top of page
Threat Roundup for February 21 to February 28
C45-2020-02-29-8
Indicators of Compromise (IOC) List
Indicator of Compromise (IOC) | Date Published | IOC Type |
|---|---|---|
HKCU\SOFTWARE\BB0E5F604F30988E0B2498356D0A2358
2
HKCU\SOFTWARE\BDBC444244C8D079DD87AC27E84A52E2
2
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
5
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
5
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\9BD3387F7E8ABEB14EFCB3BDF5E7C89B
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\38407B401D4C3FE12E0AA019ABFE1C1E
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\38407B401D4C3FE12E0AA019ABFE1C1E
1
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\9F78F6C54CD3644B404DDA00839B7FA6
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\WINRAR
11
HKCU\SOFTWARE\WINRAR
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\9F78F6C54CD3644B404DDA00839B7FA6
1
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC
Value Name | 29/02/2020 | Win_Registry |
HKCU\ENVIRONMENT
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\WINRAR
22
HKCU\SOFTWARE\WINRAR
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\BB0E5F604F30988E0B2498356D0A2358
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\E425607C2D9B7766223C902817C469E3
1
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\FAKEMESSAGE
1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\BDBC444244C8D079DD87AC27E84A52E2
Value Name | 29/02/2020 | Win_Registry |
HKCR\LOCAL SETTINGS\MUICACHE\\52C64B7E
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\FAKEMESSAGE
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\9BD3387F7E8ABEB14EFCB3BDF5E7C89B
2
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
Value Name | 29/02/2020 | Win_Registry |
HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9
Value Name | 29/02/2020 | Win_Registry |
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
e425607c2d9b7766223c902817c469e3 | 29/02/2020 | MD5 |
HKCU\SOFTWARE\random | 29/02/2020 | Win_Registry |
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS | 29/02/2020 | Win_Registry |
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 29/02/2020 | Win_Registry |
9F78F6C54CD3644B404DDA00839B7FA6 | 29/02/2020 | MD5 |
5ebda11b3fd5a5a7f5d1714d88c0f3af | 29/02/2020 | MD5 |
9f78f6c54cd3644b404dda00839b7fa6 | 29/02/2020 | MD5 |
38407B401D4C3FE12E0AA019ABFE1C1E | 29/02/2020 | MD5 |
HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\33E4E80807204C2B6182A3A14B591ACD25B5F0DB
25
IP Addresses contacted by malware. Does not indicate maliciousness
Occurrences
91.199.212.52
25
88.198.60.25
25
160.153.137.40
25
27.254.81.87
25
45.119.83.237
25
165.22.221.121
25
216.218.206.69
1
Domain Names contacted by malware. Does not indicate maliciousness
Occurrences
api.w.org
25
crt.sectigo.com
25
secureservercdn.net
25
pieceofpassion.com
25
raisabook.com
25
www.marketfxelite.com
25
biswalfoodcircle.com
25
tananfood.com
25
www.pieceofpassion.net
25
Files and or directories created
Occurrences | 29/02/2020 | Win_Registry |
E425607C2D9B7766223C902817C469E3 | 29/02/2020 | MD5 |
38407b401d4c3fe12e0aa019abfe1c1e | 29/02/2020 | MD5 |
bb0e5f604f30988e0b2498356d0a2358 | 29/02/2020 | MD5 |
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name | 29/02/2020 | Win_Registry |
b5065239929ba72b4ba764c7bd80e9a81a59cd37977a6a7a9044ccd08f443254 | 29/02/2020 | SHA-256 |
80b91b5430c4200ddd41340d7ab5e72083ef5e2da2bbb62d21f93dab73b09374 | 29/02/2020 | SHA-256 |
bdbc444244c8d079dd87ac27e84a52e2 | 29/02/2020 | MD5 |
9bd3387f7e8abeb14efcb3bdf5e7c89b | 29/02/2020 | MD5 |
BB0E5F604F30988E0B2498356D0A2358 | 29/02/2020 | MD5 |
BDBC444244C8D079DD87AC27E84A52E2 | 29/02/2020 | MD5 |
30D802E0E248FEE17AAF4A62594CC75A | 29/02/2020 | MD5 |
33E4E80807204C2B6182A3A14B591ACD25B5F0DB | 29/02/2020 | SHA-1 |
e77bacc45b82228bf607ff0d32fbff385fa74ee4e5dd77962cee5a6ff9832cd9 | 29/02/2020 | SHA-256 |
9BD3387F7E8ABEB14EFCB3BDF5E7C89B | 29/02/2020 | MD5 |
bcc3ddeb859276e8b8d83e53eca72f22bb15131ff2be63b1847403f91c1c9ad5 | 29/02/2020 | SHA-256 |
3525253f41b121d2355eb87270c8549d2ee43c39aaebbef5b3b59a282dd2d057 | 29/02/2020 | SHA-256 |
af1ee4f6576c31441a2274c256d4607b756e97cca20782f4a48e2f1dbe73d00d | 29/02/2020 | SHA-256 |
bottom of page