we hit the breakpoint and see in Fig. 3 that it has unpacked the next stage (coral).

    Fig. 3

    We analysed this stage and found that we can set another breakpoint in the qMayiwZxj class on line 113 (see Fig. 4)

    Fig. 4
    This unpacks the next stage and we see the new unpacked stub.exe assembly (Fig. 5).

    Fig. 5

    If you have looked into other ConfuserEx obfuscated binaries, this looks familiar. Indeed, if you have a closer look, there is a well known friend, the gchandle.free() call on line 10082. This is our next breakpoint candidate. This call used to be the end of an unpacking stage in previous versions.

    Fig. 6

    As expected, this unpacks another module ConfuserEx is known for: koi.

    Fig. 7

    We are getting closer, but the classes in koi are still empty and not yet filled with code:

    Fig. 8

    Again, we set a breakpoint on the last method called in koi's cctor and proceed running the sample.

    Fig. 9
    Nice, another DLL is unpacked, unfortunately it is nothing important. Our Main class and most others in stub are still empty. Single stepping, brings us back into <module>. Once there, we analysed the methods and found out that we can set another breakpoint at line 92 for unpacking the next stage (see Fig. 10).

    Fig. 10

    Tada! If we now look in stub at the classes, they are filled with code. Now we can set a breakpoint on stub.Run() and start investigating what this malware loader is actually doing besides unpacking itself.

    Fig. 11

    We see that it is attempting to bypass some AV scans and reading several config parameters from the resource section. Below you can see the malware's configuration which was hidden encrypted in the resource section (Fig. 12) before unpacking.

    Fig. 12
    It checks if it was executed from the Startup folder (e.g. %AppData%\mozilla firefox\firefox ) as configured in the resource section. If not, it copies itself to the Startup folder and launches itself via cmd.exe. This means, we need to stop debugging and start again by loading the firefox.exe from %AppData%\mozilla firefox\firefox into dnSpy, following the unpacking again up to this point.

    Fig. 13

    Now we are in the "is executed from Startup location" branch. Here it gets interesting. First it makes itself persistent on the local machine. As you can see below, it writes a file called Update.txt with the following content to the %AppFolder%.

    --- snip ---
    C:\Users\dex\AppData\Roaming\mozilla firefox\firefox.exe
    exit
    --- snip ---
    Fig. 14
    Fig. 15

    Then it adds this file to the auto-run registry key by executing reg add in a cmd.exe to make sure the firefox.exe file gets executed at PC start up:

    Fig. 16a
    Fig. 16b

    It executes a couple of other methods based on the configuration and then loads and decompresses the LZMA compressed malware payload file (Recam) from the resources MainFile section. After a couple of runtime fixes it loads RunPEDLL.dll and tries to inject the file into the user's browser. In case this fails (e.g. no browser is running), it injects the file into itself (firefox.exe). In both cases the RunPE.Run() method is used to do that.

    Fig. 17

    From here on the work is done for the malware dropper and the loaded Recam binary takes over.

    Payload
    As mentioned in the introduction, the authors have gone the extra mile to frustrate analysis of the sample by using multiple obfuscation techniques, including multiple layers of data encryption, string obfuscation, piecewise nulling, and data buffer constructors. It also relies on its own C2 binary protocol. All relevant data is heavily encrypted before transmission.

    The dropped binary is packed with vanilla UPX. This part is easy to unpack; the tricky part comes in the next stage. After the original Entry Point (OEP) is restored, it begins with some homebrew cryptographic initialization for several values that get used consistently throughout runtime. Most remain constant following the initialization routine, but some change over time. Some preliminary string deobfuscation occurs shortly thereafter and includes a single hard-coded Command and Control server (C2) IP.

    call Recam_string_decode2
    mov [esp+12Ch+var_12C], ebx
    mov [esp+12Ch+len], 0FFh
    mov [esp+12Ch+ciphertext], offset decode2_var_len255
    call Recam_string_decode2
    mov [esp+12Ch+var_12C], ebx
    mov [esp+12Ch+len], 20h
    mov [esp+12Ch+ciphertext], offset aPassword ; "Password"
    call Recam_string_decode2
    mov [esp+12Ch+var_12C], ebx
    mov [esp+12Ch+len], 10h
    mov [esp+12Ch+ciphertext], offset HostID_plus_rand ; "HostId-%Rand%°å"
    call Recam_string_decode2
    mov [esp+12Ch+var_12C], ebx
    mov [esp+12Ch+len], 8
    mov [esp+12Ch+ciphertext], offset mutex_name

    This less frequently used deobfuscation routine is primarily based on a single-byte XOR loop. The other primary routine is JIT based and relies on a hard-coded decode key. Fortunately, IDA Pro's Appcall feature made short work of these obfuscations.

    Fig. 18
    Getting to the end of the preamble functions shortly following the PE Entry Point (EP), we get to an operation selection routine. The presence of unnecessary code and calculations disguises the fact that the jump to location 40849B will always be taken and the apparently interesting code that appears to involve file mangling and process creation is merely a decoy and always skipped in execution.


    lea ebx, [esp+83Ch+var_618]
    mov [esp+83Ch+lpValueName], 204h
    mov [esp+83Ch+uExitCode], offset decode2_unk_len128
    mov [esp+83Ch+Mode], ebx
    call Recam_getenv
    mov [esp+83Ch+uExitCode], 1
    call Recam_arg0_AND_constant
    test al, al
    jz loc_40849B ; jmp taken (skip mangling & proc creation)


    Recam_arg0_AND_constant proc near

    var_1C= dword ptr -1Ch
    arg_0= dword ptr 4

    sub esp, 1Ch
    mov [esp+1Ch+var_1C], offset flow_constant3
    call Recam_base10_to_base16
    and eax, [esp+1Ch+arg_0]
    cmp eax, [esp+1Ch+arg_0]
    setz al
    add esp, 1Ch
    retn

    Moving forward, the malware sets a Run key for system persistence. Near the end of the operations function, an additional thread is created to start up a keylogger component, logging to %APPDATA%\Logs with <DAY>-<MONTH>-<YEAR> as the file name format. Logged input is stored in the commonly seen bracket delimiters. However, as one might expect by now, the final data is encrypted before written to the file on disk.

    Next, the malware will create an ID file entitled .Identifier. If such a file already exists in the PWD of the sample (extracted via the GetModuleFilename API), it is simply read in instead of created from scratch.

    Fig. 19
    Data to be written to the file is generated piece by piece and results in the following format:

    (4 bytes) Static ID
    (13 bytes) HostId-<6 character alphanumeric rand, seeded from system time>
    (19 bytes) 19 null bytes
    (19 bytes) system time OR local time (19 byte format)
    (13 bytes) 13 null bytes

    Fig. 20
    Note that since a static ID is used, the first 4 bytes of the file always remain the same (the cryptography used for the C2 data is much more complex).
    Fig. 21
    Fig. 22a
    Fig. 22b
    As with the .Identifier file, the initial C2 beacon will also always be 68 bytes in length. Each C2 message (both client & server) will use the following format:

    (4 bytes) Length of data following these bytes
    (1 byte) C2 command
    (n bytes) Data relevant to the command

    It's often easiest to break on a few instructions prior to deciphering the C2 beacon for many malware families these days. Whether it was intentional or not, the authors decided to opt of a homebrew crypto scheme allowing for randomized beacon data for each run (only the length bytes & C2 command for the beacon remain the same), or their homebrew crypto implementation is severely complex & broken.

    Fig. 23
    Fig. 24
    Fig. 25
    Once the beacon is sent, the sample waits for a server response. The C2 we encountered is now down and resetting connections, but pcaps captured in sandbox environments at an earlier date can give us a better idea of what to expect for the rest of the communications. The following example shows the beacon, the initial response, one additional client transmission and a series of "keep alive" messages consisting of the sole command byte.

    Fig. 26
    At this point, code execution depends on a flow state that is set only a few times throughout the binary (initially set to 0xFFFFFFFF). As far as the response length and C2 command are concerned, this state further dictates which each attribute must be. For example, the function responsible for checking the response length checks the flow state too. If state has changed, it checks if the message length exceeds 0x30000. If it's still in the default state, it checks if the length is 0x41 (length of the beacon message and its expected response). For the command byte itself, the default state checks if the command byte is set for the beacon phase of the communications (0x85). Once changed it will check to see if the command byte is less than or equal to 0xD2.

    Fig. 27

    Fig. 28

    The response and subsequent data (if any) are relayed to a large jump table that is responsible for checking the command byte and proceeding from there with a particular action as issued by the server.

    Fig. 29

    The beginning of the previously mentioned function and jump table checks flow state again to see if the relevant parameter now equals a previously set state outside of the 0xFFFFFFFF. If this is the case, the data from the last server response is decrypted with the same routine used by the sample to encrypt data before transit. When in the default state, the command byte is passed to a LEA (Load Effective Address) where a calculated address is stored in EAX. In this case, there will be no calculated address due to the zero-extended command byte being referenced by the instruction. Instead, 0x7F gets added to the command byte. The single byte stored in AL taken from the DWORD stored in EAX is compared against 0x51. If equal, it proceeds to the function end and returns with no further action taken. Otherwise, the final byte stored in AL is zero-extended to EAX itself, multiplied by 4 and passed to the jump to determine the next action as requested by the server.

    Fig. 30
     As one might have gathered from the jump table, there are 82 possible commands that can be accepted from the server. However, not every command is unique. As we can see from the highlighted jump offsets below, many lead to the address shown earlier (RVA 0x227C) that is jumped to when completing no action.

    Fig. 31
    While time did not allow us to deeply examine each and every path, gathered sandbox pcaps along with our understanding of the command protocol allowed us to examine the commands sent by the server and calculate the jumps ourselves. Here are some examples of the functionality available in this variant of Recam, given the command.

    0x85 (case 4) - Process initial server acknowledgement and set flow state
    0x81 (case 0) - Keep-alive message
    0xBD (case 12) - Download file to %TEMP% OR download file to %TEMP% and create new process
    0x87 (case 6) - Create new process from argument
    0x89 (case 8) - Close network socket, release mutex, call WSACleanup, & terminate process.


    IOC


    Malicious Word Document:
    C3b1a98c6bc9709f964ded39b288aff66abc5c39b9662fdd28ddfcc178152d67

    Dropper binary:
    99371d8da86e964cc52bd719fd85f1f0015e4c60a9705747bb9b8ac52fd29b4a

    Payload (Recam):
    1fd8520246c75702c000f4fac3f209d611c21bfdb81df054c9558d5e002a85ce

    Command and Control Server:
    185.140.53.212

    Domain registered to the Command and Control Server
    U811696.nvpn.so

    Domain Owner
    meridoncharles@yahoo.com

    Directories and Files
    %AppData%\mozilla firefox\firefox.exe
    %AppData%\mozilla firefox\.Identifier
    %Temp%\Update.txt

    Registry:
    Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Update
    Value: cmd /c type C:\Users\dex\AppData\Local\Temp\Update.txt | cmd


    Similar files:

