Threat Roundup for January 3 to January 10

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 3 and Jan. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Trojan.Razy-7505643-0	Trojan	Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypts the data, and sends it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Dropper.Tofsee-7492214-1	Dropper	Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages to infect additional systems and increase the overall size of the botnet.
Win.Packed.Ursnif-7489213-0	Packed	Ursnif is used to steal sensitive information from an infected host and can also act as a malware downloader. It is commonly spread through malicious emails or exploit kits.
Win.Packed.ZeroAccess-7489468-1	Packed	ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.
Win.Ransomware.TeslaCrypt-7501245-1	Ransomware	TeslaCrypt is a well-known ransomware family that encrypts a user's files with strong encryption and demands Bitcoin in exchange for a file decryption service. A flaw in the encryption algorithm was discovered that allowed files to be decrypted without paying the ransomware, and eventually, the malware developers released the master key allowing all encrypted files to be recovered easily.
Win.Dropper.Upatre-7491797-0	Dropper	Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Dropper.TrickBot-7490964-0	Dropper	Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Win.Packed.Formbook-7491272-1	Packed	Formbook is an information stealer that attempts to collect sensitive information from an infected machine by logging keystrokes, stealing saved web browser credentials, and monitoring information copied to the clipboard.

---

Threat Breakdown

Win.Trojan.Razy-7505643-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE Value Name: Blob	11
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\SETTINGS\LEAKDIAGNOSISATTEMPTED	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden	3
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0748AF3992DE6E3AA7B386B7F6C08EF2.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\1C3DDA8020173A5B45A7C80CFC8B0298.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0748AF3992DE6E3AA7B386B7F6C08EF2.EXE Value Name: LastDetectionTime	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\B4F3AEA9F95879ABBE9B311B5AB9FC30.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\2AA87EE2B7BAA7D413CC747537A867A2.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\1C3DDA8020173A5B45A7C80CFC8B0298.EXE Value Name: LastDetectionTime	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\EB9064AF85850CF7B3485B2A911798D7.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\B4F3AEA9F95879ABBE9B311B5AB9FC30.EXE Value Name: LastDetectionTime	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\2AA87EE2B7BAA7D413CC747537A867A2.EXE Value Name: LastDetectionTime	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\EB9064AF85850CF7B3485B2A911798D7.EXE Value Name: LastDetectionTime	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: goodsStartup key	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\6035E0F59A5169E7C59129A3CDBD076E.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\6035E0F59A5169E7C59129A3CDBD076E.EXE Value Name: LastDetectionTime	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: goods	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0786B90DA12B29B5CC97621DCC78FA3E.EXE	1
<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0786B90DA12B29B5CC97621DCC78FA3E.EXE Value Name: LastDetectionTime	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: mrke	1

Mutexes	Occurrences
Global\14c64321-2d62-11ea-a007-00501e3ae7b5	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
172[.]217[.]12[.]206	10
172[.]217[.]9[.]225	7
172[.]217[.]5[.]238	6
104[.]16[.]155[.]36	3
77[.]88[.]21[.]158	3
172[.]217[.]10[.]46	1
172[.]217[.]10[.]33	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
smtp[.]yandex[.]com	3
whatismyipaddress[.]com	3
doc-00-6c-docs[.]googleusercontent[.]com	1
doc-0s-9s-docs[.]googleusercontent[.]com	1
doc-14-60-docs[.]googleusercontent[.]com	1
doc-0k-c8-docs[.]googleusercontent[.]com	1
doc-00-5o-docs[.]googleusercontent[.]com	1
doc-10-6c-docs[.]googleusercontent[.]com	1
doc-04-bg-docs[.]googleusercontent[.]com	1
doc-04-6c-docs[.]googleusercontent[.]com	1

