Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 20 and April 27. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
The most prevalent threats highlighted in this round up are:
- PUA.Win.Adware.Multiplug-6518212-0
Adware
Multiplug delivers a large number of files used to display advertisements.
- PUA.Win.Adware.Linkury-6518171-0
Adware
Linkury is another browser hijacking adware which comes bundled with other software.
- Win.Dropper.Temonde-6517997-0
Dropper
This is a Trojan compiled in .Net. It performs code injection on another process to avoid detection and extend its control.
- Win.Dropper.Chapak-6517991-0
Dropper
Chapak is a trojan which makes itself persistent on the host system and contacts a server to fetch commands and potentially download other malware.
- PUA.Win.Adware.Itorrent-6517988-0
Adware
This is a bundler which installs adware and other potentially unwanted applications.
- Win.Dropper.Vabushky-6518142-0
Dropper
This is a dropper which unloads Vabushky, a ransomware, onto the local system. Vabushky encrypts local files.
- PUA.Win.Downloader.Downloadguide-6517985-0
Downloader
Yet another malware which installs potentially unwanted programs and browser hijackers.
- PUA.Win.Adware.Browsefox-6518209-0
Adware
Browsefox modifies the browser to display ads and change the search behavior. This adware is typically bundled with other producs.
- Win.Dropper.Gandcrab-6518210-0
Dropper
Gandcrab is a ransomware which was particularly prevalent this week. Samples were delivered via Word documents. While the documents were different, the executable fetched by them was the same for each campaign.
Threats
PUA.Win.Adware.Multiplug-6518212-0
Indicators of Compromise
Registry Keys
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LOCALSERVER32
- Value: ServerExecutable
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TYPELIB
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
- <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
- <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\VERSION
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value: PnpInstanceID
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
- Value: CachePrefix
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
- <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
- <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\WIN32
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
- Value: CachePrefix
- <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
- <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
- Value: Version
- <HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\PROXYSTUBCLSID32
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: UNCAsIntranet
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
- <HKLM>\SOFTWARE\CLASSES\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
- Value: CachePrefix
- <HKCU>\SOFTWARE\WEBAPP\STYLES
- Value: MaxScriptStatements
- <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
- <HKLM>\SOFTWARE\CLASSES\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TYPELIB
- Value: Version
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
- <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32
- <HKCU>\Software\Microsoft\Internet Explorer\Main
- <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version
- <HKCU>\Software\WebApp\Styles
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0
- <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
- <HKLM>\SOFTWARE\CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32
- <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib
- <HKLM>\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP
- <HKLM>\SOFTWARE\CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
- <HKCU>\Software\WebApp
