top of page
Threat Roundup for April 9 to April 16
C45-2021-04-17-8
Indicators of Compromise (IOC) List
Indicator of Compromise (IOC) | Date Published | IOC Type |
|---|---|---|
HKLM\SYSTEM\CONTROLSET001\SERVICES\PRVDISK
Value Name | 17/04/2021 | Win_Registry |
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE
25
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE
25
HKCU\SOFTWARE\XVYG
25
HKLM\SOFTWARE\WOW6432NODE\XVYG
25
HKCR\C3B616
25
HKCR\C3B616\SHELL
25
HKCR\C3B616\SHELL\OPEN
25
HKCR\C3B616\SHELL\OPEN\COMMAND
25
HKCR\.8CA9D79
25
HKLM\SOFTWARE\WOW6432NODE\XVYG
Value Name | 17/04/2021 | Win_Registry |
HKLM\SOFTWARE\WOW6432NODE\JQFVR5
1
Mutexes
Occurrences
EA4EC370D1E573DA
25
A83BAA13F950654C
25
Global\7A7146875A8CDE1E
25
B3E8F6F86CDD9D8B
25
563CCFFF6B36C3AB
5
Global\B2A01B9EB1B404AD
5
2070A5364843D9D3
4
408D8D94EC4F66FC
1
Global\350160F4882D1C98
1
053C7D611BC8DF3A
1
06227EDDA8D89D57
1
6A123199DB021A8B
1
Global\45A6DF2480F9A736
1
Global\16C74D482A4B4028
1
DCA5F909ADD0D874
1
30F80C6A32079FAE
1
DEACD0FAD06A020D
1
Global\793E1E6FCBC55A91
1
9D883BDB5F7D179D
1
Global\215A76A5FB88ABE2
1
EF0AACCE6B5A4B31
1
0AB7AC96567558DE
1
IP Addresses contacted by malware. Does not indicate maliciousness
Occurrences
140.153.250.82
1
171.212.85.59
1
208.91.242.175
1
6.22.113.129
1
116.180.119.93
1
213.231.170.236
1
143.250.90.57
1
102.214.50.189
1
193.146.104.28
1
148.148.17.149
1
102.215.36.70
1
218.190.35.240
1
160.149.203.171
1
65.24.108.147
1
198.119.252.214
1
212.106.76.71
1
189.114.140.54
1
204.53.49.149
1
144.224.239.94
1
69.135.139.62
1
87.51.113.34
1
129.18.34.141
1
24.70.206.40
1
134.137.11.213
1
156.180.219.238
1 | 17/04/2021 | Win_Registry |
HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS
Value Name | 17/04/2021 | Win_Registry |
HKLM\SYSTEM\CONTROLSET001\SERVICES\MSISERVER
Value Name | 17/04/2021 | Win_Registry |
4aecc28c37f0cbca6bd0abdd1017a9f23fce02834b0cc442ebf6711b73036153 | 17/04/2021 | SHA-256 |
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 17/04/2021 | Win_Registry |
5cff2c97e295c70cd6b0a2d37cc6ca45de38840e6494f843ea62f797564198a0 | 17/04/2021 | SHA-256 |
2f59973e2c566e98d299c15d4d86d4727d0a9c142352646126e344e5aff97f9f | 17/04/2021 | SHA-256 |
HKLM\SYSTEM\CONTROLSET001\SERVICES\ | 17/04/2021 | Win_Registry |
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name | 17/04/2021 | Win_Registry |
0f210b532df043a6b654d5b43088f74f | 17/04/2021 | MD5 |
9444fb6c6b50b8aeb4a8391dcbb31f584c1f9e65876c9e85821734c1d7318417 | 17/04/2021 | SHA-256 |
HKLM\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC
Value Name | 17/04/2021 | Win_Registry |
HKLM\SOFTWARE\WOW6432NODE\KCOMMON\1
Value Name | 17/04/2021 | Win_Registry |
HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST
14
HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS
14
HKLM\SYSTEM\CONTROLSET001\SERVICES\PRVDISK
14
HKLM\SYSTEM\CONTROLSET001\SERVICES\PRVDISK
Value Name | 17/04/2021 | Win_Registry |
81acd88ef7514af2bfdd0bfccc699dcb1745b4b15d4d52bbeae774be0485d9fb | 17/04/2021 | SHA-256 |