    Dropper related:
    006583023242bf4a8dcd0190aef32500dcacfacf1dda7b24409133dfccbfd186
    0086bb92bd34b41e180bec90dd15d4b0d0eb9c7384a68b66354d603ad8e14706
    01226da791e32f8cc907f88b2b672068b78b86b1a0d154bd22274234a7d9b5e6
    031046538b60f9b243aa74bdec2a13ab2aee4b941a136daca12de78c3419dd6e
    038aa33ab7363ea484efe9c79c718de500acf766266166b6a70e69b0a67c3984
    03fe0caa0f3e21f1975bdceaa5e38e00d725879322c8815e7b3b60b1c0cfec20
    13010c16d07c00d22ffebd78c7e00ee40678088f3f46292d3fc7e7b299296361
    14d341bd2c2b7ea90b3b15fcb8154caa036b629156199d955047fb081de6669d
    237ed26f6d9b19ddd2fc368ba871c1df651bf20e21f0f2cf2f1a0d9a885fdfab
    2442515adb2cbc03f54b4edce7762e3b4ce0763ad073666cfec5743ff1bc62e2
    264ba90eb6e5e38905bb8333830ea0ef86126d06d68a8609efbe18068d0861e8
    26a6f02efcda37e1c0d1a66ce57ccfe0fb95bf1ddf9b20106e0d90407cb89d0c
    289ab18d2c67c1c2f92829e11761ba3ec3a9088f36993031a002a0dbe7ab08d5
    2a1a0356d96f97a4710511a5e023d43124e7e97261154b5e82d6047fd6dc85e1
    2b3fe2be93456173aa1d998764284c687ce68db9c5bfc5175ccf475b090809c1
    2fbd846efe0cbf9aa0e51da044403f7d96f159ab655bf44ed697062888fd4fbd
    30c0f9250fbe8b8eccbf9b195a4803d33b320d20da4252763cd91b5a8c261872
    31442c2ed9a803eba0e162616c16907985487f3bfddcfbc4e30e699fc58847e6
    3e7aaa364e5d15d974fab62f828a7ab1f14f5c79ceca7e3dd8560f9a863517ad
    3fa46682f660e7f0136544ec995657150bd42dd33ef4362bb0c002d25c9327c2
    490183ce7288fe6b35f2ad05514cbdc8d212121c661edf570530980634983276
    550db43b5965301a33d2bf71760c4e17c7ae249bcbb1f6b0c9173d76774623c4
    61788dbc231ec56f115607e6d7b3cfe2962ecdc112bfbd0a8f2ef1e3f145b25b
    6ac23f995572bd1b9caf860384abf62921cf6d572e679872314f67038bc076ab
    6b965cc215758d529edaff3a2913226823848c47146121855a482059a6e8ee38
    6e74c3a1f5bc17f38da7305068f9203943090067b2dfa67fb9361fa1821a674b
    7960bc0d2d9422df90216d1b81fb4420c04607c374289ffe10eb9a80e18990cf
    7c127f9f22a346d4369405f540c4e467abac02bcf4589dbd6d3e97f18fbe0f98
    7dedf655e19430f538faab5638ec76383d651abf5c24ed799e101abb7c9f40b8
    99371d8da86e964cc52bd719fd85f1f0015e4c60a9705747bb9b8ac52fd29b4a
    9d0671ee5279abd7973a426c60f44723503fd09d4d771092e2453ac4a3e9334c
    9dfee20b6e5c57387968da91ec6efd4e0ac8abce219c437a2cd4b5df36f2a79e
    a9b4e5cf351bbb3f20fcdcd7cf0b2c03df788c4d0c0d59a31cbab09cccc335d1
    c064c70d887ea1ccf37e3edd19dc717b53f2c0513424416fc783654ab9f61134
    c13d2ce1b561ed02c02c9a2899a7d7e9c97400ef8f81eb48d6ba02a90d76c689
    c2fef90a5ad97a030712b9245fccffb26f226370bd6f67c989bbf95e02ca03b8
    c8d98b7f1cf8811c3e75b0ec8c1011d0ed4c3951420f04e3b743da564869e02b
    cdd98208665360ca7745a1e5577e1e9607c49ac8790ffde2edd93e2c64ead8a1
    d7d94b3aea52f0a9bda593806d56f962c09f4d389820cd9016ceed73767feb55
    df46d34c0ff71d994f157cfe158ae7dba9dbf16ffb021a10e401bc9afb2f4e8d
    e20c3b8e3460f719219cb4ddac61231db047c125818a391d34d87dab1726f070
    e3704aa7bfb90e8e7f96aa529cbd96319696157cda076d92bab9eae07cfe977e
    e8a4a890d34b328857389d48d837fcf4b9ab4774a29bcc582b4cdf05ac3a49db
    f7ac275c2971820fb311f41049c5e460251486625696caa0fc60d0ffc683fb70
    fc0bd596957f70e87954ef42acc0bfe0123c11be6879c7c910a4a7e434e36c46

    RTF Document related:
    27bf1851e64f5e6d6e33b2b3bc89b82dda2da2fd9a747c847c148909dda028d3
    7a63150ebd09fd4f8c8f1b7485a0139108f22aea043c9759239d9976948b5c75
    a27ebd73ac836d659512befe4fee57f9343eca992448242b1ab40730506a747c
    ac2e9c83c7e23514c196b14e49f93345bfed2ed8fc10343c21d358ec3e809928
    6f3a8557e2c95a717cb48080042293045011e74f2a4c79aaeffbfcc86456eb37
    5a234b3e389a22b70da242b1c93d65f358d60f1347b03101f7613fa1db032645
    660a6197a032cd2baf35df713575f16b71ebdcda67b89deb1afc45f2b986490a
    7c7d00e12273fe924a9dc945add40c91692b8e468682240cf241a418d3ce198f
    1d604531fd15a7476296612cbfcfa4761148a61d54f44351d97b5feb1bb293e4
    46907300ed93309f083181489bf68ef8f357b1a583bda501b3ab5249f55778ad
    6fed760b5eefd70dddef34daaf678f3d999a91c0f638c8afbe844dd8097c4bc8
    f231bca66d0d8b241dfbd49630602405297c18cbe108b609f420ff6e9c987e7e
    d3de3093b173746fd5cf892e32caafabb898616766953ccad2b6a303930731d4
    662f7b3816dd59c5f1988c9d7b5b62b61b94028fa513ddfe0c00e21a79367883
    b9d38a08e7b888940ad0bafb6032dfe45d4b6cab2f09a734f46d05d718eda57e
    1fd682146e278a76b216215ba9bc8040f9fc4e817f0676ccbfd46ccc13ca95d4
    135db94b1b75fbeccf2e28abf568e3384e14dc452e5f638cdb1cb533794d2bca
    51e1da451e38159e73bf185f627fedf63aca03734e95f88dfbf85536eb6bef9a
    18ba9d4175c48148d4dfa7d022a687e4c63da18337fd86a3f48efd5afa5cfcde
    4f6dd728633bba78841da6fce1ce9a3e8673830588bd51e2bfd283e2afcb0ecb
    6943484dad1a3246a82b1a9444811e0f4c561770291dd936a1f1a5314e13fda9
    53c325566fc88c8355478e001445da54debb009c60581e2e6c3345f10c4f65f0
    a546965c6a46e9f19c374b1195ba0924c0a6d462a9d37210527d1f2801719932
    2752ed543f880807557ba9556838e4ef6a1582ea50351fc2723e4d63f4f57ad9
    771f02d96d7eb5b4e8b719e3d9848482220a27ca0704c0a156c613348e3a64bd
    8ecb075bba3f583d350e136b9df81d2a773f26174a014c59f26915eca785dc4a
    57e31a5ea3b7fa86cf8b1b257cf91e5e499e633b17d2a9bff388beba2fd101d7
    41015210e0faac0825b1c51dde385d390bc7cba7b4c45a534688d58cea5d0d58
    2c69630f2fc87ff69cd7644e312b484c118b7d447985c655ba772954085c8f33
    8481f95d09058d24f4a764223c128bd38e430aa9211f135e684744cc3bbc1b6c
    42b1093ebfd76a869f8a50e7529348f6a5b9d8b85c0d6b2b90d243a32e35baea
    3ee302f650b87c151bb6e91d2b3ff38ab49b1e4ad30f6f18224d8236d9784ad7
    2a8410b31c50f966704f0abb5a976f0faf59604116c4a4908992b33bb9dc4e19
    05ce4c14144b9935de8d30dee60dfaa513bebdccb35099c8892ece10c86f0a6d
    5885ea86add67e7a149634e8c9ae4da63e35b431c5210256a570b56387ee1f8a
    5daba9df4ce8d4e7bc3e5bb6dc43dac7034185a218e53a261f814d6398eabadd
    e5666e76d755a8c1e0430860677dbb1991c9025b99318e42dabefc09f276b91e
    5df14265d5ce37ae0dc0dcb332c42b7331cdc305fc1b265b767bb96d6e6d93cf
    180734591883412d5ad4db3f768b59e7e918fcc987915fb130e72077a27f15a0
    aa3f5e91fb4f447bfff93123c404a62b8ebe2a9790ebbd02c57f5ab61d2d2882
    70ebcc2aa157230051490f5480d49dcef22ad8c26be1307ad8eab63bd4233c40
    a2139efcf459ad80e6ffe1e3e346d18c466dd4a0c1e9973771e3c674abd56456
    98b4862bba7bda1169bc8a3f4726c0033b0a02f9d4d934265c56307c8a9cae11
    944f1bd37c0b223d45b1f33f1b5cb77bee2eb720ac2d17b1098ad770d85083a5
    aed64804a5191a6c119cba1f81ad5f09260bac0f8642d1f0101da73e8a7b3329
    e338747a4f62d1826ee92cf74ae3161bb817a19eefec7902f4f334c43bf94399
    888f9c76d26cdfa7340779a015d95785253cf14a1a850fe79ec64a6a24b1deac
    26092c74ff3ad634577f5b890fbdc911b8813b337b77aa5db5132b5d3a51990d
    810afd3bee3016d443536163cffdb7819cdabbf69b16fffc9108f9747d6314a8
    5062a698879870e73250973e45cadcaade05a314f4f17fb17f14f82007bd6b1b
    f4ecc8fc573401cbd54022d91fe1fe4575d16fe899aa7e30fcc7c17cd8b66ade
    5f485d6c9b210bdb7a7dc4987a3bef3c180cff3a389229853987818673032823
    9cb7191e87fc0efe04f38e8881dd09367c267a5abf0fac51f54d89b6fe1c74e3
    2da4433c077bc5b7a9bb74e89b77e2f441e6f3faca86f1b33ec62745f9d1c119
    31e1bf4c259b09f9a0af1d25e1978fb1cb0aff4dd3ed19c40654b2cf0fc7baa7
    b05d350a806200a7d98386b0955e778f5cde98d1c0b29ae94245731b811983c3
    678fa6d2731f25e7529ead56c1274b40a15275fa8df95004e3c8fa8fb4f87985
    3d4324f0e9eb827b180b8c406c7893a57524cb9c943d0cf51851277c55fa137b
    ff9403de6d602fdfbce67c39929425a6ddf1702f8ccb5f73a45590f41ec9b298
    75ded8ff160d4a4cb1a15617ba82c2fd979f4c6de068ad3c1628c3fa96ccb06e
    c167a67bf9f07204a6d4f15848d40c152138d56d1e105cf851dda74049ef4e02
    d873d716210c4c3eb86d2e27c72ec5b083b29a3ceaa0e71e0a784aac74667670
    9299804183d38a89f7790527b21acbc958c40dd09b09c40fe19c4629cdeaacf0
    b9b5adb3b3918e9652b73d06e2ea98370a48c3a58ef86405f56c47771cc21af4
    f982fb8ef63466c16cdc5c8d107770f986e4b28c476edf5d848a600e2f4320fa
    202e364f3b50fd785831515c6991f5db2c03923890785788c15c04e8128b4e12
    4789ee4e6c8490b31fa68b40dc134d29baae0872dd1fda04a28d62f8455fcf2e
    167594296c9be12c0aa8f9ab40e83409361ba0e4eb8044fe3276d0c927fcd3c7
    90d293195bf573c14d39eac6aa6e0786b3282bbd3f4bff850b7dedb7eebb6049
    ecee734d28bf51f199efea4d27e42865fdafe0d880ba6b9ed846a502050d8e20
    7cdcb22b02294c4d981c161e6f527b9a4b9e0ec8a63778f0f9ba4b0d86daac2a
    84684f264b035865a26dca9631f0bb0d88597daaed3cfe1bb69c6c81892cb20f
    b89ebe23b4d2d47885c7431ddb1ffd084e1537c59585fb29a825a06581af0dea
    bbe8d4f57f896b96cb2f1c147afdf4bd50277d436bb68c03216547bdc9d88b7a
    603c5d3dffc0ecfb898bbab51130b7b1c95c95c0dba8691873eed5a21ef8a052
    2f8141c3517394dfd818bd9ae762332a9454c8ae12b815de7eb73851a47d9b83
    17db38e774338602058f883997841aa4ca2e647b605768b9a5dbdd89ac252d5e
    e83f5d93e97625407ed4529e05f6e6116cbd183177e3ba65f2acd8e81f07bf36
    bf38e39eb1dc78c4b854546f8e212527aeb8990e7fff3d63f49b8c15846d19b0
    3823a6914e7fa21764df33c51efb307a53385bc4692d167af5220e7ec7425235
    c8e01564f14c5677db7c0e264cd2b125952edee26731b42d280d476b3c191a56
    88a58c8848ab67c3552acac7250fb8408c06c398e6dd79df8437e064b209023b
    9068cb2c0257b905d8079bcb40033fc58e832e7c0d2d687a1d942542443634a0
    ca2ce6f6cf845e5b17934c3a5a0f43ef860fb5ed67ec771f293baf4d9938cc50
    3963c2ebbcbb893f2695e90249dcb6ebc546a0fbd0ba126d398d9774071262b1
    ca270cae900efb83979e0aa2f997876aaab68714c242ab131b5a0929ca661ea8
    1f262c5c54bbb0f6622fb8b5ca806d8544cac3fe6184d300c8f28074e180b9f7
    9923f18495de93f7c957fe991f0dd3b185c8c7660b9ef93f9a83ebd4bc31cc1a
    d451a59c8900f7e9fbd535d1a3bba645d2f7bce4bf95df73fbca72755602325b
    147fd5fb0f771d22f38f33d217be393358c3e3b6452b3064922acdb1f160e164
    ce0e5fb3022a01bb6ff24d9430e599eb50cf670e6f3d6c3e96adb448774e510f
    eb8973d6ad89e13c5f87e14c5cfc897d5d44436891dc9ed651388334041a5f31
    47883497485f0f841395071590f9bef0e13a6d2859a511002cb2a3060c128c02
    e6bf577e20cf0834f2b7ab050f81e475ad41cd1580f53dd040e919b58bf57ccb
    33bd585673e1c40499e7702bdf04d6326ef440da297611301c190ac508c107f1
    2433294309a1c514ce9733b0ee8b0ad4ce807d4f93c0df17a2370168577e10c4
    b710e3f9bf878c2c7940bba099ae0fc8363a5446f6c9a2428f5fb6fef39cd814
    449f09003bc890df9bf5cc8885eb1e278a724eb3872bbf95fbabb504aacc9ca4
    77e77ebd338d1829ac00047f4c64fe84443699290f67ac0ebe01697b38b6d439
    ae8404e4404174a6fab8477b27e60d49a19b72ee623ef60e37b391812682944c
    ff68a536f40f20c0bca80d30077949a9b69f37b5bbc4bf32eeb0e36803a1cce7
    723b22279a368ab7e1db69352ecd4e4524f3d062a30a3dbeb4101d3ed681002f
    a40f324c032f9af3a0a26be7d21655f75381058bdbd7ec49f6cf9fa6ec01074d