Files and or directories created	Occurrences
%APPDATA%\pid.txt	3
%APPDATA%\pidloc.txt	3
%TEMP%\holdermail.txt	3
%TEMP%\holderwb.txt	3
%HOMEPATH%\desktop\product.pif	2
%TEMP%\bhv61AB.tmp	1
%TEMP%\bhv8DF6.tmp	1
%HOMEPATH%\Orkende	1
%HOMEPATH%\Orkende\Recomm.pif	1
%TEMP%\bhv5953.tmp	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Dropper.Tofsee-7492214-1

Indicators of Compromise

Registry Keys	Occurrences
<HKU>\.DEFAULT\CONTROL PANEL\BUSES	192
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config3	175
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Type	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Start	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ErrorControl	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: DisplayName	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: WOW64	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ObjectName	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Description	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>	158
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ImagePath	68
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\wpdjiqwl	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Type	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Start	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: ErrorControl	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: DisplayName	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: WOW64	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: ObjectName	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Description	11
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\lesyxfla	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: Type	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: Start	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: ErrorControl	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: DisplayName	11
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: WOW64	11

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
69[.]55[.]5[.]250	192
43[.]231[.]4[.]6/31	192
85[.]114[.]134[.]88	192
239[.]255[.]255[.]250	175
46[.]4[.]52[.]109	175
46[.]28[.]66[.]2	175
78[.]31[.]67[.]23	175
188[.]165[.]238[.]150	175
93[.]179[.]69[.]109	175
176[.]9[.]114[.]177	175
192[.]0[.]47[.]59	174
172[.]217[.]12[.]164	159
74[.]125[.]192[.]26/31	140
67[.]195[.]204[.]72/30	135
168[.]95[.]5[.]116/31	134
172[.]217[.]197[.]26/31	122
172[.]217[.]10[.]67	116
216[.]146[.]35[.]35	110
212[.]227[.]15[.]40/31	104
104[.]47[.]54[.]36	102
208[.]76[.]51[.]51	101
168[.]95[.]6[.]60/30	97
98[.]136[.]96[.]92/31	95
31[.]13[.]66[.]174	93
98[.]136[.]96[.]74/31	91

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
250[.]5[.]55[.]69[.]in-addr[.]arpa	192
microsoft-com[.]mail[.]protection[.]outlook[.]com	192
schema[.]org	175
250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org	175
250[.]5[.]55[.]69[.]cbl[.]abuseat[.]org	175
mta5[.]am0[.]yahoodns[.]net	175
250[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net	175
250[.]5[.]55[.]69[.]bl[.]spamcop[.]net	175
250[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org	175
whois[.]iana[.]org	174
whois[.]arin[.]net	173
coolsex-finders6[.]com	173
bestladies[.]cn	173
bestdates[.]cn	173
bestgirlsdates[.]cn	173
hotmail-com[.]olc[.]protection[.]outlook[.]com	171
eur[.]olc[.]protection[.]outlook[.]com	127
mx-eu[.]mail[.]am0[.]yahoodns[.]net	125
ipinfo[.]io	118
nam[.]olc[.]protection[.]outlook[.]com	93
mx6[.]earthlink[.]net	91
pkvw-mx[.]msg[.]pkvw[.]co[.]charter[.]net	88
charter[.]net	87
mx0[.]charter[.]net	87
msn-com[.]olc[.]protection[.]outlook[.]com	72

Files and or directories created	Occurrences
%SystemRoot%\SysWOW64\config\systemprofile	192
%SystemRoot%\SysWOW64\config\systemprofile:.repos	192
%TEMP%\<random, matching '[a-z]{8}'>.exe	188
%SystemRoot%\SysWOW64\<random, matching '[a-z]{8}'>	158
%HOMEPATH%	59
%System32%\<random, matching '[a-z]{8}\[a-z]{6,8}'>.exe (copy)	59
%SystemRoot%\SysWOW64\wpdjiqwl	11
%SystemRoot%\SysWOW64\lesyxfla	11
%SystemRoot%\SysWOW64\mftzygmb	10
%SystemRoot%\SysWOW64\piwcbjpe	10
%SystemRoot%\SysWOW64\zsgmltzo	10
%SystemRoot%\SysWOW64\yrflksyn	10
%TEMP%\<random, matching '[a-z]{4,9}'>.exe	9

