ID: Cookbook: urldownload.jbs Time: 08:25:02 Date: 29/10/2018 Version: Fire Opal

Transcription

1 ID: Cookbook: urldownload.jbs Time: 0:25:02 Date: 29//201 Version: Fire Opal

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: HIPS / PFW / Operating System Protection Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Startup Created / dropped Files Domains and IPs Contacted Domains Contacted URLs URLs from Memory and Binaries Contacted IPs Public Static File Info No static file info Network Behavior TCP Packets HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 322 Parent PID: 544 General File Activities File Created Analysis Process: wget.exe PID: 3252 Parent PID: 322 General Copyright Joe Security LLC 201 Page 2 of

3 File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Fire Opal Start date: Start time: 0:25:02 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: CloudBasic 0h 1m 1s false light urldownload.jbs /neko.sh Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: EGA Information: HDC Information: HCA enabled EGA enabled HDC enabled Timeout MAL mal5.win@3/1@0/1 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Warnings: Failed Failed Adjust boot time Unable to download file Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample will exhibit less behavior Copyright Joe Security LLC 201 Page 5 of

6 Signature Overview AV Detection Networking System Summary Hooking and other Techniques for Hiding and Protection HIPS / PFW / Operating System Protection Evasion Click to jump to signature section AV Detection: Antivirus detection for URL or domain Multi AV Scanner detection for domain / URL Networking: Connects to IPs without corresponding DNS lookups Downloads files from webservers via HTTP Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Spawns processes Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) HIPS / PFW / Operating System Protection Evasion: Creates a process in suspended mode (likely to inject code) Behavior Graph Copyright Joe Security LLC 201 Page of

7 Behavior Graph ID: URL: Startdate: 29//201 Architecture: WINDOWS Score: 5 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Number of created Registry Values Multi AV Scanner detection for domain / URL Antivirus detection for URL or domain started Number of created Files Visual Basic Delphi Java cmd.exe.net C# or VB.NET C, C++ or other language 1 Is malicious , 4911, 0 NETACTIONRO Romania started wget.exe Simulations Behavior and APIs Time Type Description 0:25:42 API Interceptor 14x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link /neko.sh 13% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of

8 Source Detection Scanner Label Link /neko.shB 0% Avira URL Cloud safe /neko.sh? 0% Avira URL Cloud safe /neko.sh 13% virustotal Browse /neko.sh 0% Avira URL Cloud malware Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Startup System is w cmd.exe (PID: 322 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-ag ent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 MD5: ADB9C1403B52BC532FBA594342B9) wget.exe (PID: 3252 cmdline: wget -t 2 -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' MD5: 3DADBE2ECE9C4B3E1E322E15B0) cleanup Copyright Joe Security LLC 201 Page of

9 Created / dropped Files C:\Users\user\Desktop\cmdline.out Process: File Type: Size (bytes): 205 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-25: SHA-5: Malicious: Reputation: false 45DAF9CB1D953F4EE44C 9EBD921114FB2554B95FCD2E439CAFFCD2 BF05D054AE00F4F9152F01AE9F002D9C213D1E04EFAD00 25F44192F015E599CFCC3B2D340F EDDC14DD5DE1D50E5F11513AF5CE149CB3BAF15C2FF 531D4D29B3D0FB544DB29EB1CDE5 false low Domains and IPs Contacted Domains No contacted domains info Contacted URLs Name Malicious Antivirus Detection Reputation /neko.sh true 13%, virustotal, Browse Avira URL Cloud: malware unknown URLs from Memory and Binaries Name Source Malicious Antivirus Detection Reputation /neko.shB wget.exe, sdmp /neko.sh? wget.exe, F sdmp true Avira URL Cloud: safe unknown true Avira URL Cloud: safe unknown Contacted IPs Copyright Joe Security LLC 201 Page 9 of

10 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 5% 5% < No. of IPs Public IP Country Flag ASN ASN Name Malicious Romania 2519 NETACTIONRO false Static File Info No static file info Network Behavior TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET HTTP Request Dependency Graph HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\cmd.exe Copyright Joe Security LLC 201 Page of

11 Timestamp Oct 29, 201 0:25: CET Oct 29, 201 0:25: CET kbytes transferred Direction Data 0 OUT GET /neko.sh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko Accept: */* Accept-Encoding: identity Host: Connection: Keep-Alive 0 IN HTTP/ Not Found Date: Mon, 29 Oct 201 0:25:34 GMT Server: Apache/2.4. (CentOS) Content-Length: 205 Keep-Alive: timeout=5, max=0 Connection: Keep-Alive Content-Type: text/html; charset=iso-59-1 Data Raw: 3c f d 4c c d 2f 2f f 2f d 4c e 30 2f 2f 45 4e 22 3e 0a 3c 4 d c 3e 3c e 0a 3c c 5 3e e f f 5 e 4 3c 2f c 5 3e 0a 3c 2f e 3c 2 f 4 9 3e 0a 3c 31 3e 4e f f 5 e 4 3c 2f 31 3e 0a 3c 0 3e c 20 2f e 5 b f 2e e f 4 20 f 5 e 4 20 f e e 3c 2f 0 3e 0a 3c 2f 2 f 4 9 3e 3c 2f 4 d c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head> <body><h1>not Found</h1><p>The requested URL /neko.sh was not found on this server.</p></body></html> Code Manipulations Statistics Behavior cmd.exe wget.exe Click to jump to process System Behavior Analysis Process: cmd.exe PID: 322 Parent PID: 544 General Start time: 0:25:41 Start date: 29//201 Path: Wow4 process (32bit): Commandline: C:\Windows\System32\cmd.exe false C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 0 -P 'C:\Users\user\Desktop\download' --no -check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 Copyright Joe Security LLC 201 Page 11 of

12 Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: 0x49f bytes ADB9C1403B52BC532FBA594342B9 true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\Desktop\cmdline.out read attributes synchronize generic write normal synchronous io non alert non directory file Source Address Symbol success or wait 1 49F3A9 CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 3252 Parent PID: 322 General Start time: 0:25:41 Start date: 29//201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wget.exe false wget -t 2 -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-d isposition --user-agent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' 0x bytes 3DADBE2ECE9C4B3E1E322E15B0 true C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page of