ID: Sample Name: Coss, Daniel.vcf Cookbook: default.jbs Time: 15:16:47 Date: 21/06/2018 Version:

Transcription

1 ID: 6467 Sample Name: Coss, Daniel.vcf Cookbook: default.jbs Time: 15:16:47 Date: 21/06/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Key, Mouse, Clipboard, Microphone and Screen Capturing: Networking: Boot Survival: System Summary: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis OUTLOOK.EXE PID: 340 Parent PID: 24 General File Activities File Created File Written Copyright Joe Security LLC 201 Page 2 of 15

3 Registry Activities Key Created Key Value Created Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 15

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 6467 Start time: 15:16:47 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m 10s light Coss, Daniel.vcf default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean2.winvcf@1/11@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.vcf Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: OUTLOOK.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 201 Page 4 of 15

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 201 Page 5 of 15

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Mouse, Clipboard, Microphone and Screen Capturing Key, Networking Survival Boot Summary System Analysis System Evasion Malware Hooking and other Techniques for Hiding and Protection Click to jump to signature section Copyright Joe Security LLC 201 Page 6 of 15

7 Key, Mouse, Clipboard, Microphone and Screen Capturing: Creates a window with clipboard capturing capabilities Networking: Urls found in memory or binary data Boot Survival: Creates or modifies windows services System Summary: Creates files inside the system directory Deletes files inside the Windows folder Classification label Creates files inside the user directory Creates temporary files Reads software policies Uses an in-process (OLE) Automation server Writes ini files Checks whether correct version of.net is installed Executable creates window controls seldom found in malware Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Malware Analysis System Evasion: Checks the free space of harddrives Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 7 of 15

8 Hide Legend ID: 6467 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: Coss, Daniel.vcf Startdate: 21/06/201 Architecture: WINDOWS Score: 2 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started OUTLOOK.EXE 5 26 Simulations Behavior and APIs Time Type Description 15:17:44 API Interceptor 3x Sleep call for process: OUTLOOK.EXE modified Antivirus Detection Initial Sample Detection Scanner Label Link Coss, Daniel.vcf 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of 15

9 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 15

10 Startup System is w7 OUTLOOK.EXE (PID: 340 cmdline: '' /v 'C:\Users\user\Desktop\Coss, Daniel.vcf' ED2BEEE00B4D1DF1B6252EDC0D3) cleanup Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging\firstrun.log Size (bytes): 143 Entropy (bit): diff output, ASCII text, with CRLF line terminators C73FA43DC03D5A4D4377CE E023A10FED5ED34FBBEE7DE1FF4F3A1F 4DF7A60D2AB4B5254E1275E33ED2A1716F3FE0A7B4B4BE6D12B 4E C7110F420155B6EFD3A5CEDA6FABF3CECC6203D17CCEE76E426DACCDCB416057C 232DFABD53414F53D33676E27EEEB0540BE low Copyright Joe Security LLC 201 Page 10 of 15

11 C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT data Size (bytes): Entropy (bit): ACF4C7A77CFB0DFBBD34D6D4 5B75D7C40D14DEAD23F66B2C14C37EB A114B1606B2B6F5B41204B3CB5B0BA653CB C1C5126A 2BD4D51CFBE20A66AA5BAF1DE6B0673E2476A3FD1F20EAC21145C D7E4CD44F BEE 2DDAFD0353AD34B3142C201E4140E5 low C:\Users\user\AppData\Local\Microsoft\Outlook\Outlook.sharing.xml.obi Size (bytes): 15 XML document text Entropy (bit): F6F44B02CCD4A7B03437B7B363451C 4A751C34D163B2C4BF76A056247DE42A CD1A7643F002A632E1E2E51FDC12FAADBF0C7D14514A65FF0BE2A2F0 F4A40DF52BE0DF6FDBB6AC61A4EBD16AC6D6BC57EBB2C1CD63C11E16D25EC650C050F33664DFD33A AD434FDBAF667F EC4BA2A1744ED14 low C:\Users\user\AppData\Local\Microsoft\Outlook\mapisvc.inf Size (bytes): 1122 Entropy (bit): Little-endian UTF-16 Unicode text, with CRLF, CR line terminators 4DD6CAE43CE26B2C357FCD76 E600544DF0250DA7D6345CE6EE50DA11C0355 7BFE1F361E2B4FB4D61FBF5EF772FBE4DA42DBD32201C2CCE540DBD1A C1B322C00F5BE0AD166DDCFEC1461FB25A17607D6140FD F3AF310A3E6DA37D16000D4ACB BCD5236F03C3C7F376AEBA7A4B32F31 moderate, very likely benign file C:\Users\user\AppData\Local\Microsoft\Outlook\~NEW~.sharing.xml.obi Size (bytes): 15 XML document text Entropy (bit): F6F44B02CCD4A7B03437B7B363451C 4A751C34D163B2C4BF76A056247DE42A CD1A7643F002A632E1E2E51FDC12FAADBF0C7D14514A65FF0BE2A2F0 F4A40DF52BE0DF6FDBB6AC61A4EBD16AC6D6BC57EBB2C1CD63C11E16D25EC650C050F33664DFD33A AD434FDBAF667F EC4BA2A1744ED14 low C:\Windows\System32\PerfStringBackup.INI data Size (bytes): 704 Entropy (bit): F606BD E5642C73E7EE11D 11ACC7370C7C426412E4C0732A2EB3AAACC67 CA5C00A1E2E16F2C22D6B6F74FD736E6A62DFE56437E060451BF7D D32A7AE43601ED1D0ED64D2F52F5D6B23DE5F3BEB4F2F473FE67676CC657CF74C61CF1B05C E1A1BE7DC2143D60B51A24C5CB Copyright Joe Security LLC 201 Page 11 of 15