- <HKLM>\SOFTWARE\CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0
- <HKCR>\WOW6432NODE\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable
- N/A
- 45[.]77[.]226[.]209
- R2[.]JOBURNT[.]NET
- R1[.]JOBURNT[.]NET
- r2[.]joburnt[.]net
- r1[.]joburnt[.]net
- c2[.]allocal[.]info
- c1[.]allocal[.]info
- images\progressbar.gif
- %LocalAppData%\Temp\2eB3B1f\steps\1.ini
- %LocalAppData%\Temp\2eB3B1f\steps\3.ini
- %LocalAppData%\Temp\2eB3B1f\images
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\SCREEN0[1]
- %LocalAppData%\Temp\2eB3B1f\steps
- %LocalAppData%\Temp\2eB3B1f
- images\loader.gif
- 93289f85a27f71089eddea6f139d7c41344d318f411850126d75ea51aff6733c
- 3c2c480d23acacf31423e2b78520f88bd3bb0b481d2f43840aed1d16d0987f93
- 598c1ca12fb83aaeade0b19ad6d18ed680c011ee085c0798eda44b97aa38644b
- fbfe94ed1d3d11dff22ebccf7a80028f3052e863aae2b095bd700773a4d5d123
- a9eb76def683a0ffba1ab2704c40715d133fb6884121849096fcbaf8b3e65541
- ee92af9885b7b962d550b5c559001b71d3a5186c63edc2b84c6ee0a3d11f6038
- 1c6c368211a29b5f69ff64da32147ba4241f62fc77d02e66e98873b024bb2046
- d0424200836fda85e802c7c0e16aa1bcff1f9dacbc7524586244bf0c55b4c83b
- f5d97121664e2df180bb286d808c899ff085bf67ff42e8cf4573f5a14be52b72
- 14aee87a92ec1fc11211f5b52f6fe0c8f94c724a5a14b6ea0957ca25dedb0892
- b8688655f68b5d395cb4914e711e1995b4123688412d7fe06372cc3c0c8267a7
- 74ef0193265e7ca2e353a75f51fc81324669352775db867030b77687e65316f3
- 5de9d6ebd6d3c90d5819259d4c2f8bd646a861c36d090cc955c2408d7924ee9d
- 35a21ae4f4cdcf2681697cab80dae2a19cdd27f978e2e4875199967b100bb69c
- 0cf84cd5e553946d61bba2ec1e0c6b988c63dda6fdfe55bb70d0e742781bdb15
- e1a04d38648a472cfd5a87fdfaa480d2e38bcc88bda3b3e5181bbc1a2bcbba9d
- b193e85ec1b01e95d0a4575093868f92b0179ace355b78d7f6c87541fe68b370
- ac605db020addf7d28c6f919aca656cc97df7771801748b78d68a34fc2c07721
- 5afa83ca67022bc19477b014e20b4613e93b3a595dfa5f317ec9d602135aa21d
- 68fb06e263e78d0993d69c574c8508ee9fab8289310ec22542c4a686c2fbbc11
- 632e9c757e6a7ff18b8d382161af1fd6491eb8650fc12079cbcb617d624423ae
- cc80abc53d7720b98517f8a2321f457cd7b7a250f7ae8cd45846bab1c2558a50
- 16878f5289a2acda314ede318c644f4a3c271f1495e6d4bea1493aa2e3a88a36
- 1caeb8b04af0bffe857f6f7617f01d82f20177fb1a6913d46b974f62aa20ce2a
- f8abce29ef422582ed920d36d26be5357041ceca2297442c931f70a7e4f9c8e0
Coverage
Screenshots of Detection
AMP
ThreatGrid
Umbrella
PUA.Win.Adware.Linkury-6518171-0
Indicators of Compromise
Registry Keys
- N/A
- N/A
- N/A
- N/A
- N/A
- 91e4d7e3fe06af8180d03d35a88b13ad18c91784840b29ebbabd0897f03c85b9
- bc3e7e29b6fe2012781ef03cf08967ee577e4ddc4f643a753eea6057474dcbdc
- 969e8b516f4a717475e03661429ac2fa6a446ba26f8bef680e7881ebd66960c4
- 1fe2e86e58738c48c37274e273adef72e287ce86e3f42fb65b11ae6ebb553ba2
- 2b0d96ac5f744b63f2ccac770d7ebed16c27f42080a2e3e28d67dda778e4047e
- 610a95d15b5b189f04d12da43450d0ab8ba84e108943c2bb3a43162e980e82cf
- 6e5ced523eeec1ca10df59bd446f92ad5c1ed029152250457f27d2a09f6bc6c3
- 4bf6b5977c3921c9c64a9f96082b1476a8d9c96b31e2af7435471ec1bbae21a6
- 130ec795353581ee133a6a41ab7a546fd116d2b0144117346ef740fa15be4b98
- a5cb5b7f01b765fcc51ff84061c609b72aae5cef1bcd795f3e5efa67c8629064
- 1a8215183cb4bc71f6e30c3c2e72f786cf70d0ad25af0865b49d1d667d52091c
- bb2f71514dd42d3dfa81df0cf2e5d0f7bd51b40d13925410bd02a29e9dde404f
- d6c7b30f4cb108f802fc592e7e0aef0140b09514600b5500ad32caa83653db5f
- 132f430515486d593e247fedff3b503d2fe96013e20660c9afe2251d34c39967
- e45f125305d1dc217dca73fb75e89fc3243cd839ed22c46483a752b46e142d8c
- 8037c529362ffc95eaeda800830b56892addd747a416d4ea130ae3ea27fd3b2e
- e871b106da94ac12cb606e303279fed865c7c93b64ddbba6c758770841ef07a5
- b07357cedc32609686210cab144e5534289a9917d6731c5d94cb3c39aa6bd375
- 3aa333d83f3b6b631ed2576ed8fe745a5c90fbf33f3591e0e3ee1c602d7818bd
- 79b9e3719b1825c2506c39e876fc4007d63d72d2ece87bf952d55feb652057f3