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Packed.Ursnif-7489213-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob	18
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE Value Name: Blob	18

Mutexes	Occurrences
Local\https://vars.hotjar.com/	18
Local\https://www.avast.com/	18

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
23[.]221[.]50[.]122	18
152[.]199[.]4[.]33	18
23[.]221[.]49[.]75	18
23[.]221[.]50[.]102	18
104[.]107[.]26[.]214	18
13[.]109[.]156[.]118	18
65[.]55[.]44[.]109	17
157[.]240[.]18[.]35	15
104[.]107[.]18[.]91	15
38[.]126[.]130[.]202	15
192[.]42[.]119[.]41	14
13[.]107[.]21[.]200	13
172[.]217[.]164[.]136	13
23[.]196[.]81[.]176	13
204[.]79[.]197[.]200	12
204[.]2[.]197[.]202	12
72[.]22[.]185[.]200/31	12
172[.]217[.]197[.]156/31	12
172[.]217[.]6[.]206	11
172[.]217[.]12[.]136	11
172[.]217[.]11[.]36	11
172[.]217[.]10[.]14	11
169[.]54[.]251[.]164	11
23[.]201[.]42[.]247	11
23[.]201[.]42[.]161	11

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
googleads[.]g[.]doubleclick[.]net	18
www[.]googletagmanager[.]com	18
www[.]google-analytics[.]com	18
stats[.]g[.]doubleclick[.]net	18
connect[.]facebook[.]net	18
www[.]googleadservices[.]com	18
ib[.]adnxs[.]com	18
avast[.]com	18
static[.]avast[.]com	18
secure[.]adnxs[.]com	18
mc[.]yandex[.]ru	18
dev[.]visualwebsiteoptimizer[.]com	18
amplifypixel[.]outbrain[.]com	18
pixel[.]mathtag[.]com	18
tr[.]outbrain[.]com	18
amplify[.]outbrain[.]com	18
ajax[.]aspnetcdn[.]com	18
img-prod-cms-rt-microsoft-com[.]akamaized[.]net	18
az725175[.]vo[.]msecnd[.]net	18
script[.]hotjar[.]com	18
static[.]hotjar[.]com	18
c[.]s-microsoft[.]com	18
assets[.]onestore[.]ms	18
a[.]tribalfusion[.]com	18
www[.]avast[.]com	18

Files and or directories created	Occurrences
%TEMP%\www2.tmp	13
%TEMP%\www3.tmp	13
%TEMP%\www4.tmp	13
%HOMEPATH%\Favorites\Links\Suggested Sites.url	13
%HOMEPATH%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms	13
%HOMEPATH%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	13
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}	2
\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B40C43F1-F039-44D2-AEB7-87F5AF8ABC3D}\ProxyStubClsid32	2
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage	2
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}	2
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7EE7F34-3BD1-427f-9231-F941E9B7E1FE}	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f237df9-9ddb-47ad-b218-400d54c286ad}	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32	1
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81397204-F51A-4571-8D7B-DC030521AABD}\InprocServer32	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

---

Win.Packed.ZeroAccess-7489468-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: FileTracingMask	55
<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: ConsoleTracingMask	55
<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: MaxFileSize	55
<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: FileDirectory	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Start	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Start	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: DeleteFlag	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: DeleteFlag	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BROWSER Value Name: Start	55
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Defender	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Type	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: ErrorControl	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Type	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: ErrorControl	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: DeleteFlag	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Type	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: ErrorControl	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Type	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: ErrorControl	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010 Value Name: PackedCatalogItem	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009 Value Name: PackedCatalogItem	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008 Value Name: PackedCatalogItem	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007 Value Name: PackedCatalogItem	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006 Value Name: PackedCatalogItem	55
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005 Value Name: PackedCatalogItem	55

