ID: Sample Name: Updater.exe Cookbook: default.jbs Time: 21:09:59 Date: 18/05/2018 Version:

Transcription

1 ID: 6032 Sample Name: Updater.exe Cookbook: default.jbs Time: 21:09:59 Date: 1/05/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Copyright Joe Security LLC 201 Page 2 of 14

3 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: Updater.exe PID: 3444 Parent PID: 3024 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 6032 Start time: 21:09:59 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 33s false light Updater.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean2.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: Updater.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 201 Page 4 of 14

5 Confidence Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 201 Page 5 of 14

6 Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Signature Overview Networking System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data System Summary: PE file contains strange resources Sample file is different than original file name gathered from version info.net source code contains many API calls related to security Classification label Creates files inside the user directory PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads software policies PE file contains a COM descriptor data directory PE file has a big code size Submission file is bigger than most known malware samples PE file has a big raw section Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Found a high number of Window / User specific system calls (may be a loop to detect user behavior) Copyright Joe Security LLC 201 Page 6 of 14

7 Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Behavior Graph Hide Legend ID: 6032 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: Updater.exe Startdate: 1/05/201 Architecture: WINDOWS Score: 2 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started Updater.exe 1 5 Simulations Behavior and APIs Time Type Description 21:10:45 API Interceptor 1x Sleep call for process: Updater.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link Updater.exe 2% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 14

8 Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Copyright Joe Security LLC 201 Page of 14

9 Screenshots Startup System is w7 cleanup Updater.exe (PID: 3444 cmdline: 'C:\Users\user\Desktop\Updater.exe' MD5: 3F4BA7AF269B0EABEA10FED97663) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs Copyright Joe Security LLC 201 Page 9 of 14

10 No contacted IP infos Static File Info General File type: Entropy (bit): PE32 executable (GUI) Intel 036 Mono/.Net assemb ly, for MS Windows TrID: Win32 Executable (generic) a ( /4) 99.16% Generic CIL Executable (.NET, Mono, etc.) (73296/5) 0.73% Visual Basic Script (6000/0) 0.06% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% File name: Updater.exe File size: MD5: SHA1: SHA256: SHA512: File Content Preview: 3f4ba7af269b0eabea10fed97663 afb33cbb53d4f33d e5f02be9bf3a5 bdc3b21f7a6ee37c27f9f2d15fe7d7503a7f52d3447ff b57174ae14cf0d7 7502fcd37cb2266efffd12eab99beecfb5c52db150bb 612d53647fcb99fed7b692b9605f5d3360b07f45af40a 4a2ff333f70396e950ae1db11dd6f MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l... iz..."...0..<...b[......`...@ @... File Icon Static PE Info General Entrypoint: 0x515b62 Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x5A69C4C0 [Thu Jan 25 11:51:2 201 UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f34d5f2d4577ed6d9ceec516c1f5a744 Entrypoint Preview Instruction jmp dword ptr [ h] Copyright Joe Security LLC 201 Page 10 of 14

11 Instruction Copyright Joe Security LLC 201 Page 11 of 14

12 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x115b10 0x4f.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x xac0.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x1159d 0x1c.text IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x200 0x4.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x1b6 0x1c00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x xac0 0xc00 False data IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ.reloc 0x xc 0x200 False dbase IV DBT of d;.dbf, blocks size 12, next free block index IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x x3437 PNG image data, 256 x 256, -bit/color RGBA, noninterlaced RT_ICON 0x1195c 0x25a dbase IV DBT of `.DBF, blocks size 4, next free block index 40, 1st item "JJJ\377JJJ\377JJJ\377JJJ\377JJJ\377JJJ\377JJJ\377J JJ\377^^^\377\202\202\202\377\303\301\302\377\356\35 4\355\377\356\354\355\377\356\354\355\377\356\354\35 5\377\356\354\355" RT_ICON 0x11bb0 0x10a data RT_ICON 0x11cc3 0x9 data Copyright Joe Security LLC 201 Page 12 of 14

13 Name RVA Size Type Language Country RT_ICON 0x11d5d0 0x46 GLS_BINARY_LSB_FIRST RT_GROUP_ICON 0x11da4 0x4c MS Windows icon resource - 5 icons, 256-colors RT_VERSION 0x11daa4 0x3a0 data RT_MANIFEST 0x11de54 0xc67 XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators Imports DLL mscoree.dll Import _CorExeMain Version Infos Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright Oleg Shilo Assembly Version InternalName Updater.exe FileVersion CompanyName CS-Script LegalTrademarks Comments Updater for CS-Script for Notepad++ ProductName CS-Script for Notepad++ ProductVersion FileDescription Updater OriginalFilename Updater.exe Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: Updater.exe PID: 3444 Parent PID: 3024 General Start time: 21:10:44 Start date: 1/05/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\Updater.exe false 'C:\Users\user\Desktop\Updater.exe' 0x bytes 3F4BA7AF269B0EABEA10FED97663 true.net C# or VB.NET low Copyright Joe Security LLC 201 Page of 14

14 File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14