- 0639d833c0a7d3d6fb8f9b7f92dc94cd562ac9c47060483436fe9d94c16e5135
- 6a65245e7ed18ede739f10a4d40be6c94f6e5c98b3ed11d0eea248d5cc9ff11b
- 6c3fd7ca8f725a51fbfbd1f9db7ee4032177c5324bc4ef5706372099d973f009
- ff10ff4a8ab0c3fee8d071c83d46f5c6c5a9057719a373874617283c544f1b10
- 5121d56efc3809129297ee364599222b75e77626a0650777f7c4c49345d17e5a
Coverage
Screenshots of Detection
AMP
ThreatGrid
Win.Dropper.Temonde-6517997-0
Indicators of Compromise
Registry Keys
- N/A
- Global\CLR_CASOFF_MUTEX
- N/A
- N/A
- N/A
- b0662b7e4ca76b633d7fa52a06b4720cc853528d4400c309ed42b9f861c4d0ac
- 47376c59afd142cadb3e254a7e63b24e1e77de31e181187c7d342104253c7574
- ccbe3c1a79cf6b7d07e6a2fb24ef3ebc1152354b4994cd0d9b5ca94c2df46da6
- 3a14fd4223810486654135562a655c0681fdd2974ece9176052ee5e36a0e9ea7
- ce41b0bc6b918b0866cc195784d2ba08d33c2f599c5b7ff383390517593239be
- ad2f25d3c2840f42c9b0d496b4125b428c5d339cff3314b55ae54e8b79ee3ed4
- 0c37f6474d2d93a51da230b381a01da8b053248c5dfc4dbb6779d57b190f26a3
- 870778c3c6d04c83f05805b3b0a9d56356224f7f76d42ad29ecfe882e3c20d20
- 4620f7f7a2340f01f98b4d78f2b61aeb40a8354c91151280a3c54477a49c757d
- 5f157c0ba35bfe6d325cdef614c9aa677d749f1651b0a1228a00089269cbdb2d
- 93692c5ff1a68074c64d0669eeb133bf74d8946300bbf2ee03230e00e4b3a8ba
- 94d3a893baefe31231d40934db7eb6a9fd1243b56386dfa022dc6c30cfdf16ee
- ef05bc231e06777d5fdc77b3ca76bd167c39e31b3a728b88628a183ec9115a0c
- e7c4eff70017f79df91242135de536cc57e808d9cfddcfcef143ac76fb6459cf
- 1231830b27d1e59968e92f0cd5c4d4d2202eff9721ccb24dd87eba864da466ac
- 160c33212fbfeeb2afd8a9413d00a506b7f7c795375ee3bdcf8b10d50564bf0e
- bedc93271e1e0765ccec9f6560361413356948c7363494994048660477cfae45
- 8c26f89d4073d3cf99da3197f556a13aaee0af9fa71887d837236109ee0dda11
- c8fe4346e53515c87a35e6b401efd28659e0cdc3c21094949d0c270e2a10b5a9
- d1c779a3f3540e7100aac4774d21a9cc0f79944f649b34991eec85e025b74240
- 8677ab94aea9a1ce5dbec3b5701a27c86dbfd5eb6ef30ff99c57ec21b942b1f1
- 1fd97e491e3ebc4ab1fc9fe1dac1eb700924cd4920839007ae257579780580be
- c4d7447ee91e066529282c2b6caccb285e4d264765c6483ba4ff802209b6afe6
- eb6399c420bd574436d1a508ec3f22e1540be110606d7a5679fc92ad217e26ce
- ea68665c2dadd9bbff4d81ed2c3037530dfb2b388eb212a4f666743e44877ad4
Coverage
Screenshots of Detection
AMP
Win.Dropper.Chapak-6517991-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: SavedLegacySettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
- Value: pfypvwhssoy
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: UNCAsIntranet
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyServer
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyOverride
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyEnable
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoConfigURL
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value: PnpInstanceID
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4
- 66[.]171[.]248[.]178
- NS2[.]VIRMACH[.]RU
- 1[.]0[.]168[.]192[.]in-addr[.]arpa
- politiaromana[.]bit
- ns1[.]virmach[.]ru
- ns2[.]virmach[.]ru
- ipv4bot[.]whatismyipaddress[.]com
- malwarehunterteam[.]bit
- NS1[.]VIRMACH[.]RU
- gdcb[.]bit
- %AppData%\Microsoft\rojovu.exe
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\7TZAD419.htm
- %WinDir%\Dorawonu kenevuli
- 38e70f6ab21df8f358a0339efacf813c398d2c81ac84eb170692b7f4a9d85a11
- c5284d7f81af2640b87e389739c393377f9cf44f66c734544dd7c5d36e5ebce8
- 511d460a7a89f8e04ae63c095a6bd609ea3430070c2219abf52b54b6a68cf65d
- 771be31a99b3a142530974876c7b19631e41909014aa830d8901db4ea0dcdf75
- 6116763086a3f5cca15f35eaf1c4e5b622486e180f57b97fedf03b9d489ee944
- fdc1af5f15cc306e1a31af6fa92b5c78a02839cf1623c44ed6dedf3c96e3e66c
- 4a9d4dcc8bd9a5648254db92047fd1b34d5b62ae9a73ad472ebc8831e5f7cf14
- aeeff1ad563cc9fd9e7199209c489fbe4ca86bda6d650b6d0437341a65949adc
- 5c902360da48c8aa3764fd81471f58ca9a741af24955101a9ff8927bd1e284d0