032f1001b3739d13ffb7c9e6bd27cbb086dda00b0f2b83ec3321e425b842e2cb | 17/04/2021 | SHA-256 |
129d89a72d58dc4cd55d10424537463d5c79ef79742fce6b99936d3d75de5d8f | 17/04/2021 | SHA-256 |
a510b529e22abd31eee1cf46abbddc9c483725f0d9d1ea03b93ffc02acc76870 | 17/04/2021 | SHA-256 |
HKLM\SYSTEM\CONTROLSET001\SERVICES\IEETWCOLLECTORSERVICE
Value Name | 17/04/2021 | Win_Registry |
ff48b3a25d19a221928162e22b12dc46f1b90b8b0c52c676cd6ff504c9a0219d | 17/04/2021 | SHA-256 |
2e3458d8d0c635a80c934f4490fe1fb82039abf9f0f01386c2b2da5e642c3151 | 17/04/2021 | SHA-256 |
HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS
Value Name | 17/04/2021 | Win_Registry |
0d40d41deee5bc6d04744ade927358f6151cc06391dc0388b80b98e561dddcfe | 17/04/2021 | SHA-256 |
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name | 17/04/2021 | Win_Registry |
55c4cb5cce26927ea82bfd6e67cab27906c5be4b591b4ac13b0de2badb0741f1 | 17/04/2021 | SHA-256 |
5fdcb11e9b300711e4825bafa08e74696f0a7f72b0d7b8b2ca4bd21f7c7cf082 | 17/04/2021 | SHA-256 |
83bf6d1bc398ff7edcbdb3d3bfbca3ef8789c3eef2668eeaba3fdb436aa43f64 | 17/04/2021 | SHA-256 |
2c83a9278ecd4e9e3579dc8f33f95f3bd2a4d4dc0cc86880797b53a0dfa0a2e0 | 17/04/2021 | SHA-256 |
7f6a0819df2284a9756e0ff4ac84483704ec7c95cd0eb8192578e54a1f22267a | 17/04/2021 | SHA-256 |
HKLM\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name | 17/04/2021 | Win_Registry |
20b700280875a41a93fb65c225d9d8d4f9ee38090c354ec7af0f6ff51cf6c64e | 17/04/2021 | SHA-256 |
1c812633a6f023c5262ab8f1dcd664f86f46aeb7b80cc3245432dc7718ee458c | 17/04/2021 | SHA-256 |
1a57cd28aee912c1f3f535bd1ac08224ad93ea6c7b032acdfefb01b9f17274e8 | 17/04/2021 | SHA-256 |
0003b0136a582bb94b56170103aa79695527c265809111a2d5924592cd45c00f | 17/04/2021 | SHA-256 |
f382071341e59f475f98d83c4109a02b8249fb17cef159a0f249e267e55bff13 | 17/04/2021 | SHA-256 |
71b79a5d061eb42a7e1086daad23fdeaefa0d94614a0ffb61ab9210b65405c40 | 17/04/2021 | SHA-256 |
846608f40aca4ca5bc12d3e874dab3059f95bbed0acac1434e6806bc9ab4a3be | 17/04/2021 | SHA-256 |
32968d9468aea7c5b3ac4c636c25320e3f29e01038ba36b062b54fb948a8c011 | 17/04/2021 | SHA-256 |
4c4200de9e89d65e9da6d397719400e59ce391c5515e706e456138a01eed4192 | 17/04/2021 | SHA-256 |
413de3f8b19c0bbda810761cca2ecdf16735932baa3f0b916f3e61d7a97e49a0 | 17/04/2021 | SHA-256 |
2eef6e2c74f6a371d423b06c121b15c0a8f674eabd95ec2c9526a4fa0977c318 | 17/04/2021 | SHA-256 |
7fc08c31e8a19582469be2071e9f393066c43bf98fd17b1e4ce0b09c208651a0 | 17/04/2021 | SHA-256 |
d48e65bff95ca6f0fc8359c2a69221a5eeb6ca7ab96c5f4bf350e573919a436d | 17/04/2021 | SHA-256 |
29e6d62a734f2d706b85acca57c40d8dc3b90cf2e249150e952a20c195901abd | 17/04/2021 | SHA-256 |
cddbeadb7a29bf9e5c1b12253340128e1006c9a9f3d21b521b0d631cbaa2353c | 17/04/2021 | SHA-256 |
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name | 17/04/2021 | Win_Registry |
2869da0ee38663ff44962d04d7d767a78a81dc5ad76077a2d3435e1209e9d76f | 17/04/2021 | SHA-256 |
ebb8235ac1357bdf231cfe94fbd8d57ab040693710588b9f5e368430b6a87a26 | 17/04/2021 | SHA-256 |
bottom of page