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
94[.]242[.]250[.]64	116
64[.]210[.]151[.]32	55
178[.]32[.]190[.]142	55
91[.]207[.]60[.]22	15
71[.]229[.]165[.]75	15
201[.]231[.]100[.]117	15
71[.]239[.]117[.]142	9
66[.]41[.]70[.]14	8
71[.]63[.]0[.]235	7
98[.]224[.]77[.]3	7
83[.]15[.]111[.]38	7
76[.]180[.]80[.]134	7
24[.]73[.]24[.]191	7
46[.]45[.]5[.]240	7
67[.]185[.]179[.]4	6
98[.]230[.]137[.]123	6
69[.]80[.]173[.]91	6
75[.]66[.]129[.]205	6
69[.]117[.]29[.]163	6
190[.]36[.]183[.]136	6
77[.]126[.]70[.]166	6
98[.]203[.]164[.]253	6
67[.]240[.]46[.]208	5
72[.]200[.]101[.]79	5
68[.]97[.]172[.]87	5

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
promos[.]fling[.]com	55

Files and or directories created	Occurrences
\@	116
\L\eexoxfxs	116
\cfg.ini	116
\systemroot\assembly\GAC_32\Desktop.ini	55
\systemroot\assembly\GAC_64\Desktop.ini	55
%System32%\LogFiles\Scm\e22a8667-f75b-4ba9-ba46-067ed4429de8	55
%SystemRoot%\assembly\GAC_32\Desktop.ini	55
%SystemRoot%\assembly\GAC_64\Desktop.ini	55
\systemroot\assembly\temp\@	55
\systemroot\assembly\temp\U	55
\systemroot\assembly\temp\cfg.ini	55
\systemroot\system32\consrv.dll	55
%System32%\consrv.dll	55
%SystemRoot%\assembly\temp\@	55
%SystemRoot%\assembly\temp\cfg.ini	55
\systemroot\system64	55

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Ransomware.TeslaCrypt-7501245-1

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\XXXSYS	15
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: addon_v57	15
<HKCU>\SOFTWARE\XXXSYS Value Name: ID	15
<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'>	15
<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'> Value Name: data	15

Mutexes	Occurrences
z_a_skh495ldfsgjl2935345	15

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
23[.]20[.]239[.]12	15
64[.]140[.]157[.]157	15
157[.]119[.]94[.]202	15
104[.]27[.]31[.]89	9
104[.]27[.]30[.]89	6
3[.]225[.]189[.]10	5
3[.]229[.]167[.]115	4
54[.]83[.]91[.]42	3
34[.]195[.]145[.]145	2
3[.]93[.]124[.]54	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
en[.]wikipedia[.]org	15
www[.]torproject[.]org	15
www[.]hugedomains[.]com	15
vostorgspa[.]kz	15
p4fhmjnsdfbm4w4fdsc[.]avowvoice[.]com	15
bledisloeenergy[.]com[.]au	15
polyhedrusgroup[.]com	15
todayinbermuda[.]co	15
nn54djhfnrnm4dnjnerfsd[.]replylaten[.]at	15
www[.]buildenergyefficienthomes[.]com	15
mosaudit[.]com	15
buildenergyefficienthomes[.]com	15
akdfrefdkm45tf33fsdfsdf[.]yamenswash[.]com	15

Files and or directories created	Occurrences
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0ZU5JT.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I478AKJ.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FI238.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FKVBH.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4QK3KJ.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I5QX7W9.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I77RW1L.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I7J37KF.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I9NSD58.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IANXEE8.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IC5NB1M.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ID60W3E.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IIUTK07.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IJE160U.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IKAVPAE.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IL2NS3P.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$INKC8CM.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IP8M1EE.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IPDP9E0.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ISIYA4I.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IV54ALI.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IWK2JPN.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IWYYKMD.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IXC3P46.txt	15
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IZ7KADN.txt	15