12 C:\Windows\System32\PerfStringBackup.INI moderate, very likely benign file C:\Windows\System32\PerfStringBackup.TMP data Size (bytes): 704 Entropy (bit): F606BD E5642C73E7EE11D 11ACC7370C7C426412E4C0732A2EB3AAACC67 CA5C00A1E2E16F2C22D6B6F74FD736E6A62DFE56437E060451BF7D D32A7AE43601ED1D0ED64D2F52F5D6B23DE5F3BEB4F2F473FE67676CC657CF74C61CF1B05C E1A1BE7DC2143D60B51A24C5CB moderate, very likely benign file C:\Windows\System32\perfc00.dat data Size (bytes): Entropy (bit): D056C5A1C65B41ACF42E71C6FFB FAC63A0ACCDA04B165DACB70EB6FF7A F3BA0BFB3EFED4CB021405D26D1B52EBD25E F434FF24DD EBA3CCF3DF2C3F5F75B7C4145C74F1D030DB674CDBEC23045A60D406B02C0F4BBC1E65310BA DAACB401D35B5EBB17D4035CA1EBCFC moderate, very likely benign file C:\Windows\System32\perfh00.dat data Size (bytes): Entropy (bit): ADCB5552E236244C53641C5E231FC32 6A742DD54F5D74DCBC10DFEC21E44A5EB54 75E74CAF516330F354D1A762A43D1D535C1730C47B3CA D 325DAE20A1C337271FF5A FF2406D43343DB3BF4EAD3BFD2CACD172FBD53EB07D37E3C5DD41D0 C4253EA1FF0D6E74E162FF12EB6C1F120B6 moderate, very likely benign file C:\Windows\inf\Outlook\000\outlperf.ini Size (bytes): 265 ASCII text, with CRLF line terminators Entropy (bit): A717AE66401D1DA76F4BAC1DD0A A30F0CF0161ADDBDD3B04B42FEF651EE4EAE322 EEE2C345FD54FD405BE007F215FC070064E170110C0C7461A C1073CB15ADA4D24CF612A5502CE74AC1EF6FD1BDFDF4EDDD074150B602C534E407AD3166F E34736AE45D36EBBFC2ACFC6C071 moderate, very likely benign file C:\Windows\inf\Outlook\outlperf.h ASCII text, with CRLF line terminators Size (bytes): 551 Entropy (bit): BC71FF7DA14ECA43FA0AD15F72BCB Copyright Joe Security LLC 201 Page 12 of 15