    Payload related:
    08433debdfd2e520ac5d2f0ec922f84020e8f4beb711fff868e607f06f40e133
    0a6be4d49ec1c9fa2e4d0f097d3808802117836effe1f4087cb9743a88695bc0
    104024e27738377f05a24aa493561d9ebc9d38d462fedd0d888830cbaae670e0
    155033e85069c716c3819c5e81fa876ad0c4269d911f3832c4cc61dd45bc2aa7
    15a6a46e678ecf4d5d9a9d9d75eb12aa33d55611ed8cb555079315e4b9e22553
    16e6b6bd449f4ffb634df45808adaf78456c91b53bee79b8b8b7bff1ed3d4b50
    191a3d8104ad83ac76cb36014021f2c7ab81b74ae15eae59d799bdc0f4798951
    1f3a5878104747d51c08d75ef0c7eb644859ea01e46246d97c278292d4251960
    20208b337e4f0a418a0e3329f7f863700538bed1a50ca720db05e7f0f9ad8c4e
    2258fd874969f13c8b6b62db03c5db12df9848bceb2e0fc6654690b691956889
    22e249f2d2bef1632aa61d6f07909eeeda706670e5d89f11aa8c3bb89bc92f16
    234add1226f0ce30f83f72afa1067329ac22b20759c5333c404926775f298119
    281729d8c1131999a6ac0f784a5f0ba45ca83149406bcbbf06f866f446d88ce2
    2a917a89e324402b23e084820fcfec8c3e98e4a1124be1f29323e1694b5755d6
    2eebd42599746cf252f08338f81ed3df9e975342c12e13ca8c70fafa4c4dc83b
    2f4a6936dafd89cef6b8ba828e90439daa81a2a898c2da0767bec6b51cdaf11a
    2fb2b9863d534f9436e438f86275ea1e0c4741fb8fa5d9aa7311cc025f78f30a
    300f8301f23487e2433002999f1acbc804f4f684f6403e3a4c65f4e5979540e5
    304b15d20b64622250cf0d0954f3c887a059c4c98642b3fd6b3e3eb94b07546a
    344d063a2ce0b614cd073725b9b9a018c8706b6b9f380800506eadd80e92bd7a
    3738bbfd8ab9a37a5ad5bff41f4fabfc3a7ad0f4085a5290b83c1fc7ee3723b4
    37907c564942af4f1b235ec8592b60f7286de2e67206506733955c8a70ae5d7b
    39675f4f6648317e322593cb654094e548bf2735df063537ee896037e946d451
    396f61528c9b25144b89cb20e5668daa965489311bb8a00b7a6244feb0b79190
    3cc77f145194653036c846505fd26563f3a1fac0cc2d3fd5123701685e84b28e
    3cf115056782e777dbfa2b6393ab1463547401c8bb2d59ab89455bf77305ea98
    3d825d79bda177aadb305d8c6822bb97f7fe2ee451e5257e85bad42e99535606
    40e90e30cee9c1726154b6678221fead406b94bc3259ba8386ab438cd5ebb250
    41475ce4186414fbbb8589f29d5f7001bb286167e77324ce4da719acb21f4dea
    42a4cd926419aa35a4b17264d190256b9cb52cdfc33c943e68e578566ceae334
    43024e16cbd0ef8ef160355e051477a3b31018c9dbe0afb8cac06576f57deca9
    43b361398583c3c0ce75429a84b30ff10e047e757223eb433414a99d35160a0d
    45c375bfea191f576e2a5deaaacc8e695d2d7868ae5b87859411dc5438240212
    4976a6ad02ff39f568cb9cd7a1ebdea8c381b8f9600909c273f7f53436dd0f05
    4a1d7a0688318d216c3b3c9883b7e35c4ff2bcc9cd7ecf63486e622339bf5059
    4c959c764c3bc7d5141cd002c261382b95db1d22c371071409c08d771bb5e413
    4cfac44cf32a5c067383d815997f7d474af97bb82ebbfa25d909f86a1081eabd
    51b4cdf23ea83bf87d741e92522c6f6670b98cc0b2b13bb41b7cb24afba959b7
    53546e823073cbda154c74b6e511556cb17db067f2a2e746693c2d1c7f1f7eda
    556f0b284c63cc884661c583726ddc5bdec2e679f53e2b3bb52233b1750d78aa
    5934d3620e3d2905cba1cc431e8040f00ca0b763c8a38a6fbb1121e9c4c25cf6
    593516e03212b03296720bd0a1f09221e156c19067d713b723fe57a81d3d5faf
    5c9154974d5daaf850614fc660e1e9864f9df8f4d7e0ce68ca3e00b3e15d4e58
    5ce46c27795fb25bea268f233f89be52336e344737e059bb21f3daa9815eda96
    5cf4effade63cf1aa9a3cc6909bcf2e16867ce8db60e7f20a9d08dd4a5c59bfc
    5deeb0fd202427f5763562bc80672096884655b834e219d527ab200f2ba5f01b
    62387f4d55f15ea72c8d7f5d2ab1bd4029d895fe3f22d95980291b2595a658e6
    63c0153b2deff5a9286db1bbf41c327d55e4afeb938472b04f5f2e5367a1418f
    64f2e9c68908a7ce978ddeb17b661e787f1464ae706eb1ff1ce006cafe81e07e
    6c8eadfcecafdebccc737420d83c1f8493d12fcbecf13198aff88c10017316fc
    713a536264bff75649da55d367804c47333c55ed326be5ff73384fc3f2e87977
    72adc4612c53415a4b924acff7f8f400d1f20f5eb7d02f5e2d12488db168fd9d
    73afba6db12fda23caf12b2e71310631abbe6b9467636d8343ddb3674a49f527
    771000d6307e4372f2f51b6958e8b7e7a35ee34e9f9fb636b77559534a9fc1ce
    789481741e0df019d839bf61181b5cdd085b2334123be58a4b64c12fa7bd6193
    7e53b73cca7189e97e46de3e6e056edcb98b1aec6c2c338e043b8732ae46580e
    806f0d040303841e913e0a2a3ac96ce4427c269dafe6f135b1b64f5d9ba3d740
    8263655df987bd6c2bf8087e6b8759a360482757cd28a1d7e1742f652fb6bfc5
    8321a2104d185e9ddeb7f19c15bfc92ec4fe7fba67ba5a167270706fdb90e6bb
    85007ecdc6baec70a7e259395066c96fb7ddafd1be8a84244c92a7dc52a003e4
    87ae17f03b47f54fd9f2a3cf9f3e1e4d5cdfa6592bec4a05214c30756599a3ef
    8af2013a53c58346f9d558155691d9d736b253a6b179a40fc9e167cfee025dba
    8b42ef0774a9eb367ad36d51e990ca5bcc2708c33380dbaeeeffb29e113656b6
    8c9c9a4689a4b0319a32f32ded1e97dce3185d1d91fb3338b38081d28ccfb80c
    8f256697f2c7c5c19671c5ffec1b7458a609efbfa3c54b0aa83d71c524afb3b4
    903b5ca6aace73bc14ea9a22c900772078f063cccd9c144de6236513184d07b8
    9172fef013aca4eeef4bc4abfe0a283f89acaa58c6fb61a654eb66fe60bfb42b
    942d5bebedebee78c19d4dfce09c2a8e69c94ed77d55e7f16db3e0dd8f179f9b
    94948ea1285abe593df349b24340cf176726e92b0e20b35a3d9668de43b856dc
    94ef90e1cf5286566afb6ff7204b2045f5cc44d895f4e1ed3691b61ffd961bfa
    9510899b01066f15d622a79611c3b1f3444559ccc483aad04f52ef3ed0c0e955
    9751f750493d38ee62c7139cbc4ee4191ca6c7f9a6ba629468f33d8c653cf660
    989a36bca1548dc37bbe8c9716e69d789cc1eece69dc0b3c1ffccbf01764a0e5
    9b7442f32111a4acff0f85a4c38b79dd756f2dae3b73545ee53a4c000aba8b1f
    9e56b2771f3bfc3003183d0cda39821c2d1d8f427ea521ba0cbce0bf69734005
    a07c4ced1cc47b8df61eb5d4be42ea64a79d47ef6dd4967e9c956dc49796ba80
    a0dacb034d3b1e563714ad91fe51a71fe83c488a5931c1fb82f8cad04ae2fc1d
    a54ab03086af7b96b88efa0fa1abad56870947ebca89c05eb6503eee5f9a4cf8
    a6693a690c7b1f1363d61301db838c0854f7f95f5322ad38353f9888dd386346
    b25b113c1159e0fd35eb6b07a4f2318439e779ce9916af6b8e909e1eca744809
    b8c92c94113509e2d60ee97c0233d107ccd4dd11ce1bbdb2eb5b92113b4d27cd
    bcf5b70de961cf53dcb845ad766ed8d36653408e72478f3c4f36883018cf4264
    bee0a43ffaeda2d39e0bb754ab6ac5f3bf159f8bf79d5c3619086eb26974aac9
    bf9ff9889bcbd338586a17ea8a7f270efd45efeea367f118cf2c036b9a63c45f
    c0d71564ae30d7336504ae8bac556eca7338f519586060edb378250f2af46ca2
    c2e56d8c1090398b2d60370b55cb5bd3359630451acdb554ee8c1aa7f5c1b51c
    c5d2fb553d6406100c0b4a1be2f9e11ac2101bfa081527e211b7ac113fff6ff5
    c63281c74f8ca4309b1651a18241a69979fb135048beac2267620efc46e798e3
    cbfc83e8341728851650b3bb78855e5e16e030e33fc64dcbb8e27004dce7b290
    ce0c460160d5a2000e807f225940fbcd8e0e629f3bbec52e952c3355ffa688ff
    d27406627260481d000551236d65bfb284ada771f105adf41ee231041fe5b2fe
    d8a8f29bcea4e4b3a2515b31926abd1ce7b2adb0679a26a68df992c2c14ec730
    d9a3fc467e1198db9eec0a2231396f94d5fc44206d829ddf74dbeb529cb6e6f6
    d9ea0bc4909f894c30368ab6fcce37046523945bc64ab46b671491bea1d48904
    dab2045ebb2a37e78f0c3a0fff063b32ca66e16acecb197e33e671948f9ba4fc
    db5ea1d29e6681c30c49f640020fac8aab39e696e2b871ce4cdae45bacc1da0e
    dbba4d5a7f81feff29265babf103cf6c5e240254a6dc157ddc4bc3cfa2941b75
    dbdddbe487c70319c928d8b4a9a499dbe18c347a622ef78e665b27d9563340c5
    ddaf881c973e8302146ca59f0d65327ea0fc4b9bd30961e245fea693f377e893
    de1edc5dacc285b7f4910f4252a01c3d418b5f9fe14b76c33b00e8eaaef9976c
    dee635d66b0ecd41655f180a9e51967a84c6c65be8574197da161f3cf51662b7
    e242f942726ebd6c123a6d868d6a5c8c420e15056f0662773c14f218b20c550d
    eacf6fbc19a4a8d39ba16be72a51d0f376d59ab09b6726e0632eabd00382dba2
    f013c00f93260c72da674522b0169a65553b67c71ccf2bdc1879c7c91381332e
    f070a3e1450d56266a24d0f8f0878d249ec777305f85b4b4b55e1f1aa474c5c0
    f0e38d842f1ef4d67c7510440f7c8985cd79b6c52bbaf07c43aa370e178a10dd
    f14fb553d340d6f62c640711e058f147d186a9f51b0f422bd55187dc3c34ca8c
    f2b47d7b9becbcdaea350fc0fb01f258e5e31ebc3a39b8e9e170730b194869d2
    f47254880625736325ba64853ddaf35a5fdf940843fb8af7ea66008953539170
    f62cfb5f412ce47c611430e4445c14376791eb68ed665ab8641731b923643b14
    f63c4ece8caee488bb4873d7a494f8d52b0bcfa8746794fb5e0b913808b3f1e6
    fd80d1c741ca0f648f7ea14bb8f345358681f5335d909f4f0e56f14640bde1df


    Conclusion

    Malware is a moving target, it is constantly evolving in an arms race between the malware authors and the security researchers. This analysis shows the level of sophistication employed by threat actors in order to attempt to escape detection.