- f4e6ba27da9e31d52ae6a0483cccf0806aeb23590cff70af85f2af89f55b9dc5
- e8027abfcbe9f3d3fbda1e635318a9f9ff7dbadec2697a630f21ecdf72d43a6e
- 6500b0fc6b279282716162300a4ebfe059ef254479313392514bf9af7b0b5f54
- 1a0a083d3905c1b37f010130b19e73db0cd4385090c35c951dd6807da14db397
- 39027deb5b01892736313fc5b1acef81ee0d6e581ee3514768416371b9482c3b
- be15a74b15c3607d6d6d9995e1752bac8b78d4316098971669c9f6c10a7d9c0c
- b88dffcb8f1ecf6629100041f13c5b406c72ca5620067d49c6cdcbf46b8458a9
- 91435815f46bc5ad768c77636c23ee71ec6a82b88819e545f499b0c498d477c0
- 691f1968e302150ca31abb2e25ba117882418a4de9227a6201b8a6e759740bbd
- 49abf7cf6af3fda93f22c08316706d8596f29b45d2513f9682ff2d209b8f4d43
- 757825ffc0c5e38b61b3d56d57f7372223401bf47b891f1b6e333021b4804a20
- 516b2b6db75a4155fde2e0497da0ac000404e9872acf701ff1898df0ba4a51cb
- f2a55bf2bb857bf74eaabccf704ba5424de2c14fb88306327164abb8ad678536
- 85e84238a760302bbfd913d9dbf6d57d4a4c5939e27c930eaca6145f24f58b95
- ea4c4220c9d997032a3269b002a86752725c83115a1f1f9b12371721836945bf
- e1fa4987144085f9924993039e07d6f4e3d90b4b7b63864655bab7209fe9d97f
Coverage
Screenshots of Detection
AMP
ThreatGrid
PUA.Win.Adware.Itorrent-6517988-0
Indicators of Compromise
Registry Keys
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value: PnpInstanceID
- <HKCU>\Software\Microsoft\GDIPlus
- N/A
- 52[.]29[.]64[.]41
- 52[.]29[.]39[.]104
- info[.]atmili[.]ru
- s[.]itorrent[.]bz
- %LocalAppData%\Temp\98CBEC1.tmp
- %LocalAppData%\Temp\98CBEC2.tmp
- 5d4374d3efad7aa1fb713f39228ca03ba2d635d95dcc868448c64ced8462669b
- 4d19aaf8351aa917ae7e0451e5e3d555266230492b92df14924207898fe0556e
- ff7cbe2b22c305e60d97df17900c6dbd1f3ee04f893aa2f0064e8baca4b095e3
- 3650b0eb28ec8aa62803b5225f1d802c8c86030183d13568ca5b7ca83433c6b3
- 14189877093a87f0c1134cec073ca1b2feae37b98db1dc9ac11b28d22eacad41
- 0674b063dd2337e1ef589c6140513bd03775f98a8e7cdcd48ad516f2206196ea
- 4aafbe0e0fadbf24d9b7606ec02ed67472bfa2dfd80e911b80783ceac9ef707a
- 62fc29d2df8aa13dff0aeeaefc5226745fe49d7e0e676475924e365764fb93aa
- bfd7f93e3a51fe337dd83ae8b10db73db759d8950e41ffa5f10f3a9dd4637c16
- 8dfcd382927817426e77d43b6eb0a1b549a90dd623e3322bb87c8bc5b3af9a80
- 0ac7f7714b66003494e817c495a7cff7d00ed9c776f3852d6ae97a4f87fa76b1
- 8305265d4dc7323eca0bdc4b8dd05f7aefa8bedeaaca32de0158503624a901da
- 64f60f5274a7c672c9ab2616209c622aebc384a05d23f118f423a8ad7c89537d
- 4081b52e671a7ad760d8247d8946d1ee7909e727330efa8029afeac4926837e5
- 606f74b199f3ebffa19c8b97c80afdf81cbfc320d4cc27530166ac32d77184bc
- 7c5460496f4ce2ff5384ea07fa07a8022557a6f07e796a06269bba39c92b825a
- 8bf4e8f31580ad26afd918b8d895c1e222d5d60290c63a98ac22f046a5d63c9b
- f487f94cdb442263a9536771a081e04f8890e0884ff85d49992357066c5a6447
- c557ea0836e365f9c3b490cc7e03c180b4924a562c0d13d0720d902efb9bcca9
- 163c50c2c5fd71fc90d32c5b201eae19ef0f07ed17006058c210a6856021f892
- 71d8a2b00a79567120449b5be30ccbbb30b3df3619bd22bb72666a548f13eeea
- ad7e4d6ef119c9a1bd24cad2d540ca97b6d8f872f1a7cc56f284fe1fbbcfeeb2
- efa15c4ecc4a72a498103e9ee3fe46c8fb10f356996c51b55be1d838441f5905
- 2bb8cd9afc4b1dcbbea1aef78e7dd1fd4519dbcd84e318ae8d95ab6b2d3291b5
- cc44c2e0af8ecb0c3f6d06e12171b0a7b579a535d98d9cf16708a37f9c01d53f
Coverage
Screenshots of Detection
AMP
ThreatGrid
Umbrella
Screenshot
Win.Dropper.Vabushky-6518142-0
Indicators of Compromise
Registry Keys
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
- Value: CachePrefix
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: UNCAsIntranet
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: AutoDetect
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
- Value: Collection
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpDefaultGateway
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpDomain
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpNameServer
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpSubnetMaskOpt