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Dropper.Upatre-7491797-0

Indicators of Compromise

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
93[.]185[.]4[.]90	25
104[.]20[.]17[.]242	10
98[.]214[.]11[.]253	6
66[.]196[.]61[.]218	6
98[.]246[.]210[.]27	6
81[.]90[.]175[.]7	5
216[.]16[.]93[.]250	5
76[.]84[.]81[.]120	4
217[.]168[.]210[.]122	4
84[.]246[.]161[.]47	4
85[.]135[.]104[.]170	3
24[.]148[.]217[.]188	3
81[.]93[.]205[.]251	3
81[.]93[.]205[.]218	3
62[.]204[.]250[.]26	3
173[.]248[.]31[.]1	3
87[.]249[.]142[.]189	2
98[.]209[.]75[.]164	2
194[.]228[.]203[.]19	2
24[.]220[.]92[.]193	2
176[.]36[.]251[.]208	2
109[.]86[.]226[.]85	2
95[.]143[.]141[.]50	2
68[.]55[.]59[.]145	2
188[.]255[.]239[.]34	2

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
icanhazip[.]com	25

Files and or directories created	Occurrences
%TEMP%\tywy22.txt	24
%TEMP%\tywyaven.exe	24
%TEMP%\t4930.tmp	1
%TEMP%\vimazet.exe	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

---

Win.Dropper.TrickBot-7490964-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2580483871-590521980-3826313501-500 Value Name: RefCount	1

Mutexes	Occurrences
Global\316D1C7871E10	22

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
181[.]113[.]28[.]146	5
188[.]120[.]254[.]68	5
195[.]123[.]220[.]178	5
198[.]23[.]209[.]201	4
104[.]20[.]17[.]242	3
119[.]252[.]165[.]75	3
78[.]24[.]223[.]88	3
188[.]165[.]62[.]34	3
164[.]68[.]120[.]60	3
69[.]195[.]159[.]158	2
190[.]214[.]13[.]2	2
5[.]2[.]70[.]145	2
185[.]213[.]20[.]246	2
185[.]141[.]27[.]190	2
185[.]177[.]59[.]163	2
216[.]239[.]38[.]21	1
200[.]21[.]51[.]38	1
200[.]127[.]121[.]99	1
181[.]129[.]104[.]139	1
18[.]213[.]79[.]189	1
45[.]125[.]1[.]34	1
23[.]20[.]220[.]174	1
45[.]137[.]151[.]198	1
5[.]182[.]210[.]109	1
51[.]89[.]115[.]124	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
icanhazip[.]com	3
250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org	2
checkip[.]amazonaws[.]com	2
wtfismyip[.]com	2
api[.]ip[.]sb	1
ipinfo[.]io	1

Files and or directories created	Occurrences
%System32%\Tasks\System Network Extensions	22
%APPDATA%\adirecttools	22
%APPDATA%\adirecttools\data	22
%APPDATA%\adirecttools\settings.ini	22
%APPDATA%\ADIRECTTOOLS\<original file name>.exe	22
%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt	21
%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp	21
%APPDATA%\adirecttools\Data\pwgrab64	1
%APPDATA%\adirecttools\data\pwgrab64_configs\dpost	1
%APPDATA%\adirecttools\69ab1bb7084669cf84cc43537b700264.exe	1
%SystemRoot%\TEMP\~DF8EC46E2629511EB8.TMP	1
%APPDATA%\adirecttools\runme.exe	1
%SystemRoot%\TEMP\~DF5EC233074AA93A3C.TMP	1
%SystemRoot%\TEMP\~DF4BEDA5BB57A455AF.TMP	1
%SystemRoot%\TEMP\~DFCE2B4CA7595FDB1F.TMP	1
%SystemRoot%\TEMP\~DF771B5AE6CE965D7A.TMP	1
%SystemRoot%\TEMP\~DF21C4C13A90F8FECB.TMP	1
%SystemRoot%\TEMP\~DF2EDE8F31D379304B.TMP	1
%SystemRoot%\TEMP\~DF887620F0BF482816.TMP	1
%SystemRoot%\TEMP\~DF6B5F6A59497674CC.TMP	1
%SystemRoot%\TEMP\~DFA8D4CB1355CC2A5F.TMP	1
%SystemRoot%\TEMP\~DF326643DA3623EF2B.TMP	1
%SystemRoot%\TEMP\~DF2334856A166D2B71.TMP	1
%SystemRoot%\TEMP\~DF862A67F04082D9B3.TMP	1
%SystemRoot%\TEMP\~DFC53480C7F7651844.TMP	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