    Obfuscation is an art form. Techniques can range from frequently changed packers to the multiple techniques employed in malware such as this. Often malware packers are modified by their authors very soon after deobfuscation tools or reports are publically released. In many cases it is enough for them to change minor parts of the obfuscator to confuse the deobfuscation tools. Hence, malware researchers can't rely on these tools and must resort to be able to manually deobfuscate code when necessary.

    Understanding the steps that threat actors will go to to hide from detection and analysis is vital when it comes to protecting systems from malware. It is by applying lessons learnt from analyses such as this, that we are able to detect advanced malware with tools such as Advanced Malware Protection (AMP) and Threatgrid.


    Coverage


    Additional ways our customers can detect and block this threat are listed below.

    Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

    CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks.

    Email Security can block malicious emails sent by threat actors as part of their campaign.

    Network Security appliances such asNGFW,NGIPS, andMeraki MX can detect malicious activity associated with this threat.

    AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

    Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

    Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

    ↧

    The Mutiny Fuzzing Framework and Decept Proxy

    December 7, 2017, 10:06 am
    $
    0
    0

    This blog post is authored by James Spadaro of Cisco ASIG and Lilith Wyatt of Cisco Talos.

    Imagine a scenario where you, as a vulnerability researcher, are tasked with auditing a network application to identify vulnerabilities. By itself, the task may not seem too daunting until you learn of a couple conditions and constraints: you have very little information to work off of on how the network applications operates, how the protocols work, and you have a limited amount of time to conduct your evaluation. What do you do?

    In these scenarios, searching for and identifying vulnerabilities in network applications can be a monumental task. Fuzzing is one testing method that researchers may use in these cases to test software and find vulnerabilities in an efficient manner. However, the question that then comes up is how does one fuzz quickly and effectively?

    Enter the Mutiny Fuzzing Framework and the Decept Proxy.


    Mutiny Fuzzing Framework


    The Mutiny Fuzzing Framework is a network fuzzer that operates by replaying network traffic through a mutational fuzzer. The goal is to begin network fuzzing as quickly as possible, at the expense of being thorough.

    At a high level, Mutiny is designed to take a sample of legitimate traffic, such as a browser request, that has been prepared and formatted into a .fuzzer file. Mutiny can then be run with this .fuzzer file to generate traffic against a target host, mutating whichever packets the user would like. Mutiny can also be extended and configured to behave in different ways such as changing messages based on input/output, specifying how network errors are handled, and monitoring the target host in a separate thread.

    Mutiny is easy to use for cleartext traffic, but it does not natively support TLS or other various network protocols. This is where the Decept Proxy comes into play. Not only does it simplify capturing and fuzzing encrypted traffic, it also performs one-step traffic capture and processing for Mutiny.

    Decept Proxy

    The Decept Proxy is a multi-purpose network proxy that can forward plaintext or TLS secured traffic from a TCP/UDP/DTLS/domain socket connection to another plaintext or TLS secured socket connection. It makes a good companion for Mutiny as it can both generate .fuzzer files directly, particularly helpful when fuzzing TLS connections, and allow Mutiny to communicate with TLS hosts.

    What makes Decept Proxy different from the various other proxies?
    • It supports TLS endpoints, IPv6, Unix Sockets, abstract namespace sockets, L3 protocols/captures, and L2 bridging and passive modes.
    • It can perform SSH proxying/sniffing/filtering.
    • It was created with portability in mind and only uses standard python libraries. As long as the system you're going to run Decept Proxy on has Python 2 install, it should be good to go.
    Decept is based off of the TCP proxy.py from Black Hat Python by Justin Seitz.

    Decept and Mutiny In Action


    The Mutiny Fuzzing Framework and Decept Proxy have been an effective tool set for Cisco in evaluating a variety of network applications and devices. This includes a number of Cisco devices which have been hardened based on bugs and vulnerabilities that were identified by network fuzzing. Other examples where Mutiny and Decept were instrumental include:

    • CVE-2014-7815, a denial of service bug in QEMU.
    • TALOS-2017-0439, a heap overflow bug in Tinysvcmdns which affected Circle with Disney devices.
    • several vulnerabilities in VMware products that have been responsibly disclosed.

      Where To Find These Tools


      Talos is releasing the Mutiny Fuzzing Framework and the Decept Proxy as open source tools. These tools are actively maintained by us and we gladly welcome any feedback from the community on improving functionality. Note that these tools are provide as-is and are not officially supported. Users assume all liability for the use of these tools.

      The Mutiny Fuzzing Framework can be found on GitHub at the link below. Note that there are several development branches for Mutiny and users who are interested running the stable version should use the master branch. The experiment branch contains newer functionality, but may not be stable enough for normal use.

      Mutiny Fuzzing Framework:
      https://github.com/Cisco-Talos/mutiny-fuzzer

      The Decept Proxy can be found on GitHub here:
      https://github.com/Cisco-Talos/Decept

      ↧

      Vulnerability Spotlight: TALOS-2017-0393 / CVE-2017-2886 - ACDSee Ultimate 10 Remote Code Execution Vulnerability

      December 8, 2017, 5:40 am
      $
      0
      0
      Vulnerability discovered by Piotr Bania of Cisco Talos.

      Overview


      Talos has discovered a remote code execution vulnerability in the ACDSee Ultimate 10 application from ACD Systems International Inc. Exploiting this vulnerabilities can potentially allow an attacker to gain full control over the victim's machine. If an attacker builds a specially crafted .PSD (Photoshop) file and the victim opens it with the ACDSee Ultimate 10 application, the attackers code could potentially be executed with the privileges of the local user.


      Details


      An memory corruption vulnerability exists in the .PSD parsing functionality of ACD Systems International Inc. ACDSee Ultimate 10. An attacker can build a specially crafted PSD file that uses this bug to trigger a memory corruption. A byte value is taken directly from the .PSD file and used later as a size argument to the C++ memmove function. An attacker can use this to overwrite large parts of memory to crash the application or potentially even execute arbitrary code by overwriting critical control flow structures. For additional information, please see the advisory here.

      Coverage


      The following Snort Rules will detect exploitation attempts of this vulnerability. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org

      Snort rules: 43862-43863

      ↧
      ↧

      Threat Round Up for Dec 01 - Dec 08

      December 8, 2017, 11:24 am
      $
      0
      0
      Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 01 and December 08. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

      As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

      The most prevalent threats highlighted in this round up are:

      • Doc.Dropper.Agent-6394293-0
        Office Macro Downloader
        This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable. The sample was unable to download the next stage so no further analysis is available. Interestingly, this sample attempts to callback using a Tor service by using the onion.link proxy service.
         
      • Doc.Macro.Obfuscation-6389653-0
        Office Macro
        Emotet has slightly altered the VBA macro obfuscation used to hide its obfuscated PowerShell commands. The obfuscation technique leverages a large number of unused VBA APIs relative to the overall lines of code used.
         
      • Doc.Macro.Obfuscation-6394435-0
        Downloader
        We have discovered another trending pattern of Valyria downloaders delivered via malicous email spam. The macro code barely resembles common VBA code at all, save for a few keywords such as AutoOpen & Shell. The bulk of the malicious downloader code is deobfuscated through a long series of cast arrays containing upper cased strings & string splitting via the Mid function.
         
      • Win.Packed.Agent-6395107-0
        Malicious packer
        This style of packed executable has been has been seen recently carrying Firefox credential stealers and Zuzy
         
      • Win.Trojan.CeeInject-6394235-0
        Trojan
        These samples contain the PoSeidon malware. PoSeidon is a Point of Sale malware which gathers credit card information.
         
      • Win.Trojan.Delf-6394424-2
        Infostealer
        This infostealer malware family targets Brazillian users. It pretends to be an update to Adobe Acrobat Reader to steal steal data by getting access to the clipboard. It also tampers with keyboard and mouse activity
         
      • Win.Trojan.GenCNs
        Trojan
        This family is a classic trojan and it has a dropper behavior as well as an adware component. The samples contact many Chinese websites and other remote website. Additional files are downloaded and executed and the sample tries to inject code in another process's address space.
         
      • Win.Trojan.Tinba-6390856-0
        Trojan
        This banking trojan steals sensitive information from the user such as bank account login information by using man-in-the-browser attacks, web injection, or traffic interception.
         

      Threats

      Doc.Dropper.Agent-6394293-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses
      • N/A
      Domain Names
      • 6vt4gbkwnjfnyo6g[.]onion[.]link
      • ypg7rfjvfywj7jhp[.]onion[.]link
      • yztnv4ha5rapf6gj[.]onion[.]link
      Files and or directories created
      • N/A
      File Hashes
      • 0099b9221eb92408f0b8bead5d703b5c7ecb11962f49f5e67f60725427318236
      • 094842414f8029ea69cca6237b7758c2559dd553c98990cb4e8474e6653e0b9f
      • 0b81075cc3ef1121f3eca801d2f821719a7cfa31e5d95081ec3feb195f44d8c6
      • 0e9b2c7a5526c8d469c3e2183cd52a38d862773118d2401467c59472aaf17263
      • 14a415384df11be5271c58e66474cb4326aaeb4af0035afce1d61f75eaf53db3
      • 2e6523b856a9f40bf3cf851407f3003a6564a7fb5d86657781a03bbd30d63966
      • 365d356b6d8d463ee4d6924b37acfecf16624a58d8d2e6a783a9ef289e74ace3
      • 3ac9e97344506f3e443490eb6b0d5f877e0c8d4462ab9bf9544b5128aafc78bb
      • 3cae4325b4b559431dba511779feadeff19433aed194511e4ea8f4ef676ac6c7
      • 3cc669528549cc7394074ac3ffbaa6cf3eed14436a1653d70f54ca2b3d5cdead

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Umbrella


      Screenshot





      Doc.Macro.Obfuscation-6389653-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses
      • N/A
      Domain Names
      • seoexpert4rank[.]com/yfu/
      • inade[.]mx/KoSZG/
      • 1000id[.]ru/JtcKoSROv/
      • www[.]ra-lang[.]ch/gNFQe/
      • nts-tech[.]co[.]kr/RI/
      Files and or directories created
      • N/A
      File Hashes
      • 93900a04e4d7c629e03f3d510d249f1c8497cf94d818e0ae5913b685e467be6b
      • 0a6d8c964286f1ec0173cde38caf3d5e36147945baaa83a0200e6f35f82446af
      • baf01275b874c04687f84d78451e41231b31bfc0e71995e124830ba63379fedd
      • 5dbf9dc9341bd506eb2cdf5ec294c6c3029535424aa0a42e9b045cbd95c6d3df
      • 0f236dccbbdb81b7724f71569eff462c6fb40658f1697331617a38074a99c6e8
      • d3e06e4d623b1bbf7b72ec709541c3b3fe66d09c4616c356cdc93240bd4b4c6a
      • a44450c9b8514dd5647128f55d2704889c87e852e3eaceea80734ae7bf8d9f49
      • 46217dc4ef9fcef981be9a931995008f56b71e3f510721c33ed4b58b577e8fbb
      • 4519c2f4fc0bc43cace2e70e464c00e7302e003262d7e6f903672becaba9e8ed