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpInterfaceOptions
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyServer
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoDetect
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyOverride
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyEnable
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoConfigURL
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
- Value: WpadDetectedUrl
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
- Value: WpadDecisionTime
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
- Value: WpadDecision
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\D0-EC-4E-4C-68-09
- Value: WpadDecisionReason
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpNetbiosOptions
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
- Value: DhcpNameServerList
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: SavedLegacySettings
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
- Value: CachePrefix
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
- Value: CachePrefix
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- Value: WpadDetectedUrl
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- Value: WpadDecisionTime
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- Value: WpadDecision
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- Value: WpadNetworkName
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- Value: WpadDecisionReason
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
- Value: DhcpDomain
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
- Value: DhcpNameServer
- <HKLM>\SOFTWARE\VBSZKYHV
- Value: h
- <HKLM>\SOFTWARE\VBSZKYHV
- Value: w
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
- Value: DhcpScopeID
- <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}\d0-ec-4e-4c-68-09
- <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
- <HKLM>\software\vBszKyhV
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\d0-ec-4e-4c-68-09
- N/A
- 93[.]115[.]93[.]16
- N/A
- %System32%\vBszKyhVp.dll
- %System32%\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
- e5d37e741c64965d38d30ce53e8b80996a26b806ce4400789bb89deec6522632
- 62321486dbed50c38e356e48863522c8c34e1300fe00276839ccf8d5afb9c841
- 6d7dda4b9afd2609b3a9994304d611e532162d29b812f96a03aa0f9e156c4577
- fa168315e0e19fe319c9b48bea50b7e51519b16c828d74acc3f9d23ae8ee85f8
- b6c714f8167add365e23d2479c1dd401740cad0bc8b63dc214de63a56df54669
- 1eef403ddd8dd010b7ab5bcf6b6712a44b61cff62c2db804c4e8caf0a3df5257
- dcd3dc2fee778172e4adce4ea100e2cba0e590028c9b7ecef7e6736b8a50b289
- 8cd0afe406d49d69c16574f75256e3df1421296894062c619f0da2173f771e64
- e69d973504e34512b713f9e827113933fcb0317e0a96f0d0f34cd0ad86f99121
- b43b77f254c0f554634b7cbf524c1466c9cd9cf8d1eb59aa47c508cb47b3ca83
- 9ef72f076e0cd74e58e93654a8fe556144102221b63daba988448c6851bc12bb
- fd182a516290da90accab1ed6111b2833b56b10adaafd09105c31abab9b6158a
- 3399af9c82bc394bd730d9f7dd947947431a8033979d6d5ae64a53d4715541da
- e9801efc84681d52ecb905a22f154f41e848077319b67a31afb85c3ff7212c6d
- 463aa2d0b27a92d0d1b872d70bc13abe90a8b4622649a0e8d5b8135cd20cd901
- bdf235c92c2d880df003221ba993639971f3ea5aba29597a561c48a684949743
- 2b6d7d1c3d31bd042d6dbc31386b8641863d58e6b791c0b3c7b88cea6ae88950
- a3213eed4e1ffaf58f680c2d76f4be16783f1c40ba25d7480d7d1b2bedeb4c23
- 25b9b7e68b36e941c41376fec5c929dde6e3ffe05223cae34becf22c5c4f4e3d
- 3145293a52c8730bddfe326e00f9a6afcea42fa22ae12eb70cb64c47d06b2ed2
- be8b254407529caf893760aaa1db43303eb0f4b00bb51c7e0d4a1d05bd702014
- 2344027fc2269e49976251e652faf815d943ba12cafa340b4f3064161207ddd7
- d982d7d4bb9a9bbfa5d0a0e5cddfe4ab5a6455761d2f30a27ded543b9bcd42fe
- a6aeb422cb95bd79dadb200ee9db1479723bdbd4ea090bcf6f5e5cf9dd2457d9
