ID: Sample Name: maintools.js Cookbook: default.jbs Time: 15:43:35 Date: 17/02/2018 Version:

Transcription

1 ID: 48 Sample Name: maintools.js Cookbook: default.jbs Time: 1:43:3 Date: 1/02/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: wscript.exe PID: 321 Parent PID: 244 General Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 2 of 10

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 48 Start time: 1:43:3 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 1s false light maintools.js default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal2.winjs@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Found application associated with file extension:.js Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 3 of 10

4 Strategy Score Range Further Analysis Required? Threshold 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 2018 Page 4 of 10

5 AV Detection System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for submitted file System Summary: Classification label Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Uses an in-process (OLE) Automation server Java / VBScript file with very long strings (likely obfuscated code) Suspicious javascript / visual basic script found (invalid extension) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: Found WSH timer for Javascript or VBS script (likely evasive script) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 2018 Page of 10

6 Hide Legend ID: 48 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Sample: maintools.js Startdate: 1/02/2018 Number of created Registry Values Number of created Files Visual Basic Architecture: WINDOWS Delphi Score: 2 Java.Net C# or VB.NET C, C++ or other language Multi AV Scanner detection for submitted file Suspicious javascript / visual basic script found (invalid extension) started Is malicious wscript.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Scanner Label Link maintools.js 8% virustotal Browse No Antivirus matches Unpacked PE Files No Antivirus matches Copyright Joe Security LLC 2018 Page of 10

7 Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshot Copyright Joe Security LLC 2018 Page of 10

8 Startup System is w cleanup wscript.exe (PID: 321 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\maintools.js' MD: D4EAC8B818A8DF204A) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 2018 Page 8 of 10

9 Static File Info General File type: Entropy (8bit): ASCII text, with very long lines, with CRLF line t erminators TrID: Java Script (400/0).23% Java Script embedded in Visual Basic Script (2000/0) 30.% File name: File size: 112 MD: SHA1: SHA2: SHA12: File Content Preview: maintools.js bb003223d238a4e8aef8d df24fdfb130ff3184a3fcdc4df14cade4 4e44e31a138f8b4d1ec18e2c8aaed0ffa ac24b8ef33 818fc cde8cb84d433a0b3324ab b18341a3a4ebf3a1fa3b11e1140c48e8d11 d1ace48233bb1ee01003afaa10e function new_eval(code){...wscript.echo(code);..}...eval = new_eval;...try{...var wvy1 = WScript.Arguments;...va r sswz = wvy1(0);...var ES3c = y3zb();...es3c = LXv(E S3c);...ES3c = CpPT(ssWZ,ES3c);...eval(ES3c);..}cat ch (e)..{...wscript.quit();}... File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: wscript.exe PID: 321 Parent PID: 244 General Start time: 1:43:4 Start date: 1/02/2018 Path: C:\Windows\System32\wscript.exe Wow4 process (32bit): false Commandline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\maintools.js' Imagebase: 0x30000 File size: bytes MD hash: D4EAC8B818A8DF204A Has administrator privileges: true Programmed in: C, C++ or other language Copyright Joe Security LLC 2018 Page of 10

10 Reputation: high Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 10 of 10