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Umbrella






      Doc.Macro.Obfuscation-6394435-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses
      • 91[.]121[.]175[.]92
      • 185[.]125[.]46[.]161
      • 95[.]213[.]194[.]234
      • 62[.]109[.]26[.]193
      Domain Names
      • smart-soft[.]pl
      Files and or directories created
      • \srvsvc
      • %Public%\95857.exe
      • %SystemDrive%\~$7369835.doc
      • %SystemDrive%\10001.exe
      File Hashes
      • 1879023e70e891830300f667e1d08f5d3712d313108795c0fc2234942fc525f4
      • 189f27929e2ac19501e00b9bfefddd92aed496030af4dec597d7832b38c80d84
      • 2054a559d38206a764ce41fcff3a581ca6501e69ea87fc551ad57575cdbc5f04
      • 33a689526403786d393a27f65e288a817fda4b2cfe2a6b153d0bcfb6eb46c2a7
      • 33b2b1ff14870f1d94d70921ab347ebeedd7bc680bbaab9fa500f76f775b34cb
      • 404acc127b63c29d78bef4309711b4cce103e772ec5d69d0674876f1ca38a52d
      • 6591be6105ffedee758410af2d9e6ae849cae900aea514facf42642b6743a62c
      • 68d539f5e356adca4d9c2c5c79839567c2d1d633a4762dc7bd84a71bd684855d
      • 7364757fd07097278b46d8943e7ab7cc787db37a0ec28bf6d22fa92eae78c633
      • a658d88baff44592b269b9bc64c4b69b16e44478d86a3a7cacc201be26574fa8
      • af732649a7f58fc1bc8c81d513e0936c042f12342d9d6da30ff2e4f30f5a949f
      • b0010bb2f93bfcccdeb51beff7ce67c4b84fbfd65f892ed828de0f75e84a7ddb
      • bc8bb9ae27cf534eeecbb8d41da1b48e33c8a222d793e16dcb10edfc792ac92f
      • c7d07eb16ecddfeaa812ad251210c2bdc1681e04ea585bf145f567f9575e6757
      • d322b11db04a9ecd13cea36438e591d2ddd8aa0f92b6a41bd5808d21e4854683
      • d35c4be48d34270cc43367e37a53d6ca5c29637fc7517d9b95b5ab8048a36062
      • dcc5cc23f492dee38ce7411daa8e0f89bb72dbfc89b7da3a6ca6a799e1f0f324
      • deb9f507b68ec8201318e3be8bc44a20d549a57981a07f25f687ad97ddf63c73
      • df79ffd3c6e157de55104b9ab3eb4a62ed341926bbaffbd2c9216895d5adfe26
      • e1fe9f1caee0a7adedcc8fbb3270388c54c694171d7b7ea6991b7d0b43cbcc40
      • e3c59888637ff64ea4418986c375b41b0b46168e8bffde3fc3606b0c212f712b
      • e67446529af580230d0f007e9805a93978885a440dc68029744d951db5b07914
      • f348c2fd327ad98abcb609e6e1555445cd90cd9488322aa769e2680e0aae6415
      • f68502a6a1920806528873682da860231f60a2146dd010d2cd63e042c6f80e28
      • faa0729ac6b3dc7cdfbeb5c042e4d9ff95ecfa51d1c3efdaf79560f9c27956b8

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Umbrella


      Screenshot





      Win.Packed.Agent-6395107-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • 3749282D282E1E80C56CAE5A
      IP Addresses
      • 52[.]76[.]169[.]66
      Domain Names
      • www[.]loki5[.]info
      • hkfb[.]01power[.]net
      Files and or directories created
      • N/A
      File Hashes
      • 085dbab7e810819bff0abe261e1d7015cbb4de4bb54261d547a7fa91e4d09d88
      • 95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80
      • df77604366128916f33b09dbb2fdb14ff88563bf214cbb4fd65d695858fb15fc
      • 3edef9b394c47000fcca8f62f9f43875b1691cd26db56013327735c224d0498f
      • 111df72bee877678a03a98f57f59ef1f9614ff0fee6fbaa2cea120e0d452a009
      • 918911a937295b041ef4cf59cdadc4de332161cde87bc83d7f87e7e0e3fdbaa5
      • 89d660f623dc3b4a64986709076b0923c85a88d23648156badf61897d40970fb
      • 4fedc2463dcf7d3bbac73858d35a85a06bbde28f42937f13c1908f4d360e8987
      • 1b011c8b56701fe3ef08308320d2913548b2284c55c0f7cda8b9de32de76648c
      • 5e243d5865898124260d1eaac4c5a0f8952919cbd07ecc18831dcd632666c122
      • a3c28f543dcb02e10a8172e7179eefb09281828cfb79a278ebbf969998866fa1
      • b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f75a630

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Umbrella






      Win.Trojan.CeeInject-6394235-0


      Indicators of Compromise


      Registry Keys
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyServer
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: _FileId_
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: ObjectName
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: Type
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: _Usn_
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
        • Value: ObjectLru
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: AeProgramID
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: DisplayName
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: AeFileID
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: ProxyBypass
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: AeFileID
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000095A9
        • Value: AB6
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
        • Value: ObjectLru
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: _FileId_
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: _UsnJournalId_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: IntranetName
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: UNCAsIntranet
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
        • Value: WpadDecisionTime
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
        • Value: CachePrefix
      • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
        • Value: PnpInstanceID
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\11000000005DAF
        • Value: AB5
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: _ObjectLru_
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
        • Value: ObjectId
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
        • Value: WpadDecision
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
        • Value: WpadDecisionTime
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: ErrorControl
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: _ObjectLru_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
        • Value: WpadDecision
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: AutoDetect
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: IntranetName
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: AutoDetect
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
        • Value: CachePrefix
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
        • Value: WpadDetectedUrl
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: _ObjectId_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
        • Value: DefaultConnectionSettings
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: ProxyBypass
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
        • Value: CachePrefix
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
        • Value: ObjectId
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyEnable
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE
        • Value: _CurrentObjectId_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
        • Value: WpadDetectedUrl
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: _Usn_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3A-57-D6-05-63-AB
        • Value: WpadDecisionReason
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: AeProgramID
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
        • Value: SavedLegacySettings
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
        • Value: WpadNetworkName
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST
        • Value: CurrentLru
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
        • Value: _UsnJournalId_
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyOverride
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
        • Value: 10000000095A9
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
        • Value: _ObjectId_
      • <HKU>\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
        • Value: LanguageList
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: AutoConfigURL
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: WOW64
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
        • Value: WpadDecisionReason
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: Start
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINHOST
        • Value: ImagePath
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
        • Value: 11000000005DAF
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D4
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
      • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\SmartCardRoot
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\CA
      • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\TrustedPeople
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Disallowed
      • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000095A9
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WinHost
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\trust
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Root
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CRLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\3a-57-d6-05-63-ab
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5\Indexes
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Root
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\My
      • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople
      • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\trust
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6\Indexes
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\TrustedPeople
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Root
      • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\TrustedPeople
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\Certificates
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\11000000005DAF
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\Certificates
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CRLs
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\CA
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLs
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CTLs
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB6
      • <A>\{33CA8D6D-A479-11E7-BE8F-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{D9F0881D-8458-4CC2-AE9B-5472D27E0970}\3a-57-d6-05-63-ab
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\trust
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Root
      • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\trust
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CTLs
      Mutexes
      • WinHostWD
      • Local\ZonesCacheCounterMutex
      • Local\ZonesLockedCacheCounterMutex
      IP Addresses
      • 144[.]217[.]254[.]90
      Domain Names
      • linturefa[.]ru
      Files and or directories created
      • %WinDir%\SysWOW64\WinHost.exe
      File Hashes
      • daee59ee955587d378dd6dc11af1a702d554c7926a9f42bac3752732c33e9317
      • 1a7de2ac4b22ca77acef5afe8e8b45dcc5150deb3408c8934221cfbbaee0655e
      • fe33dc8941a6cd8ef4f64af295c2066eb0974966dfb355b5dd57e0c277261033
      • 62a22fb0f59578de3679f70a41c2971b384167aebb032dd782f1d23d27015aa3
      • b7ad41fbecce918894c0645aedbc60e4ac8daee24405b6a4957c98a728a14b9a
      • 58e226e02f8dded4b24ae60d2524497083c3d0dafb02436df5209fa9e1061085
      • d065ba2603790329d31e35cd45538b693c77f9870d98c4656e490c1a5034a8fa
      • 36d4800fb0bed77e59468ae9b732eb806d59999ec2832a72e0209473069af5b1
      • 3507a76940a2e6c930882b5cde32d2f11ba48cc0e6bfd6e4771a973ebe9db5ab
      • 952e29ae44bb49c78f2b3fcd8c13e22181bc0a610e36723e41b79f8c1147649f

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Umbrella






      Win.Trojan.Delf-6394424-2


      Indicators of Compromise


      Registry Keys
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
        • Value: SavedLegacySettings
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
        • Value: CachePrefix
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
        • Value: CachePrefix
      • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
        • Value: PnpInstanceID
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
        • Value: LanguageList
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
        • Value: CachePrefix
      Mutexes
      IP Addresses
      • 191[.]252[.]186[.]108
      Domain Names
      • N/A
      Files and or directories created
      • \Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.chk
      • \Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
      • \Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\slideshow.ini
      • \Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
      • \Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
      File Hashes
      • 04c3a321d00b8f54ae242969ede062ae10b8906ba5d7071fd0aa4f3b3b4ef73e
      • 248b6182fe5aaa120a6ad009595a93bf9431cbcd3e723ad711aef9b2d4562abf
      • 3b221118a4c2716c6c76ddc1b6b01866fcc2643d7c29e38279d6aa2dd27d60a7
      • 3dde0bb92308140701cb61711dc7e7298baff68668d96d2db9390e2b691efeb9
      • 44e27c54ae3dc4c4c228dc10389d2b28d1230a8933d61661271f4eaf65925b1f
      • 482142f886ed2ee2610e2740695435e0488b5c7d6081daaeffdc93c87b6e2f93
      • 4bdae37fe1f8dab61a16f406f08a3bbe1482cd1387351f23b29849e1de64875d
      • 67ed3caf144d2b2dd0e8f0b6ed4de1e0ee4052e152cf32fdc22b9a3f8c935e67
      • 75eecd86ca4cbc10e60a6b5dc85964374fd91b25f0ecf08dcb7cd96d726ec581
      • 7a41c90ba46f40af093491c1f03fa64b36c6a10603c29a9af78540cde8440d60
      • 8486ba3a5d2ae2297118de5f39770fb89227752bbe3e59f951cd0ef0bab8c5b5
      • 9b6087e9607aa0149beecd97709d27cf2e3703fded3f7d31dd613a6d3f23ccaf
      • b17f8e85944768cc88c0a3b7103290c6eab820348103fa7a8a412af945e1d1dc
      • b7c8faa19fb394f42733df9c1bc7c5f0a5313ead7b0ec870c0db05f6e3baa910
      • c14055b23eb3a90e163962c9c70df3338bca68b67a615531ef40c6e8f8f6eabe
      • c45fabfd7e6f52fa519d8215ac1d569ca385bb4552eae82e63da4befa319f1d9
      • cc1eadad7810c4c94cdeebd63b7e54604253c4651c3a31bdf27dc96c189baa10
      • d44dff94eaf9ed08c7f4ef47e69e0a9b308ce49c8bc814b94b2c95c92ba53fc3
      • db1181dbda2b6053b008568b8f2f7b8a98cc3bd30fbea83ac8f69900d657e56f
      • f1db091fff240dd3d49f0d22d4809db237fda042cb7ddf7afc81a0430f5c4b8c
      • f6bad3bc203c29350726c32d2aad744479de84bc72e1ffed0ad8392e5dde43d0