- 4c2e70f4ec71f29a4ff7fb069c0c0a0b71050a99667fe9afd83c46ee3af58fa6
Coverage
Screenshots of Detection
AMP
ThreatGrid
Screenshot
PUA.Win.Downloader.Downloadguide-6517985-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOWSSEARCH
- Value: Version
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: SavedLegacySettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
- Value: CacheOptions
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
- Value: CachePath
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
- Value: CacheRepair
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHIST012018042620180427
- Value: CacheLimit
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: UNCAsIntranet
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyServer
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyOverride
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyEnable
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoConfigURL
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value: PnpInstanceID
- <HKCU>\Software\Microsoft\Windows Script\Settings
- <HKCU>\Software\Microsoft\Internet Explorer\Main
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKCU>\Software\Microsoft\Internet Explorer\Main\WindowsSearch
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE\MSHist012018042620180427
- \BaseNamedObjects\DlgCpp
- 104[.]40[.]188[.]185
- 104[.]45[.]146[.]238
- 104[.]41[.]149[.]192
- 104[.]40[.]156[.]71
- 72[.]21[.]81[.]200
- cs9[.]wpc[.]v0cdn[.]net
- dlg-messages[.]buzzrin[.]de
- dlg-configs[.]buzzrin[.]de
- dlg-configs-weu[.]cloudapp[.]net
- dlg-messages-eus[.]cloudapp[.]net
- az687722[.]vo[.]msecnd[.]net
- %LocalAppData%\Temp\DLG\loadingImage\loadingImage.bmp
- %LocalAppData%\Temp\DLG\ui\common\last\js\jquery-1.10.2.min.js
- %LocalAppData%\Temp\DLG\ui\common\last\css
- %LocalAppData%\Temp\DLG\ui\common\progress\img\icon.png
- %LocalAppData%\Temp\DLG\ui\common\progress\img\progress.png
- %LocalAppData%\Temp\DLG\initWindow\css\style.css
- %LocalAppData%\Microsoft\Windows\History\History.IE5\MSHist012018042620180427
- %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\img
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\css
- %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\css
- %LocalAppData%\Temp\DLG628A.tmp
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img
- %LocalAppData%\Temp\DLG\ui
- %LocalAppData%\Temp\DLG\ui\offers\d033278d2583e0fe2b7585ceb4483ad9\img\img1.png
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img\img1.png
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825
- %LocalAppData%\Temp\DLG\ui\common\progress\progress.zip.part
- %LocalAppData%\Temp\DLG\initWindow
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\css\style.css
- %LocalAppData%\Temp\DLG\ui\common\base
- %LocalAppData%\Temp\DLG\ui\common\base\js\jquery-1.10.2.min.js
- %LocalAppData%\Temp\DLG\ui\common\progress\img\br-rb.png
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\index.html
- %LocalAppData%\Temp\DLG\ui\common\progress\img\bar-lb.png
- %LocalAppData%\Temp\DLG\ui\common\last\img
- %LocalAppData%\Temp\DLG
- %LocalAppData%\Temp\DLG\ui\common\last\img\img1.png
- %LocalAppData%\Temp\DLG\dlgres\DLG-Product-Logo.png
- %LocalAppData%\Temp\DLG\ui\common\last\index.html
- %LocalAppData%\Temp\DLG\requirements
- %LocalAppData%\Temp\DLG\ui\common\progress\img\br-b.png
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\img
- %LocalAppData%\Temp\DLG\ui\common\progress\img\img1.png
- %LocalAppData%\Temp\DLG\ui\common\last\js
- %LocalAppData%\Temp\DLG\ui\common\progress\img\progress-bar.png
- %LocalAppData%\Temp\DLG\ui\common\progress\index.html
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\img\progress-bar.png
- %LocalAppData%\Temp\DLG\initWindow\css
- %LocalAppData%\Temp\DLG\ui\common\base\css