13 C:\Windows\inf\Outlook\outlperf.h CECCD0CFF2DD12AEDE7DE14457D15D BB 4E53702C03A3EEE470FC7EE072CDDC7C1A DD1243DC12A0DA 0CD022D34C1BB00322C3CFA15CC22E3353D42BA55C DC177EA0E7C6644BC2F7B2E36CB5E64 FA37FF05DA6DBA574A330E AB324 moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: vcard visiting card Entropy (bit): TrID: vcard - Business Card (11006/1) % File name: File size: 235 SHA256: SHA512: File Content Preview: Coss, Daniel.vcf 4aa1c7e0527ab424d1d352edd1 aab77aa35533cbb637012de35f543fcb2cc76 2f6c2fc76c42f0ecce0ded6e53a072c32ad61e a5debe757a6d3b bef e2456ecc5fbc52a073cbd0f5e31c243d 5cbdc51d4feac52f32e11c5242bebbbb0dd6fe31 75f53ba0d151eb04fa6feaa2036b BEGIN:VCARD..VERSION:2.1..PRODID:-//Novell Inc//G roupwise X-GWTYPE:USER..FN:Coss, Daniel.. N:Coss;Daniel.. ;INTERNET;PREF:dcoss@valley health.com..uid:56b400-0e-0000-f0-c5371ef A2EE0..REV: T000630Z..END:VCARD... File Icon Network Behavior No network behavior found Code Manipulations Statistics Copyright Joe Security LLC 201 Page of 15

14 System Behavior Analysis OUTLOOK.EXE PID: 340 Parent PID: 24 General Start time: 15:17:44 Start date: 21/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' /v 'C:\Users\user\Desktop\Coss, Daniel.vcf' 0x2fc bytes ED2BEEE00B4D1DF1B6252EDC0D3 true C, C++ or other language moderate File Activities File Created File Path Access Attributes Options Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging read data or list directory synchronize read data or list directory synchronize read data or list directory synchronize read data or list directory synchronize read data or list directory synchronize Address Symbol normal directory file synchronous io non alert open for backup ident open reparse point success or wait 1 2FC721 SHCreateDirectoryExA normal directory file synchronous io non alert open for backup ident open reparse point object name collision 1 normal directory file synchronous io non alert open for backup ident open reparse point object name collision 1 normal directory file synchronous io non alert open for backup ident open reparse point object name collision 1 normal directory file synchronous io non alert open for backup ident open reparse point object name collision 1 2FC721 SHCreateDirectoryExA 2FC721 SHCreateDirectoryExA 2FC721 SHCreateDirectoryExA 2FC721 SHCreateDirectoryExA File Path Completion Count Address Symbol Old File Path New File Path Completion Count Address Symbol File Written File Path Offset Length Value Ascii Completion Count Address Symbol Copyright Joe Security LLC 201 Page 14 of 15

15 File Path Offset Length Value Ascii Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging\firstrun.log C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging\firstrun.log C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging\firstrun.log C:\Users\HERBBL~1\AppData\Local\Temp\outlook logging\firstrun.log unknown 50 2a 2a 2a e e d d a a a 2a 2a 0d 0a unknown 32 2e 2e 2e c e c 6c e 0d 0a unknown 2 2e 2e 2e c 6f e c 6c e 0d 0a unknown 32 2e 2e 2e e f c f d e 0d 0a *** Starting First Run ( :1:04) ***.....HrPreSplashFirstRun called......hrprelogfirstrun called......updating profiles for MAPI... Address Symbol success or wait 1 2FC7646 WriteFile success or wait 1 2FC7646 WriteFile success or wait 1 2FC7646 WriteFile success or wait 1 2FC7646 WriteFile File Path Offset Length Completion Count Address Symbol Registry Activities Key Created Key Path Completion Count Address HKEY_USERS\Control Panel\MMCPL success or wait 1 2FC6F101 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows Search\Gather success or wait 1 2FFEC5 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows Search\Gather\Windows success or wait 1 2FFEC5 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex success or wait 1 2FFEC5 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex\Protocols success or wait 1 2FFEC5 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex\Protocols\Mapi success or wait 1 2FFEC5 RegCreateKeyExW Symbol Key Value Created Key Path Name Type Data Completion Count HKEY_USERS\Software\Microsoft\ Office\14.0\Outlook\AutoDiscover\RedirectServers HKEY_USERS\Software\Microsoft\ Office\14.0\Outlook\AutoDiscover\RedirectServers HKEY_USERS\Software\Microsoft\Windows Search\Gather\Windows\ SystemIndex\Protocols\Mapi autodiscovers.outlook.com Address Symbol none NU LL success or wait 1 2FC7F106 RegSetValueExA autodiscover.outlook.com none NU LL success or wait 1 2FC7F117 RegSetValueExA OutlookVersionLastIndex ed dword 14 success or wait 1 2FFECA1 RegSetValueExW Key Path Name Type Old Data New Data Completion Count Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 15 of 15