ID: Sample Name: Payment_Remittance#.xps Cookbook: defaultwindowsofficecookbook.jbs Time: 01:35:46 Date: 20/09/2018 Version: 23.0.

Transcription

1 ID: 25 Sample Name: Payment_Remittance#.xps Cookbook: defaultwindowsofficecookbook.jbs Time: 01:35:4 Date: 20/09/201 Version:

2 Table of Contents Table of Contents Analysis Report Payment_Remittance#.xps Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Anti Debugging: HIPS / PFW / Operating System Protection Evasion: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Thumbnails Startup Created / dropped Files Domains and IPs Contacted Domains URLs from Memory and Binaries Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis xpsrchvw.exe PID: 3300 Parent PID: 302 Copyright Joe Security LLC 201 Page 2 of

3 General File Activities File Created File Read Registry Activities Key Created Key Value Created Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Payment_Remittance#.xps Overview General Information Joe Sandbox Version: Analysis ID: 25 Start date: Start time: 01:35:4 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: CloudBasic 0h 2m 53s light Payment_Remittance#.xps defaultwindowsofficecookbook.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: EGA Information: HDC Information: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.winxps@1/9@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Failed Failed Adjust boot time Found application associated with file extension:.xps Found Word or Excel or PowerPoint or XPS Viewer Simulate clicks Number of clicks 0 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Copyright Joe Security LLC 201 Page 5 of 14

6 Signature Overview Networking System Summary Hooking and other Techniques for Hiding and Protection Anti Debugging HIPS / PFW / Operating System Protection Evasion Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Classification label Creates temporary files Reads software policies Uses an in-process (OLE) Automation server Executable creates window controls seldom found in malware Found window with many clickable UI elements (buttons, textforms, scrollbars etc) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Behavior Graph Copyright Joe Security LLC 201 Page of 14

7 Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Behavior Graph ID: 25 Sample: Payment_Remittance#.xps Startdate: 20/09/201 Architecture: WINDOWS Score: 0 started Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious xpsrchvw.exe 4 23 Simulations Behavior and APIs Time Type Description 01:3:42 API Interceptor 1x Sleep call for process: xpsrchvw.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link Payment_Remittance#.xps 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of 14

8 Source Detection Scanner Label Link schemas.microsoft. 0% virustotal Browse schemas.microsoft. 0% Avira URL Cloud safe % virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe % virustotal Browse 0% Avira URL Cloud safe schemas.microsof 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 201 Page of 14

9 Startup System is w cleanup xpsrchvw.exe (PID: 3300 cmdline: '' 'C:\Users\user\Desktop\Payment_Remittance#.xps' 59B20D390B43B13B23A1F9CC3DD) Created / dropped Files C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.014zspxaa3impmiduo_p5d.tmp Size (bytes): 4091 Entropy (bit): PNG image data, 15 x 11, -bit/color RGBA, non-interlaced 0CA51E49B553151D9F55019CA0 9D13CC40EE1EE2ED141CBBEA92A01 AE3EDD2345EAD29A10CB4EF351B2333B50911D1AC9322FC9BEF109 FA5C9B22FBAD352A03B0D23B1D01FF2FB255D9252B1AF395AFCB5A4F9BFF1AC05CE2E1 AA0A93A3522D010FFAAA159395D00D9AB Copyright Joe Security LLC 201 Page 9 of 14