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\js\jquery-1.10.2.min.js
- %LocalAppData%
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\uifile.zip.part
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\index.html
- %LocalAppData%\Temp\DLG\loadingImage
- %LocalAppData%\Temp\DLG\ui\common\progress\css\style.css
- %LocalAppData%\Temp\DLG\ui\common\base\index.html
- %LocalAppData%\Temp\DLG\ui\common\last\last.zip.part
- %LocalAppData%\Temp\DLG\ui\common\progress\img\151.gif
- %LocalAppData%\Temp\DLG\ui\common\progress\js\jquery-1.10.2.min.js
- %LocalAppData%\Microsoft\Windows\History\History.IE5\MSHist012018042620180427\container.dat
- %LocalAppData%\Temp\DLG\ui\common\progress
- %LocalAppData%\Temp\DLG\ui\offers\1522ef138ba104249c3934a80811f825\uifile.zip.part
- %LocalAppData%\Temp\DLG\ui\offers\d1218f43853f973f710cba676ef66845\css
- %LocalAppData%\Temp\DLG\ui\common\progress\js
- 9e80a9629faaf49911b2d55e47d662e93a9f0c3a44cdb8f6e073248ac6dc351c
- 6f96cb6e06e72dca25f5a86bafbbf54ff41444408370b5948078ac54eae173dd
- 7f0a548256c1ae127d63567454b3423f1f1bb0894e1c4052419ac3b559451d97
- 36b4be4057e110d4cc2f6bd51c64a378c33e51ccf1704490218f71b7680ae34c
- 48e9a887ad404d4cd86c1a2a5cd554a53bb726626d21d0816275c3ddfd557d9d
- 4219002c5441b449b4467be6adc3bffc20acc99de0bdc83110874ef9207430ee
- 93faa77350b1950cd65f55d5be5f7ff5912c8668b3b62c718aed1fe8a38f86f5
- 6c3c69f854fadcda9c13b80f1723579ccfe71aca91aed8b5c4fd7b0628d51c4b
- f825588ce048eaa7c398be354bea3ffe0f7c6512f345962243bcb59cdb30a4f3
- bfbb38e548a52a0f382ed522eb4af650dcaae568f2cdc50f12e47af8d58fdf5a
- 2a63b30132cf5e87858e1c4e17c803980e40d2c88d78a5217dd96cc1cb7159a5
- bd7b9ab1834ac41e95174f00240d37eda802c3d42cbafc8dbc3ad30dcc007369
- d861c6696a5e6c3b2022df85ffc7640f33b0e54428ae497bb330b2aba259b7e9
- 2bc14d1d7c7d5d0ab5062568888ffbb2e9d1260b2e1285c9b40c45821bd2bf72
- aba71484082260bb50ca65395a81ab9fbd35b6e166186b06464b3308157c83ff
- 99490c14e2a4f0f483556dbcad7b2d54f69ce512656224ef16f71e0090a25f57
- b31ff12203cb9ffb5d9727c2a67a19da79d87d8120b6e9d11d4b95e7a9e8e91c
- 58a8d3881e95c490f07f45d993938fc4d6456445f34de3231769d6780f338ab5
- cc8d8e263a8e0b6bd427cf5acf4fc4dc221cda4b457db08c1784dbb93e99e3ed
- c370fa71ae2f4fcefa06bc564102f4f29bb4dcac1fcbcd32d9dd2bfae7e711a0
- 25c86d135b52ea0178efee2d61381b217f0d9eccf47bdd67f556524dd0aefe3c
- f7308eede1d35ad4ff82d5772fc1942675ac68d326966d74477cc5e7062cf457
- 65ccc33e020e5f954be9caa62e3f4ead076fd7670eca20aeb0169661100f40c9
- 9798ccc97125290bbbac1bce664e2d7db30a8177477af78aa4e820931272ebfd
- 7dd11a1e78d6b3aae7743733767a9062ff73455e631c16d1cc007207d35cd555
Coverage
Screenshots of Detection
AMP
ThreatGrid
Screenshot
PUA.Win.Adware.Browsefox-6518209-0
Indicators of Compromise
Registry Keys
- N/A
- N/A
- N/A
- N/A
- N/A
- c8e854f4dae4072154f324023486d4e80f13e33617ecb4835bfc1e1cd39b3917
- e6aaa4ee84ce59b1fb8840f60e10d6b44af458641670479577e40bf87a12213f
- f9c662335648b5a9b41fc5fd924b3dc003399840c50e545edae35035827ca158
- 36519727bef36b4a878c5f74d7822ef79d916e9b2dd945430ad062be37e15dac
- c8de2537db16100c8e993a95210eaa922aaab758693253015ea7e6b1ae97efc1
- 802ecca3de31fc5c856cd45eab1bd312ba376e43cc53e4c72aa76c2eb1d107e0
- 1148c11c538fc4b62926ae3c817e7ee6f6066710e90da8da250c67a65cd39824
- df2c8d329cec7769b3f80e4e233fa872f1ad829ac1d0fef2707762edb5be7b5f
- bd3e42ffe6573c0678169da09f4a4c9edfbf4743547258450199b88b9ddea1cf
- 2b5478b13a17c2b07aa4e5e6d60a20880ad96d2ff6a4f5538a5eb76a581d2707
- 2d43ea47c4718358ba2338204f39484adf74746720140f82eb4d1ef5de2aaf92
- 0a59af6f94c49f2cc979c1797aaf1116601c6bd224c4cb71d7c68994e27adf82
- 9a7ba66c452046a923c365bf422a2cc47bda02ec99b0572a9afc3232a3aa778b
- 748ca5b71088c520cdace941ac85655883622ecf64c18e3dbb55f6ff48ba4ca6
- 7407c38ab706c460fc3c78b7cb1d63f87cc823d43e46031bf5744868a3b0d9ef