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Screenshot





      Win.Trojan.GenCNs


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
        • Value: Type
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
        • Value: CachePrefix
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
        • Value: Count
      • <HKLM>\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\189271E573FED295A8C130EAF357A20C4A9F115E
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
        • Value: Time
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
        • Value: FullScreen
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpInterfaceOptions
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMAINSUGGESTION
        • Value: NextUpdateDate
      • <HKLM>\SOFTWARE\Classes\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
        • Value: Type
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
        • Value: Count
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
        • Value: CacheRepair
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: AutoDetect
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyOverride
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
        • Value: Type
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
        • Value: Blocked
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
        • Value: LastProcessed
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
        • Value: Count
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
        • Value: DhcpScopeID
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
        • Value: Time
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
        • Value: CachePrefix
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpDomain
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: AutoDetect
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
        • Value: Count
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\iexplore
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
        • Value: DefaultConnectionSettings
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyEnable
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
        • Value: CacheLimit
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpNameServer
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
        • Value: CachePath
      • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
        • Value: PnpInstanceID
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOWSSEARCH
        • Value: Version
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
        • Value: MFV
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpNameServerList
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: IntranetName
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: ProxyBypass
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
        • Value: NextCheckForUpdateLowDateTime
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
        • Value: LoadTimeArray
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
        • Value: CompatibilityFlags
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpNetbiosOptions
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
        • Value: Collection
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
        • Value: Blocked
      • <HKU>\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
        • Value: Blocked
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
        • Value: Time
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\PENDINGRECOVERY
        • Value: AdminActive
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: IntranetName
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
        • Value: DhcpNameServer
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpSubnetMaskOpt
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\52DFG.COM
        • Value: NumberOfSubdomains
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
        • Value: LoadTimeArray
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
        • Value: Type
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
        • Value: CachePrefix
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
        • Value: CachePrefix
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
        • Value: Time
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
        • Value: {6C9F4A61-DA9E-11E7-BE93-00501E3AE7B5}
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
        • Value: DhcpDomain
      • <HKU>\S-1-5-21-2580483871-590521980-3826313501-500_CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E
        • Value: LanguageList
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D27CDB6E-AE6D-11CF-96B8-444553540000}\IEXPLORE
        • Value: Type
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
        • Value: Count
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
        • Value: {00000000-0000-0000-0000-000000000000}
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
        • Value: NextCheckForUpdateHighDateTime
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
        • Value: Time
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\BAIDU.COM
        • Value: Total
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
        • Value: DhcpDefaultGateway
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
        • Value: Time
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
        • Value: Type
      • <HKLM>\SOFTWARE\WOW6432NODE\JAVASOFT\JAVA WEB START\1.6.0_41
        • Value: Home
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: UNCAsIntranet
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
        • Value: ProxyBypass
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012017120620171207
        • Value: CacheOptions
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
        • Value: SavedLegacySettings
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\52DFG.COM
        • Value: Total
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: ProxyServer
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING\NEWTABPAGE
        • Value: DecayDateQueue
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
        • Value: Window_Placement
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
        • Value: Count
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\BAIDU.COM
        • Value: NumberOfSubdomains
      • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMAINSUGGESTION\FILENAMES
        • Value: en-US
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
        • Value: {17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore
      • <HKU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
        • Value: AutoConfigURL
      • <HKCU>\SOFTWARE\MICROSOFT\MULTIMEDIA\DRAWDIB
        • Value: 1024x768x24(BGR 0)
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs
      • <HKCU>\Software\Microsoft\SystemCertificates\My
      • <HKU>\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
      • <HKCU>\Software\Microsoft\Internet Explorer\Toolbar
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Root
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKCU>\Software\Microsoft\SystemCertificates\trust
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\SmartCardRoot
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\TrustedPeople
      • <HKLM>\SOFTWARE\RegisteredApplications
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\Disallowed
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\www.52dfg.com
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHist012017120620171207
      • <HKCU>\Software\Policies\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CTLs
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\pos.baidu.com
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKCU>\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CRLs
      • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\52dfg.com
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\trust
      • <HKLM>\Software\Microsoft\SystemCertificates\trust
      • <HKCU>\Software\Microsoft\Internet Explorer\Main\WindowsSearch
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKU>\Software\Microsoft\Internet Explorer\Recovery\Active
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKU>\Software\Microsoft\Internet Explorer\International\CpMRU
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKCU>\Software\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKCU>\Software\Microsoft\SystemCertificates\Root
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLs
      • <HKCU>\Software\Microsoft\SystemCertificates\SmartCardRoot
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\TrustedPeople
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Root
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CTLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLs
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\Software\Microsoft\SystemCertificates\CA
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\TrustedPeople
      • <HKLM>\Software\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\Certificates
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLs
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\cpu.baidu.com
      • <HKU>\Software\Microsoft\Windows\ShellNoRoam\MUICache
      • <HKCU>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\Certificates
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\ROOT\CRLs
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\CA
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLs
      • <HKU>\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLs
      • <HKCU>\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKCU>\Software\Microsoft\Multimedia\DrawDib
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLs
      • <HKCU>\Software\Microsoft\Internet Explorer\Main
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\CA
      • <HKCU>\Software\Policies\Microsoft\SystemCertificates\trust
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUST\CTLs
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed
      • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\Certificates
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKCU>\Software\Policies\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLs
      • <HKCU>\Software\Microsoft\Internet Explorer\DOMStorage\Total
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\trust
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\Certificates
      • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\CA
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLs
      • <HKCU>\Software\Microsoft\SystemCertificates\TrustedPeople
      • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Root
      • <HKLM>\Software\Wow6432Node\Microsoft\EnterpriseCertificates\trust
      • <HKCU>\Software\Microsoft\SystemCertificates\Disallowed
      • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
      • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
      • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
      • <HKCU>\Software\Microsoft\Windows Script\Settings
      • <HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\TRUSTEDPEOPLE\CTLs
      Mutexes
      • !IECompat!Mutex
      • IsoScope_2f4_IESQMMUTEX_0_274
      • Local\URLBLOCK_DOWNLOAD_MUTEX
      • {66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}
      • Local\URLBLOCK_FILEMAPSWITCH_MUTEX_756
      • UpdatingNewTabPageData
      • IsoScope_2f4_IESQMMUTEX_0_331
      • Local\VERMGMTBlockListFileMutex
      • Local\DirectSound DllMain mutex (0x000006A8)
      • IsoScope_2f4_ConnHashTable<756>_HashTable_Mutex
      • !IEFileUpdater!Mutex
      • Local\InternetExplorerDOMStoreQuota
      • Local\URLBLOCK_HASHFILESWITCH_MUTEX
      • Local\ZonesLockedCacheCounterMutex
      • Local\https://cpu.baidu.com/
      • IsoScope_2f4_IESQMMUTEX_0_303
      • IsoScope_2f4_IESQMMUTEX_0_519
      • Local\https://pos.baidu.com/
      • !PrivacIE!SharedMem!Mutex
      • Local\MSCTF.Asm.MutexDefault1
      • {5312EE61-79E3-4A24-BFE1-132B85B23C3A}
      • {C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}
      • Local\!BrowserEmulation!SharedMemory!Mutex
      IP Addresses
      • 106[.]39[.]162[.]36
      • 61[.]135[.]185[.]23
      • 117[.]27[.]232[.]35
      • 106[.]11[.]30[.]202
      • 104[.]27[.]97[.]74
      • 66[.]102[.]255[.]61
      • 116[.]253[.]191[.]237
      • 106[.]11[.]30[.]205
      • 103[.]7[.]29[.]251
      • 111[.]202[.]114[.]35
      • 204[.]79[.]197[.]200
      • 66[.]102[.]255[.]57
      • 66[.]198[.]178[.]124
      • 140[.]205[.]250[.]8
      • 103[.]235[.]46[.]191
      • 140[.]205[.]248[.]60
      • 120[.]132[.]3[.]45
      • 106[.]11[.]93[.]16
      • 66[.]102[.]255[.]39
      • 104[.]27[.]96[.]74
      • 66[.]198[.]178[.]122
      • 104[.]27[.]93[.]74
      • 165[.]254[.]60[.]146
      • 65[.]153[.]196[.]195
      • 65[.]153[.]196[.]196
      • 198[.]11[.]132[.]221
      • 66[.]198[.]24[.]253
      • 111[.]202[.]114[.]81
      • 66[.]231[.]239[.]122
      • 66[.]231[.]239[.]120
      • 47[.]89[.]67[.]254
      • 66[.]231[.]239[.]124
      • 140[.]205[.]60[.]79
      • 140[.]205[.]218[.]67
      • 119[.]146[.]74[.]34
      • 65[.]153[.]158[.]144
      • 104[.]193[.]88[.]109
      • 220[.]170[.]182[.]31
      • 103[.]235[.]46[.]39
      • 66[.]102[.]255[.]42
      • 66[.]102[.]255[.]43
      • 111[.]206[.]37[.]219
      • 222[.]186[.]49[.]224
      • 66[.]102[.]255[.]45
      • 66[.]102[.]255[.]50
      • 140[.]205[.]136[.]1
      • 140[.]205[.]158[.]4
      • 66[.]102[.]255[.]44
      • 112[.]80[.]255[.]55
      • 47[.]89[.]69[.]254
      • 104[.]27[.]92[.]74
      • 180[.]76[.]22[.]48
      • 65[.]153[.]196[.]201
      • 112[.]80[.]248[.]186
      • 106[.]11[.]129[.]144
      • 66[.]198[.]24[.]243
      • 14[.]215[.]178[.]152
      • 65[.]153[.]196[.]200
      • 106[.]11[.]209[.]24
      • 65[.]153[.]196[.]202
      • 65[.]153[.]196[.]203
      • 103[.]235[.]46[.]40
      • 65[.]153[.]158[.]143
      • 65[.]153[.]158[.]145
      • 119[.]146[.]74[.]49
      • 140[.]205[.]61[.]61
      • 65[.]153[.]158[.]148
      • 66[.]231[.]239[.]92
      • 115[.]239[.]210[.]141
      • 140[.]205[.]61[.]85
      • 140[.]205[.]218[.]72
      Domain Names
      • www[.]taobao[.]com
      • fj[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
      • z13[.]cnzz[.]com
      • pos[.]baidu[.]com
      • static[.]fraudmetrix[.]cn
      • dfjs[.]1235k[.]com
      • f11[.]baidu[.]com
      • cm[.]pos[.]baidu[.]com
      • cpu[.]baidu[.]com
      • dup[.]baidustatic[.]com
      • gss1[.]bdstatic[.]com
      • cnzz[.]mmstat[.]com
      • zz[.]1235k[.]com
      • cpro[.]baidustatic[.]com
      • fp[.]fraudmetrix[.]cn
      • icon[.]cnzz[.]com
      • sslshare[.]jomodns[.]com
      • f12[.]baidu[.]com
      • wn[.]pos[.]e[.]shifen[.]com
      • imageplus[.]baidu[.]com
      • wmjs[.]jomodns[.]com
      • ope[.]tanx[.]com
      • ad-sh-sz-zb[.]wagbridge[.]tanx[.]alimama[.]com[.]gds[.]alibabadns[.]com
      • zz[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
      • webb[.]jomodns[.]com
      • gw[.]aicdn[.]com
      • opencdn[.]jomodns[.]com
      • publish-pic-cpu[.]baidu[.]com
      • eclick[.]baidu[.]com
      • atanx[.]alicdn[.]com
      • p[.]tanx[.]com
      • c[.]cnzz[.]com
      • apisoft[.]df0535[.]com[.]cname[.]yunjiasu-cdn[.]net
      • www[.]52dfg[.]com
      • dfjs[.]1235k[.]com[.]cname[.]yunjiasu-cdn[.]net
      • ope[.]gds[.]tanx[.]com
      • bzclk[.]e[.]shifen[.]com
      • fj[.]1235k[.]com
      • f10[.]baidu[.]com
      • wn[.]pos[.]baidu[.]com
      • hm[.]baidu[.]com
      • sp0[.]baidu[.]com
      • world[.]taobao[.]com
      • u755[.]v[.]qingcdn[.]com
      • cm[.]pos[.]e[.]shifen[.]com
      • simage[.]gshifen[.]com
      • z[.]gds[.]cnzz[.]com
      • cb[.]e[.]shifen[.]com
      • all[.]cnzz[.]com[.]danuoyi[.]tbcache[.]com
      • apisoft[.]df0535[.]com
      • bzclk[.]baidu[.]com
      • 7xjnh3[.]com2[.]z0[.]glb[.]qiniucdn[.]com
      • caclick[.]baidu[.]com
      • atanx[.]alicdn[.]com[.]danuoyi[.]tbcache[.]com
      • z11[.]cnzz[.]com
      • imageplus[.]e[.]shifen[.]com
      • ecomcbjs[.]jomodns[.]com
      • cpu[.]e[.]shifen[.]com
      • open[.]t[.]qq[.]com
      • origin[.]open[.]qq[.]com
      • jpaasne[.]e[.]shifen[.]com
      • s4[.]cnzz[.]com
      • ieonline[.]microsoft[.]com
      • flashservice[.]adobe[.]com
      Files and or directories created
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\thread-next[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\fb[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\avatar[1].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\style_1_forum_viewthread[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\ex[1].js
      • \TEMP\AppData\wwblist.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\checkonline.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\style_1_common[1].css
      • %SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@1235k[1].txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\px[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[2].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\forum[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{775A3D20-DA9E-11E7-BE93-00501E3AE7B5}.dat
      • %AppData%\Microsoft\Windows\Cookies\MTSHQBBR.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qq_share[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\bd_logo[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=1555995088,2202163700&fm=76[1].jpg
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\arw_r[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\stat[1].js
      • \TEMP\AppLink\sql.dll
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[1].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\fm[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\MWWX7599.htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\userinfo[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\jquery-1.8.3.min[1].js
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\showip.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arw[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\detect[1].js
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF4E88.tmp
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6C9F4A61-DA9E-11E7-BE93-00501E3AE7B5}.dat
      • %AppData%\Microsoft\Windows\Cookies\28944M2J.txt
      • \TEMP\gzcvaqtzdusmspytflzf.dfg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\showip.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\6108[1].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fj_btn[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\search[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6C9F4A63-DA9E-11E7-BE93-00501E3AE7B5}.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[5].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\noavatar_small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\log[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\20171206005032_61527[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\nv[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\share_btn[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\md5[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\favicon[2].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\58d12356-49a1-4b13-8946-cf0414ecedd8[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\arw_r[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V0100010.log
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-100646-1-1[1].htm
      • \TEMP\AppData\QS.db
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\59_avatar_middle[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-next[1].png
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\print[1].png
      • %SystemDrive%\gpoigmfsdzfgohtecxlq.dfg (copy)
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\style_1_common[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\seditor[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\fav[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[4].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\jquery-1.8.3.min[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[3].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[1].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pengyou[1].png
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\qmenu[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\ico_lz[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[2].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\highlight.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pc_ads_bear.1x[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\adClosefeedbackUpgrade.min[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\switch_width[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\background[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\oshr[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\df_logo[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qmenu[1].png
      • %SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@zz.1235k[1].txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\bg_rb[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fastreply[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\i[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\53_avatar_small[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[3].htm
      • %AppData%\Microsoft\Windows\Cookies\IDOPFIC9.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\forum_viewthread[1].js
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{17DE33AB-DA76-11E7-800A-00007D8081C0}.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\kindeditor-min[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\list-style-119[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\2f57811a-a7ec-49be-8a67-fcae1fecd305[1].jpg
      • %AppData%\Microsoft\Windows\Cookies\AZ8N99IZ.txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\background[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\editor[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\scrolltop[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\px[1].png
      • %AppData%\Microsoft\Windows\Cookies\AISN47QD.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\c[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\vchm[1].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\tongdun[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=4262931832,9247409&fm=76[1].jpg
      • %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\fm[1].js
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\common[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\stat[1].htm
      • %AppData%\Microsoft\Windows\Cookies\FTBCR8D3.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\stick.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DOMStore\R85DXRAK\cpu.baidu[1].xml
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dfg.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\coreMobilePc[1].js
      • %SystemDrive%\AppData\QS.db
      • \TEMP\AppData\wwwlist.txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\logging[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\bump.small[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@www.52dfg[2].txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\noavatar_middle[2].gif
      • %AppData%\Microsoft\Windows\Cookies\3BST8HRF.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\36_avatar_small[1].jpg
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\checkonline.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\style[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\hot_3[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\collection[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\cba256a9-f1e4-429e-a5c2-cade0a1ff7ad[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\profile[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=1130617034,1673256959&fm=76[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=725440160,1310097331&fm=76[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[1].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\open.small[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\qq_login[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\online_moderator[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\qzone[1].gif
      • %TEMP%\dfg.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[4].htm
      • %AppData%\Microsoft\Windows\Cookies\GURHNPBW.txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{17DE33AA-DA76-11E7-800A-00007D8081C0}.dat
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\md5[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\weibo[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\fp[1].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\pt_item[1].png
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\arw_l[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\default[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\pn_post[1].png
      • %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\da98dd37-304c-4f34-8692-963ad9d3fb83
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\userinfo[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\pn_post[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\dm[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pn[1].png
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\jquery-1.8.3.min[1].js
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF274C.tmp
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\qshare[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\20171206005032_61527[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\tanxssp[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\settop[1].png
      • %SystemDrive%\AppData\QS.db-journal
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\wh[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\qq_login[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\hm[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\25_avatar_small[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[3].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\search[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.chk
      • %SystemDrive%\AppLink\sql.dll
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\comm[1].js
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\nv[1].png
      • \TEMP\AppData\AppConfig.ini
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\fp[1].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\hot_3[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\print[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\midavt_shadow[1].gif
      • %AppData%\Microsoft\Windows\Cookies\OL83W4WY.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\core[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\avatar[5].htm
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\pn[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\avatar[4].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\logging[1].js
      • %AppData%\Microsoft\Windows\Cookies\3QDRLGBW.txt
      • %AppData%\Microsoft\Windows\Cookies\BWJZDR10.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arrow_top[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\home[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\imagestore\aowwxkh\imagestore.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\locked[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\clear[1].swf
      • %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\Preferred
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\thread-prev[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\close.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\pc_ads.1x[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\cf2ca419-ddee-4d2b-856a-3354b551e5a3[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\o[1].htm
      • %SystemDrive%\287140881.exe
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\forum_viewthread[1].js
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\nv_a[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\common[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\232719bv8ve5cvzl1l8zls[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017120620171207\container.dat
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\arw_l[1].gif
      • \TEMP\ÈÕÖ¾\²Ù×÷ÈÕÖ¾2017Äê12ÔÂ6ÈÕ.txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\jquery-1.8.3.min[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\rar[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\pt_item[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\ad[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DOMStore\ROKQPSRG\www.52dfg[1].xml
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\nv_a[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\namepost.small[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\pic1[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\avatar[2].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\arrwd[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\31_avatar_small[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\online_member[1].gif
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=2144616610,2983434978&fm=76[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\43_avatar_middle[1].jpg
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\fj_btn[1].png
      • \TEMP\AppData\qblist.txt
      • \TEMP\AppData\qwlist.txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C5MZMU22\style[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\u=4083043643,3990593241&fm=76[1].jpg
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\switch_width[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\avatar[2].htm
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\u=1199205626,971402299&fm=76[1].jpg
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\ui[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\icon[1].gif
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\thread-100646-1-1[1].html
      • %SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@www.52dfg[1].txt
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\X1IF8CSM\comm[1].js
      • \TEMP\093477fa334791163629386b655b01a8284cf9826760b2dd9c3046e370ce026b.exe
      • %SystemDrive%\AppData\AppConfig.ini
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TQM3V6S2\style_1_forum_viewthread[1].css
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\favicon[1].ico
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6OG0LJ4F\df_logo[1].png
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\cb_pc[1].js
      • %SystemDrive%\ \ 2017 12 6 .txt
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\forum[1].js
      • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\list-entry[1].js
      File Hashes
      • 093477fa334791163629386b655b01a8284cf9826760b2dd9c3046e370ce026b
      • 32529dd47d10c539f3b8334ba849decf6b7707196ab8bcc893dd3e4aa4399c3e
      • 354c9f630336cce0332558d73ae8000b62f61ca3eb7462e21183546f0da613b8
      • 36992980b5db3833a294748ce2abe530b9313dad5b0a8094bf9b10106ecbf250
      • 3e47b0d23d7e39af6759ca207d3307584862fe4181a6a4a54ea38cd45ce8c542

