ID: Sample Name: E DA5e8a0c01b.txt Cookbook: default.jbs Time: 15:35:01 Date: 18/04/2018 Version:

Transcription

1 ID: Sample Name: E203182DA5e8a0c01b.txt Cookbook: default.jbs Time: 15:35:01 Date: 18/04/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview System Summary: HIPS / PFW / Operating System Protection Evasion: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: notepad.exe PID: 2832 Parent PID: 2132 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 2 of 10

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:35:01 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 24s false light E203182DA5e8a0c01b.txt default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.wintxt@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.txt Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 3 of 10

4 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 2018 Page 4 of 10

5 System Summary HIPS / PFW / Operating System Protection Evasion Language, Device and Operating System Detection Click to jump to signature section System Summary: Classification label Reads software policies HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Behavior Graph Copyright Joe Security LLC 2018 Page 5 of 10

6 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: E203182DA5e8a0c01b.txt Startdate: 18/04/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started notepad.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2018 Page of 10

7 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshots Copyright Joe Security LLC 2018 Page of 10

8 Startup System is w notepad.exe (PID: 2832 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Desktop\E203182DA5e8a0c01b.txt MD5: A4FDF0E33E44E802C88ED4D80EA) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 2018 Page 8 of 10

9 Static File Info General File type: SMTP mail, ASCII text Entropy (8bit): TrID: message (Var. 1) (20512/2) % File name: File size: 525 MD5: SHA1: SHA25: SHA512: E203182DA5e8a0c01b.txt bbae2c1305f3a34db4d1e8b0b d350d83ad538fd1fc21cf1c2aa dfc238bfec3fb4b110bf2fbf85e05c18fe8452 d8b45ed02aad4 54e1c31255ac2f4efaec5aea0c8cff44503cb5cd 0aba0fa3dac85c5f80afc0f208c2008fad83412efd e5d0cdb5cea3a5ac4032f518 File Content Preview: Return-Path: from [ ] ([ :414]. helo=iad-etp-emp s-prod-114.fireeyecloud.com). by IAD-104 (envelope-fro m <phyllisny5@aol.com>). (ecelerity r(:)) with ESMTPS (cipher=dhe-rsa-aes128-gcm-sh File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: notepad.exe PID: 2832 Parent PID: 2132 General Start time: 15:35:40 Start date: 18/04/2018 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: C:\Windows\System32\notepad.exe false 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Desktop\E DA5e8a0c01b.txt 0x bytes A4FDF0E33E44E802C88ED4D80EA true C, C++ or other language Copyright Joe Security LLC 2018 Page of 10

10 Reputation: moderate File Activities File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 10 of 10