- 6b9657efde984d01479364ca72edaa8da05e3286f46eca5fefe22de79dec83ca
- 52202a3bfd2e6cf27eca88aec33c3c10b878ac7ef45a837f946e9a7147ab317b
- 5b6eabf0b67e59ffdc19d7de742d97a0a01e5e142824723d8b213af8a01b534a
- 888bf7e0cae92f6218e98ebe17de3884f06b99d343df55d3c563039de449d88b
- c7609ad5e50d5b908a5474fb8648c824f335fc03e28a976743089952e1f7abed
- b20ea863ccb7ccd780af4c0e9075d97d2c64c3c795de438ba4be7e371e8dce13
- 3cb57462b962fd65d746743506651952a8f516246502b1598aa1a971ee1e7ec7
- 0daa164a8b453ada5fff14f3e29ddb4395d47d4c4102b1eebde5228be80e51f8
- 0408eed39aee7c02e3eac8c967f786bebab5b2716332dddc63529ada7cbe94d2
- 3c080b429de9c04801079c31c1496a61df7226a356f718dbe44161d33d9207a0
Coverage
Screenshots of Detection
AMP
Screenshot
Win.Dropper.Gandcrab-6518210-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: SavedLegacySettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value: DefaultConnectionSettings
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
- Value: skhclrzohqf
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: UNCAsIntranet
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
- Value: CachePrefix
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyServer
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoDetect
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyOverride
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: ProxyEnable
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value: AutoConfigURL
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value: PnpInstanceID
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: ProxyBypass
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value: IntranetName
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
- Value: CachePrefix
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f23c28b0e4
- 66[.]171[.]248[.]178
- zonealarm[.]bit
- 1[.]0[.]168[.]192[.]in-addr[.]arpa
- ipv4bot[.]whatismyipaddress[.]com
- ns2[.]cloud-name[.]ru
- ns1[.]cloud-name[.]ru
- ransomware[.]bit
- %AppData%\Microsoft\czhatp.exe
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\R0L7W0PH.htm
- 9f3fff0d33f24a6c33cbe2eb73279f9a84bab0e9ebbeecc0812d840bb1a7a9cd
- ee76c548867fe400ffba20191ff3cda4b0c17e757a34a5e033beb27609ce00d2
- 6a724649c1ff4713811d2cd20040a4b297b609baac3d7365f86bc0a46181f0bc
- 3167af650dbf40ce92c280ede3a98827bfa91393e9eb82c7d2706dbdb7314055
- 1249d39166972fecea8a6d9883fcb787aa5d3a76fc069bff30d8169f6f6cac39
- 55717667e82abb6640728e3f54f417c0e43e4074263ed8609cb3a53a8a71cea4
- f377f6456d01efb32b2f0d872309d846a0067a778e2759ef8eca366ab392d9f3
- eab4bd04e2cc37b0515c6afd8859aeccacf48f004211ff78d1c86697c7db1bca
- 1a3f9284c72f1b50669f16b4b883e20f7ae179fa90837d223a19814059c42789
- b28c5559bc1ac8b8ac03db87b99c5ff0860c4eae72776d8a658a373cd238df71
- c8798863e8741484557a2bc60963fa6b8f454a644673645fa2e5610305e1cf66
- 72389784141f9e694c4c547f234eca74a9ae563cbd7f13132cc9be113ba45600
- 0f110c3e3830554f19c906d03bc54631dd552897b974461e6a6bf469524c2449
- 8d9f1ffb082214e56252b51ce071c892d4a80b7a8ba5f664953848407c4ee536
- 7b1bdb0119f6bbac4ef62ce9a0fe03cf1a7d8f9a9243a4d9921dbc78311df503
- 20edf76d80a009863089ea1a2a13204fca58a9e15393b40dd1f9e325fb2cc676
- 78707d5e62547d52e7f0d76b7b43a4a8b0902a6463592b48beaad7b074ad5724
- 60c38375999628c4e0dda146f71d54dccebae44e6fe9caa232a8599653a3392b
- 23084b55e2f962ac0d809563e2fd8a6a91973d88e8ae0788316ff9398394aa30
- f8f59273834de7c36422384cc8533b3f46c54c4198d5e3b99c8c3e585a3bd057
- f6e56a84834c8dfcc405e8376706e56a064921a97275733c1d5518719718583a
- 1d6f2497e4cf0d6ed08a8678db2382c1a6a914455afa91ba72d9790782f5671b
- f83d3b17f1472f1b4aae34d5e9d344a9c2ba2dad0c51c41a29a18213ddc9c237
- 46f3e720df4661afe0075c6f9ca0a8158a758c267c249994070a455be97a6297
- 2135a6aa534cc195a340d1853fb7927fac025b08b8a151fd2a2b0b86aa2c298e
Coverage
Screenshots of Detection
AMP
ThreatGrid