10 C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.014zspxaa3impmiduo_p5d.tmp low C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.0t1_pbju1g2ha9505q1s3bg.tmp Size (bytes): 5404 TrueType font data Entropy (bit): E4C5A39C00A9AAC0B955DE24AF35 05DA9FB1BA34B041534CEE1E42D32D 1E0EF0F9ECEC99D1AB2F4FD0420C21542B4540E90F0ABBF9E2CA0 35B2302FDAFEDCA3011FE32F0A54F0B5FBAB01BD3DEBAFF1FBE9292F94D140E394B9E200533F5 05ECADF41EDD3E55A90F34BB0FEAFDB2A low C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.13mrluea2b9vp2gna15tzic.tmp Size (bytes): 1140 Entropy (bit): Little-endian UTF-1 Unicode text, with very long lines, with CRLF, CR line terminators F CD2CD32331C0DFF9C59 02CE FEC34E554B B 3E315BFD040FF2E54D5AD022C4F23A549AB943CF9A4FF3F9D51C D52D1A0F90B515ED5D52001E CF3B0EE5BF59EAB025E953FD3215FA11E0B4F5B0E0551 0BA9559BED14FF0BF22CDE2EEC359 low C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.cvf2y_jmzfagfenffg 5yn3c.tmp Size (bytes): 22 Entropy (bit): Little-endian UTF-1 Unicode text, with CRLF, CR line terminators 292F02B420E1FCDCFA4A9014 F4D03BE0B49CDA AEF45B50CEDF B21530C54CAEC2E54CDD31BCE5EDD24921A C04CBE C22BF155D2E3499BD2ECD1FE4301D2FD954FDE15B5BF103FCF2D5F235BD9A30DAEA2C 0EA05B513D4134B3D01BE3F52FA moderate, very likely benign file C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.dgews4v2q43lbk1b_dk4ocvd.tmp Size (bytes): 3 Entropy (bit): Little-endian UTF-1 Unicode text, with CRLF, CR line terminators 0A9EBBCAFF233000B05DE1B1 F0CB91CC05B00AEF90BFD1C093E4FB A00CA3E3C02C3C3DDB5DA4A322FFC20CA2AAA93D4B0A51FD0D32 EAAB341995C5CAAC31013EAE03CAB3A1BEE9DAFEBF0CBAC3DBED32C452B2E9EF4AB5F9 3A0B9BF9DAB24F3C4F1B EB0E395 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.ffpolsgr42o5rqfowaqo9ywb.tmp TrueType font data Size (bytes): Entropy (bit): B09F9CC5B921DD53A3EE2135A2 Copyright Joe Security LLC 201 Page 10 of 14

11 C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.ffpolsgr42o5rqfowaqo9ywb.tmp 9B52F4AD05A4FA15EF522DE4AC00B2B059 AAA1B515E0D590FCCBFCFA4521EDEFC2B02DF93BE1A90193BA34 CD5FA2D9B923E35A955E15FEBDD4E09FDDF9FCF19CCD3AEFA4D921322FC949AD19A111320CD 19DA235213FAB4C10DA1EDDF4EB431C3 low C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.g5_c55xx53cq3ax5cfu9hh.tmp Size (bytes): 320 Entropy (bit): Little-endian UTF-1 Unicode text, with CRLF, CR line terminators 9B5B5CD F925AE1B 2B B05BF91A3CFA232AB2AE93A 2CB2AAA3B03CECC1D40B229F1EF29FFB1FCADF2A2C104FD45D0393FC 2FB0EEFDFB95BD14A2A3A2B494E1FD324B54E503DF13BB4FFE4A1F5BFE9330F9EF3FFE1CB0B0 F452AFC4DF3C42113FA4DDCF304A2EDE0 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.ltyga_jfopwb4iponfp_e2gog.tmp Size (bytes): 15 Entropy (bit): Little-endian UTF-1 Unicode text, with CRLF, CR line terminators 131E29DFDB594EF3DEDBCAEFAF3A 29ABE32C1924A FA51C5EF5 D2323BBF3D2B3B1B99CCD2FDC0CD4FA355A3D9AB39E4510D44F050 D3A451F4B0E051534C3F3A34CA14D104315BDFDD1C0AC559B3C2D09522A5ADD9BFD240C39F139B DDA22529AFB5DD9C51FD4C25CA19ACE9 low C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.mo1ajfdl9leazb4t4cblvoh.tmp Size (bytes): 2410 Entropy (bit): PNG image data, 4 x 15, -bit/color RGBA, non-interlaced 9B351D590EB5F90F19FA2F2C9 34D DBB220DF51D2DCC0 435DAEAF2F0E4BAA995ABFF DD2F A03BF2A 9A039549DDD2D1DB521CCD004AA9523E DEDF5C0DDAC44C2B134A43BA3BB40EE 94013D ADAB0AFE9B low Domains and IPs Contacted Domains No contacted domains info URLs from Memory and Binaries Name Source Malicious Antivirus Detection Reputation schemas.microsoft. xpsrchvw.exe, C sdmp 0%, virustotal, Browse Avira URL Cloud: safe unknown schemas.m xpsrchvw.exe, C sdmp high Copyright Joe Security LLC 201 Page 11 of 14

12 Name Source Malicious Antivirus Detection Reputation xpsrchvw.exe, sdmp %, virustotal, Browse Avira URL Cloud: safe unknown xpsrchvw.exe, sdmp Avira URL Cloud: safe unknown xpsrchvw.exe, sdmp %, virustotal, Browse Avira URL Cloud: safe unknown schemas.microsof xpsrchvw.exe, C sdmp Avira URL Cloud: safe unknown Contacted IPs No contacted IP infos Static File Info General File type: Microsoft OOXML Entropy (bit): TrID: XML Paper Specification (2504/1).% ZIP compressed archive (4004/1).32% File name: File size: SHA25: SHA5: Payment_Remittance#.xps e ce c2f99d95d91 3ff152eabe3bfe3f9cee54e1521cb4f5c 4d0fb5b33d0f14fad c22cb443c032 e2429d2ad 39ce142fa2dc2feb9e52ecc492a02c0d23c2f1c5e3 3eb1aba0e92b5cd195c25d04c4be0a3c2c410ed930 b055c5e942d1c139eb541dd93319b File Content Preview: PK...!. osth...'...[content_types].xml...( File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Copyright Joe Security LLC 201 Page of 14