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      Screenshot





      Win.Trojan.Tinba-6390856-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value: F9E7DE7B
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value: internat.exe
      • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Run
      Mutexes
      • F9E7DE7B
      IP Addresses
      • N/A
      Domain Names
      • N/A
      Files and or directories created
      • %AppData%\F9E7DE7B\bin.exe
      File Hashes
      • cc235fb882372820d6232ba89455e5da28bc9b1877e528ac2397d280b0a7d5ff
      • baf4a030d51e688aebe5d190334f9751339e75b79c55e1ae9e277b7a33dd8808
      • 17147dc9d03023c4772817b6904676eb9417be3294d998ba118bf0a9d1f0d6d6
      • afdcc240157e03a46e8141ee99b24e4d6bcbe37c2a8d1b30e6ea860496cc3352
      • eef6f6d965da6f45e376eb9e5e01451ea110466e4b02780625cd5170edad4119
      • 52d0de1c298a088a0455941e1fe0e7894671db98338a34febf4f9870aa4f387c
      • bda3c8f957b7195dec6d5f2f4114022346aef9791ca434943876359d3d4f15e8
      • b3e98e2aed557dad670309692bdc0c6d7d580ea51933449ed01354bf2dd8ca3e

      Coverage


      Screenshots of Detection

      AMP


      ThreatGrid


      ↧

      Microsoft Patch Tuesday - December 2017

      December 12, 2017, 3:32 pm
      $
      0
      0
      Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 34 new vulnerabilities with 21 of them rated critical and 13 of them rated important. These vulnerabilities impact Edge, Exchange, Internet Explorer, Office, Scripting Engine, Windows, and more.

      In addition to the 33 vulnerabilities addressed, Microsoft has also released an update for Microsoft Office which improves security by disabling the Dynamic Data Exchange (DDE) protocol. This update is detailed in ADV170021 and impacts all supported versions of Office. Organizations who are unable to install this update should consult the advisory for workaround that help mitigate DDE exploitation attempts.

      Vulnerabilities Rated Critical


      Microsoft has assigned the following vulnerabilities a Critical severity rating:



      The following is a brief description of each vulnerability.

      Multiple CVEs - Scripting Engine Memory Corruption Vulnerability


      Multiple vulnerabilities have been identified in the scripting engines of Edge and Internet Explorer that could allow an attacker to remotely execute arbitrary code. These vulnerabilities all manifest due to the scripting engines in Edge and Internet Explorer improperly handling objects in memory. As a result, successful exploitation could lead to arbitrary code execution in the context of the current user. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of these vulnerabilities or, in some cases, opens a Microsoft Office document containing an embedded ActiveX control marked "safe for initialization."

      The following is a list of CVEs related to these vulnerabilities:

      • CVE-2017-11886
      • CVE-2017-11889
      • CVE-2017-11890
      • CVE-2017-11893
      • CVE-2017-11894
      • CVE-2017-11895
      • CVE-2017-11901
      • CVE-2017-11903
      • CVE-2017-11905
      • CVE-2017-11907
      • CVE-2017-11908
      • CVE-2017-11909
      • CVE-2017-11910
      • CVE-2017-11911
      • CVE-2017-11912
      • CVE-2017-11914
      • CVE-2017-11918
      • CVE-2017-11930


      CVE-2017-11888 - Microsoft Edge Memory Corruption Vulnerability


      A vulnerability have been identified in the scripting engines of Edge and Internet Explorer that could allow an attacker to remotely execute arbitrary code. This vulnerability manifests due to the scripting engines in Edge and Internet Explorer improperly handling objects in memory. As a result, successful exploitation could lead to arbitrary code execution in the context of the current user. Users could be exploited if they navigate to a malicious web page designed to exploit of these vulnerabilities.

      Multiple CVEs - Microsoft Malware Protection Engine Remote Code Execution Vulnerability


      Two arbitrary code execution vulnerabilities have been identified within the Microsoft Malware Protection Engine that could allow an attacker to execute code in the context of the LocalSystem account. These vulnerabilities manifest as a result of the engine improperly scanning files. Exploitation of these vulnerabilities is achievable if the system scans a specially crafted file with an affected version of the Microsoft Malware Protection Engine. Note that these update typically will not require action by users or administrators as the the built-in mechanism for automatic deployment of these updates will account within 48 hours of release.

      • CVE-2017-11937
      • CVE-2017-11940

      Vulnerabilities Rated Important


      Microsoft has assigned the following vulnerabilities an Important severity rating:



      The following is a brief description of each vulnerability.

      CVE-2017-11885 - Windows RRAS Service Remote Code Execution Vulnerability


      A vulnerability has been identified that exists in RPC on systems where Routing and Remote Access is enabled. Successful exploitation of this vulnerability could result in code execution. In order to exploit this vulnerability, an attacker would need to run an application specifically designed to exploit this vulnerability. Routing and Remote access is not enabled in default configurations of Windows. On systems where Routing and Remote Access is disabled, the system is not vulnerable.

      Multiple CVEs - Scripting Engine Information Disclosure Vulnerability


      Multiple vulnerabilities have been identified in the scripting engines of Edge and Internet Explorer that could allow an attacker to obtain information to further compromise a user's system. These vulnerabilities all manifest due to the scripting engine improperly handling objects in memory. Successful exploitation would give an attacker sensitive information that could then be used in other exploits. A scenario where users could be exploited include web-based attacks, where a user navigates to a malicious web page designed to exploit of one of these vulnerabilities.

      The following is a list of CVEs related to these vulnerabilities:

      • CVE-2017-11887
      • CVE-2017-11906
      • CVE-2017-11919


      CVE-2017-11899 - Microsoft Windows Security Feature Bypass Vulnerability


      A vulnerability has been identified that affects Device Guard. Successful exploitation of this vulnerability could result in Device Guard incorrectly validating untrusted files. As Device Guard uses signatures to determine whether a file is benign or malicious, this could cause Device Guard to allow a malicious file to execute on vulnerable systems. An attacker could leverage this vulnerability to cause an untrusted file to appear as if it is trusted.

      Multiple CVEs - Scripting Engine Memory Corruption Vulnerability


      Multiple vulnerabilities have been identified in the scripting engines of Edge and Internet Explorer that could allow an attacker to remotely execute arbitrary code. These vulnerabilities all manifest due to the scripting engines in Edge and Internet Explorer improperly handling objects in memory. As a result, successful exploitation could lead to arbitrary code execution in the context of the current user. Scenarios where these vulnerabilities would likely be exploited include web-based attacks where the user navigates to a malicious web page designed to exploit of these vulnerabilities or, in some cases, opens a Microsoft Office document containing an embedded ActiveX control marked "safe for initialization."