---

Win.Packed.Formbook-7491272-1

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTELLIFORMS\STORAGE2	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\33FD244257221B4AA4A1D9E6CACF8474	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\4C8F4917D8AB2943A2B2D4227B0585BF	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5309EDC19DC6C14CBAD5BA06BDBDABD9	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\82FA2A40D311B5469A626349C16CE09B	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9E71065376EE7F459F30EA2534981B83	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\A88F7DCF2E30234E8288283D75A65EFB	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\C02EBC5353D9CD11975200AA004AE40E	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\D33FC3B19A738142B2FC0C56BD56AD8C	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\DDB0922FC50B8D42BE5A821EDE840761	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\DF18513432D1694F96E6423201804111	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\ECD15244C3E90A4FBD0588A41AB27C55	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\F86ED2903A4A11CFB57E524153480001	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\{D9734F19-8CFB-411D-BC59-833E334FCB5E}	27
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\CALENDAR SUMMARY	27

Mutexes	Occurrences
8-3503835SZBFHHZ	29
Startup_shellcode_006	29
KN7MSAA2BUECxyHz	29
S-1-5-21-2580483-10603632762720	21
S-1-5-21-2580483-2008626601611	2
S-1-5-21-2580483-1148626601611	1
S-1-5-21-2580483-1464626601611	1
S-1-5-21-2580483-2116626601611	1
S-1-5-21-2580483-1392626601611	1
S-1-5-21-2580483-1992626601611	1
S-1-5-21-2580483-1380626601611	1
S-1-5-21-2580483-584626601611	1
S-1-5-21-2580483-1120626601611	1
S-1-5-21-2580483-2100626601611	1
S-1-5-21-2580483-1616626601611	1
S-1-5-21-2580483-1012626601611	1
S-1-5-21-2580483-972626601611	1
S-1-5-21-2580483-1440626601611	1
S-1-5-21-2580483-1460626601611	1
S-1-5-21-2580483-956626601611	1
S-1-5-21-2580483-1808626601611	1
S-1-5-21-2580483-888626601611	1
S-1-5-21-2580483-10203632762720	1
S-1-5-21-2580483-2036626601611	1
S-1-5-21-2580483-10843632762720	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
162[.]213[.]250[.]169	10
173[.]0[.]50[.]210	6
217[.]160[.]0[.]55	4
192[.]155[.]190[.]84	3
172[.]247[.]92[.]19	3
199[.]59[.]136[.]230	3
184[.]168[.]221[.]32	2
198[.]54[.]117[.]216	2
198[.]54[.]117[.]211	2
23[.]20[.]239[.]12	2
184[.]168[.]131[.]241	2
217[.]160[.]0[.]154	2
74[.]208[.]236[.]114	2
199[.]59[.]138[.]230	2
74[.]117[.]219[.]198	2
198[.]54[.]117[.]218	1
198[.]54[.]117[.]212	1
198[.]54[.]117[.]215	1
184[.]168[.]221[.]36	1
185[.]230[.]60[.]195	1
85[.]159[.]66[.]62	1
97[.]74[.]42[.]79	1
172[.]217[.]5[.]243	1
208[.]100[.]26[.]245	1
3[.]234[.]181[.]234	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
www[.]allixanes[.]com	10
www[.]travelcards[.]site	6
www[.]orlandohouston[.]com	5
www[.]xn--4qw729d[.]com	5
www[.]davekachman[.]com	5
www[.]iqama[.]info	5
www[.]reserveforcespolicy[.]com	5
www[.]enjoquotes[.]com	4
www[.]online-rfs-billing[.]info	4
www[.]imtrainee[.]net	4
www[.]ildolce[.]store	4
www[.]elgranretodeseve[.]com	4
www[.]arnaud4k[.]com	4
www[.]digital-spot[.]net	4
www[.]casalukre-co[.]com	3
www[.]jingrunxuan[.]com	3
www[.]hzwhedu[.]com	3
www[.]zxhckj[.]com	3
www[.]thehouseofthedrone[.]com	3
www[.]24hourautolocksmith[.]company	3
www[.]kingofthenorth[.]tech	3
www[.]aurora-health-ua[.]com	3
www[.]prokat[.]site	3
www[.]riicko[.]com	3
www[.]hugedomains[.]com	2

