ID: Cookbook: urldownload.jbs Time: 22:46:20 Date: 19/02/2018 Version:

Transcription

1 ID: 4706 Cookbook: urldownload.jbs Time: 22:46:20 Date: 1/02/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 3212 Parent PID: 154 General Disassembly Code Analysis Copyright Joe Security LLC 201 Page 2 of 11

3 Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 4706 Start time: 22:46:20 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 4s false light urldownload.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.win@1/0@1/1 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 11

6 Networking System Summary HIPS / PFW / Operating System Protection Evasion Click to jump to signature section Networking: Performs DNS lookups Urls found in memory or binary data System Summary: Classification label HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 11

7 Hide Legend Behavior Graph ID: 4706 URL: Startdate: 1/02/201 Architecture: WINDOWS Score: 0 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic sahabatkapas.org started Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious wget.exe..., 53, 5605 GOOGLE-GoogleIncUS United States Simulations Behavior and APIs Time Type Description 22:46:47 API Interceptor 3x Sleep call for process: wget.exe modified from: 000ms to: 0ms 22:46:47 API Interceptor 3x Sleep call for process: wget.exe modified from: 30000ms to: 0ms 22:46:47 API Interceptor 5x Sleep call for process: wget.exe modified from: 60000ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 20000ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 2ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 26ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 24ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 25ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 23ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 27ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 20ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 27ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 26ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 22ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 2ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 247ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 257ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 2ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 21ms to: 0ms 22:46:4 API Interceptor 1x Sleep call for process: wget.exe modified from: 237ms to: 0ms 22:46:50 API Interceptor 1x Sleep call for process: wget.exe modified from: 217ms to: 0ms Copyright Joe Security LLC 201 Page 7 of 11

8 Time Type Description 22:46:50 API Interceptor 1x Sleep call for process: wget.exe modified from: 227ms to: 0ms Antivirus Detection Initial Sample No Antivirus matches No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link sahabatkapas.org 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context Copyright Joe Security LLC 201 Page of 11

9 ASN No context No context Startup System is w7 wget.exe (PID: 3212 cmdline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' MD5: 34C70455BFEFBB0E76BAD13AF4) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection sahabatkapas.org true false 0%, virustotal, Browse Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious... United States 1516 GOOGLE-GoogleIncUS false Copyright Joe Security LLC 201 Page of 11

10 Static File Info No static file info Network Behavior TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Feb 1, :47: CET Feb 1, :47: CET UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Feb 1, :47: CET Feb 1, :47: CET ICMP Packets Timestamp Source IP Dest IP Checksum Code Type Feb 1, :47: CET d002 (Port unreachable) Destination Unreachable DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Feb 1, :47: CET x27e Standard query (0) sahabatkapas.org A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Feb 1, x27e No error (0) sahabatkap 22:47: as.org CET A (IP address) IN (0x0001) Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 3212 Parent PID: 154 General Start time: 22:46:47 Start date: 1/02/201 Path: Wow64 process (32bit): C:\Windows\System32\wget.exe false Copyright Joe Security LLC 201 Page of 11

11 Commandline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition -- user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: 0x bytes 34C70455BFEFBB0E76BAD13AF4 true C, C++ or other language low Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11