13 Analysis xpsrchvw.exe PID: 3300 Parent PID: 302 General Start time: 01:3:42 Start date: 20/09/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' 'C:\Users\user\Desktop\Payment_Remittance#.xps' 0xa bytes 59B20D390B43B13B23A1F9CC3DD true C, C++ or other language moderate File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC C:\Users C:\Users\user C:\Users\user\AppData C:\Users\user\AppData\LocalLow C:\Users\user\AppData\LocalLow\Temp C:\Users\user\AppData\LocalLow\Temp\Microsoft C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.dgews4 v2q43lbk1b_dk4ocvd.tmp read attributes generic write Source Address Symbol object path not found 1 B2 SHCreateDirectoryExW object name collision 1 B2 SHCreateDirectoryExW object name collision 1 B2 SHCreateDirectoryExW object name collision 1 B2 SHCreateDirectoryExW object name collision 1 B2 SHCreateDirectoryExW success or wait 1 B2 SHCreateDirectoryExW success or wait 1 B2 SHCreateDirectoryExW success or wait 1 B2 SHCreateDirectoryExW temporary non alert non directory file random access success or wait 1 B13 CreateFileW Copyright Joe Security LLC 201 Page 13 of 14

14 File Path Access Attributes Options Completion Count C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.13mrl uea2b9vp2gna15tzic.tmp C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.ltyga_ jfopwb4iponfp_e2gog.tmp C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.0t1_p bju1g2ha9505q1s3bg.tmp C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.ffpols gr42o5rqfowaqo9ywb.tmp C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.014zsp xaa3impmiduo_p5d.tmp C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.mo1ajf dl9leazb4t4cblvoh.tmp read attributes generic write read attributes generic write read attributes generic write read attributes generic write read attributes generic write read attributes generic write temporary temporary temporary temporary temporary temporary non alert non directory file random access non alert non directory file random access non alert non directory file random access non alert non directory file random access non alert non directory file random access non alert non directory file random access Source Address Symbol success or wait 1 B13 CreateFileW success or wait 1 B13 CreateFileW success or wait 1 B13 CreateFileW success or wait 1 B13 CreateFileW success or wait 1 B13 CreateFileW success or wait 1 B13 CreateFileW File Path Offset Length Value Ascii Completion Count Source Address Symbol File Read File Path Offset Length Completion Count Source Address Symbol C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.014zspxaa3impmiduo_p5d.tmp unknown 22 success or wait 1 A1B1 ReadFile C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.014zspxaa3impmiduo_p5d.tmp unknown 1 success or wait 1 A1B1 ReadFile C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.mo1ajfdl9leazb4t4cblvoh.tmp unknown 22 success or wait 1 A1B1 ReadFile C:\Users\user\AppData\LocalLow\Temp\Microsoft\OPC\DDT.mo1ajfdl9leazb4t4cblvoh.tmp unknown 1 success or wait 1 A1B1 ReadFile Registry Activities Key Created Key Path Completion Count Source Address Symbol HKEY_USERS\Software\Microsoft\XPSViewer success or wait 1 AB5DD RegCreateKeyExW HKEY_USERS\Software\Microsoft\XPSViewer\Common success or wait 1 A929A RegCreateKeyExW HKEY_USERS\Software\Microsoft\XPSViewer\Common\DRM success or wait 1 A929A RegCreateKeyExW HKEY_USERS\Software\Microsoft\XPSViewer\View success or wait 1 A929A RegCreateKeyExW Key Value Created Key Path Name Type Data Completion Count Source Address Symbol HKEY_USERS\Software\Microsoft\XPSViewer\View PrevPagesToCache dword 2 success or wait 1 A9319 RegSetValueExW HKEY_USERS\Software\Microsoft\XPSViewer\View NextPagesToCache dword 10 success or wait 1 A9319 RegSetValueExW HKEY_USERS\Software\Microsoft\XPSViewer\View HoldAllMaxPagesToCach e dword 20 success or wait 1 A9319 RegSetValueExW HKEY_USERS\Software\Microsoft\XPSViewer FindOptions dword 1 success or wait 1 A9319 RegSetValueExW Key Path Name Type Old Data New Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14