Files and or directories created	Occurrences
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	29
%APPDATA%\KN7MSAA2	27
%APPDATA%\KN7MSAA2\KN7log.ini	27
%APPDATA%\KN7MSAA2\KN7logrc.ini	27
%APPDATA%\KN7MSAA2\KN7logri.ini	27
%APPDATA%\KN7MSAA2\KN7logim.jpeg	26
%APPDATA%\KN7MSAA2\KN7logrv.ini	26
%ProgramFiles(x86)%\Ygl8drb	1
%ProgramFiles(x86)%\Ygl8drb\config9rs4ano.exe	1
%TEMP%\Ygl8drb	1
%TEMP%\Ygl8drb\config9rs4ano.exe	1
%ProgramFiles(x86)%\Ymnlhitch	1
%ProgramFiles(x86)%\Ymnlhitch\helpcfsd4ho.exe	1
%TEMP%\Ymnlhitch	1
%TEMP%\Ymnlhitch\helpcfsd4ho.exe	1
%ProgramFiles(x86)%\Kpfyl	1
%ProgramFiles(x86)%\Kpfyl\helpex9l_rep.exe	1
%TEMP%\Kpfyl	1
%TEMP%\Kpfyl\helpex9l_rep.exe	1
%ProgramFiles(x86)%\Gbbcdufw	1
%ProgramFiles(x86)%\Gbbcdufw\vgaxjwtjt.exe	1
%TEMP%\Gbbcdufw	1
%TEMP%\Gbbcdufw\vgaxjwtjt.exe	1
%ProgramFiles(x86)%\L1b6h	1
%ProgramFiles(x86)%\L1b6h\systrayybihc.exe	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

CVE-2019-0708 detected - (17518)

An attempt to exploit CVE-2019-0708 has been detected. The vulnerability, dubbed BlueKeep, is a heap memory corruption which can be triggered by sending a specially crafted Remote Desktop Protocol (RDP) request. Since this vulnerability can be triggered without authentication and allows remote code execution, it can be used by worms to spread automatically without human interaction.

Process hollowing detected - (353)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Kovter injection detected - (269)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Gamarue malware detected - (158)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Installcore adware detected - (90)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Dealply adware detected - (88)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

Excessively long PowerShell command detected - (87)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.

Corebot malware detected - (23)

Corebot is a Trojan with many capabilities found in other prominent families. It features a plugin system to enable it to load a variety of features from the C&C server at any time. Known plugins include RAT capabilities such as taking desktop screenshots, as well as being able to intercept and modify browser communications and steal data, especially data related to banking.

Reverse http payload detected - (19)

An exploit payload intended to connect back to an attacker controlled host using http has been detected.

Fusion adware detected - (11)

Fusion (or FusionPlayer) is an adware family that displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware is known to sometimes download and install malware.