      The following is a list of CVEs related to these vulnerabilities:

      • CVE-2017-11913
      • CVE-2017-11916


      CVE-2017-11927 - Microsoft Windows Information Disclosure Vulnerability


      An information disclosure vulnerability has been identified that affects the Windows its:// protocol handler. This vulnerability manifests due to the protocol handler sending network traffic to a remote site when determining the zone associated with a URL that is provided to the protocol handler. An attacker could attempt to leverage this vulnerability to obtain sensitive information. This vulnerability could be leveraged to obtain NTLM hash values associated with a victim's account.

      CVE-2017-11932 - Microsoft Exchange Spoofing Vulnerability


      A spoofing vulnerability has been identified that affects Microsoft Exchange. This vulnerability manifests due to Outlook Web Access (OWA) failing to properly handle certain web requests. This vulnerability could be leveraged by attackers to inject scripts and content. This vulnerability could also be leveraged to redirect clients to a malicious web site. Successful exploitation of this vulnerability would require an attacker to send victims a specially crafted email containing a malicious link.

      CVE-2017-11934 - Microsoft PowerPoint Information Disclosure Vulnerability


      An information disclosure vulnerability has been identified that affects Microsoft Office. This vulnerability manifests due to Microsoft Office improperly disclosing contents in memory. This vulnerability could be leveraged by an attacker to obtain sensitive information that could be used to launch additional attacks against a target system. Successful exploitation of this vulnerability would require an attacker to send a specially crafted file to a victim and convince them to open the file.

      CVE-2017-11935 - Microsoft Excel Remote Code Execution Vulnerability


      An arbitrary code execution vulnerability has been identified in Microsoft Excel which manifests as a result of improperly handling objects in memory. An attacker could exploit this vulnerability by creating a specially crafted Excel document which triggers the vulnerability. Successful exploitation would allow an attacker to execute arbitrary code in the context of the current user. Scenarios where this could occur include email-based attacks or attacks where users download malicious files off of a site hosting user-created content (DropBox, OneDrive, Google Drive).

      CVE-2017-11936 - Microsoft SharePoint Elevation of Privilege Vulnerability


      A privilege escalation vulnerability has been identified in Microsoft SharePoint Server that could potentially allow an attacker to impersonate a user and perform restricted actions. This vulnerability manifests due to SharePoint improperly sanitizing specially crafted web requests. An authenticated user who exploits this vulnerability could proceed to perform a cross-site scripting attack to cause other users to execute arbitrary JavaScript in the context of that user. This could then allow an attacker to read content, change permissions, or inject other malicious content on behalf of that user if permitted.

      CVE-2017-11939 - Microsoft Office Information Disclosure Vulnerability


      An information disclosure vulnerability has been identified in Microsoft Office that could leak a user's private key. This vulnerability manifests as a result of Visual Basic macros in Office incorrectly exporting a user's private key from the certificate store while saving a document. Note that an attacker would need to exploit another vulnerability or socially engineer the user to obtain the document containing the leaked private key in order to leverage it.

      Coverage


      In response to these vulnerability disclosures, Talos is releasing the following Snort rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

      Snort Rules:

      • 37283-37284, 45121-45124, 45128-40133, 45138-45153, 45155-45156, 45160-45163,45167-45170.


      ↧
      Search

      Beers with Talos EP 18: Kitties in My Blockchain, Obfuscating Pronunciations, and Other Security Stuff

      December 15, 2017, 7:44 am
      $
      0
      0
      Matt Olney, Earl of Ethereum - "Holy ****! We have a cat"


      Beers with Talos (BWT) Podcast Episode 18 is now available.  Download this episode and subscribe to Beers with Talos:

      If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast

      EP18 Show Notes: 

      It’s the last full episode of the year! Thanks to you and the diligent work of Matt’s loving mother, the first 17 EPs of Beers with Talos were downloaded over 200,000 times in 2017! To show our gratitude, we are giving you not one, but TWO roundtables this week and even a special bonus rant! Also, Mitch can’t say words good, and Craig reads us stories from the blog! 

      Make sure to subscribe on iTunes, Google Play, or Stitcher to make sure you don't miss an episode!

      00:53 - Roundtable 1, mostly about Craig trying to burn yet another house down
      17:40 - Christmas Present for Craig - special bonus rant
      24:27 - PyREBox wins Volatility Plugin Contest
      27:08 - Bonus Roundtable - Favorite Security stories of 2017
      39:23 - Obfuscation in networks and samples OR Gear is more than cost and speed
      50:55 - Back to Basics - Starting with Security
      57:05 - OMG!! CRYPTOKITTIES!!! (Okay, we discuss/roast blockchain a bit, too)
      1:08:40 - Closing shots and parting thoughts

      If you read this far in the notes, send us an email with your t-shirt size and "Why does Craig mess with his mic so much?" in the subject line. One email will be picked randomly (this week only) and we will send you a BWT pint glass and t-shirt.  Maybe we'll pick a few... it's the holidays.

      Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
      Hosted by Mitch Neff (@MitchNeff)

      Find all episodes:
      http://cs.co/talospodcast

      Subscribe via iTunes (and leave a review!)
      http://cs.co/talositunes

      Check out the Talos Threat Research Blog:
      http://cs.co/talosresearch

      Subscribe to the Threat Source newsletter:
      http://cs.co/talosupdate

      Follow Talos on Twitter:
      http://cs.co/talostwitter

      Give us your feedback and suggestions for topics:
      beerswithtalos@cisco.com
      ↧

      Virus Bulletin Publication And Presentation

      December 19, 2017, 7:57 am
      $
      0
      0

      Virus Bulletin conference is a well regarded intimate technical conference focused on malware research. It provides a good balance between listening to technical talks and spending time exchanging experiences with colleagues from different companies; all working on the same task of making our computing environments more secure.

      This past October, Talos participated at the Virus Bulletin conference in Madrid with a talk presented by Warren Mercer and me, Paul Rascagneres. This talk covered the latest techniques used in the reconnaissance phase of attacks by APT actors. During the presentation, we demonstrated how the reconnaissance phase is executed as a part of the infection process in order to protect valuable zero-day exploits, malware frameworks, and other tools.



      Virus Bulletin requires selected speakers to submit a research paper which can later be used to help the security research community with their own research. Our submission to the conference was a paper titled "Modern reconnaissance phase by APT – protection layer". This paper is based on research conducted by Talos throughout the year and it is now publicly available on the Virus Bulletin web site.

      If you missed it at the conference, our presentation is available on the Virus Bulletin Youtube channel. The recorded presentation provides a good overview of the paper and it will hopefully make you enjoy reading the full paper as well.

      ↧
      ↧

      Vulnerability Spotlight: VMWare VNC Vulnerabilities

      December 19, 2017, 11:00 am
      $
      0
      0
      Today, Talos is disclosing a pair of vulnerabilities in the VNC implementation used in VMWare's products that could result in code execution. VMWare implements VNC for its remote management, remote access, and automation purposes in VMWare products including Workstation, Player, and ESXi which share a common VMW VNC code base. The vulnerabilities manifest themselves in a way that would allow an attacker to initiate of VNC session causing the vulnerabilities to be triggered. Talos has coordinated with VMWare to ensure the issue was disclosed responsibly and patched by the vendor. Additionally, Talos has developed Snort signatures that can detect attempts to exploit these vulnerabilities.

      These vulnerabilities were identified using the recently released Decept Proxy and Mutiny Fuzzers. By utilizing these tools fuzzing was quickly able to take place by generating VNC traffic, feeding it through the Decept Proxy, and finally fuzzing the resulting .fuzzer file via Mutiny. This all occurs without knowing anything about the VMWare specific protocol extensions. For more details about the Decept Proxy and Mutiny Fuzzers see our recent blog.

      Vulnerability Details

      Discovered by Lilith Wyatt <(^_^)> of Cisco Talos

      TALOS-2017-0368

      TALOS-2017-0368/CVE-2017-4933 is a code execution vulnerability residing in the remote management functionality of VMWare. Along with the standard VNC messages that all VNC server are required to support VMWare uses a custom and proprietary VNC extension that implements new VNC features and also reworks some standard ones. This vulnerability lies in one of these new features, VNWDynResolution, specifically in the VMWDynResolution request. This VMWDynResolution request is one of the few requests that causes the VNC server to read in a user-supplied data. The vulnerability resides in the way the VNC server handles this data and results in a heap corruption that can lead to code execution.  

      For more technical details, please read our advisory here.

      TALOS-2017-0369

      TALOS-2017-0369/CVE-2017-4941 is a code execution vulnerability residing in the remote management functionality of VMWare. As specified in the RFB protocol all VNC servers have to support a standard set of VNC messages. It is in this set of message that the vulnerability resides. The relevant messages are VncPointerEvent, VncSetPixelFormat, and VncFrameBufferUpdateRequest. This bug involves asking the VNC server to create a frame buffer (i.e. screenshot) in memory, changing the image format of that buffer to non-Truecolor (i.e. palette-based), and then causing a cursor to be re-rendered upon that buffer. As is a type confusion in the image format of the frame buffer and the cursor, it triggers a chain of events that leads to a high value being written into the cursors PNG infoStuct eventually leading to a loop of reads and writes to the stack resulting in an overflow. 

      For more technical details, please read our advisory here.

      Coverage

      Talos has developed the following Snort rules to detect attempts to exploit these vulnerabilities. Note that these rules are subject to change pending additional vulnerability information. For the most current information, please visit your Firepower Management Center or Snort.org.

      Snort Rules: 43483-43486

      For other vulnerabilities Talos has disclosed, please refer to our Vulnerability Report Portal: http://www.talosintelligence.com/vulnerability-reports/

      To review our Vulnerability Disclosure Policy, please visit this site:

      ↧

      Beers with Talos EP 19: The "Best" of BWT

      December 29, 2017, 2:29 pm
      $
      0
      0


      Beers with Talos (BWT) Podcast Episode 19 is now available.  Download this episode and subscribe to Beers with Talos:

      If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast

      EP19 Show Notes: 


      Quotes intended, we think you know why. Mitch takes control to present the best of the first (partial) year of the podcast. He covers some of our guests, some of our favorite non-security bits, and a look back at our in-the-moment view of some of the top stories of the year. 

      Things you can look forward to: A few of our favorite bits from 2017, Mitch struggling through sailing solo with unnecessary ukulele music, and some of our questionable moments...but the clips are really good!

      Timeline:

      The Guests

      02:06 - Bill Largent
      04:30 - Sean Baird’s Fake News and Fake Joel/Fake Matt
      08:35 - We finally get to Sean
      15:30 - Dr. Adam J. O’Donnell, PhD. and Mitch is mortified

      Fave Bits

      20:55 - The Birth of Craig v. Robots
      22:30 - 1994, The Year the Music Died

      The Big Stories

      31:10 - WannaCry - a look back at the first response
      37:40 - Importance of Conveying Doubt
      40:09 - Nyetya - Great breakdown and a look at supply chain attacks
      49:24 - CCleaner - Supply chain security

      The Links and Credits:

      Ukulele song: Akashic Records - Hot Summer Ukelele - Provided by Jamendo
      Confession song: Shady Dave - My love (piano loop)
      ==========
      Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
      Hosted by Mitch Neff (@MitchNeff).

      Find all episodes:
      http://cs.co/talospodcast

      Subscribe via iTunes (and leave a review!)
      http://cs.co/talositunes

      Check out the Talos Threat Research Blog:
      http://cs.co/talosresearch

      Subscribe to the Threat Source newsletter:
      http://cs.co/talosupdate

      Follow Talos on Twitter:
      http://cs.co/talostwitter

      Give us your feedback and suggestions for topics:
      beerswithtalos@cisco.com
      ↧

      Tutorial: Mutiny Fuzzing Framework and Decept Proxy

      January 3, 2018, 9:26 am
      $
      0
      0
      Here's a basic demo video for our new opensource tools, Decept and Mutiny. Happy New Year <(^_^)> 
      ~ Lilith
      Recently, Talos released new tools to assist in the monumental task of finding vulnerabilities in network applications. Mutiny and Decept work together to help researchers fuzz quickly and effectively with some unique features.  For more info on Mutiny Fuzzing Framework and Decept Proxy, see the initial blog post here:
      http://cs.co/6058DJPR2


      This tutorial assumes the following are previously installed:

      Mutiny Fuzzing Framework: https://github.com/Cisco-Talos/mutiny-fuzzer
      Decept Proxy: https://github.com/Cisco-Talos/Decept
      Python 2.7

      ↧
      Viewing all 2012 articles
      Browse latest View live
      Search
      <script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>