ID: Sample Name: image002 Cookbook: default.jbs Time: 18:19:28 Date: 18/05/2018 Version:

Transcription

1 ID: 0309 Sample Name: image002 Cookbook: default.jbs Time: 1:19:2 Date: 1/05/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: mspaint.exe PID: 332 Parent PID: 3312 General File Activities Registry Activities Copyright Joe Security LLC 201 Page 2 of 11

3 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 0309 Start time: 1:19:2 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 23s false light image002 (renamed file extension from none to emf) default.jbs Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.winemf@1/0@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): svchost.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 201 Page 5 of 11

6 Signature Overview System Summary Anti Debugging HIPS / PFW / Operating System Protection Evasion Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section System Summary: Classification label Reads ini files Reads software policies Uses Rich Edit Controls HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: Found a high number of Window / User specific system calls (may be a loop to detect user behavior) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page of 11

7 Hide Legend ID: 0309 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: image002 Startdate: 1/05/201 Architecture: WINDOWS Score: 1 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started mspaint.exe 2 Simulations Behavior and APIs Time Type Description 1:19:2 API Interceptor 1190x Sleep call for process: mspaint.exe modified Antivirus Detection Initial Sample No Antivirus matches No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of 11

8 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshots Copyright Joe Security LLC 201 Page of 11

9 Startup System is w cleanup mspaint.exe (PID: 332 cmdline: 'C:\Windows\system32\mspaint.exe' 'C:\Users\user\Desktop\image002.emf' MD5: E9295DE2A9FDE54FEAB4FE41DF1CA) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of 11

10 Static File Info General File type: Entropy (bit): Windows Enhanced Metafile (EMF) image data version 0x000 TrID: Windows Enhanced Metafile (4012/2) 0.00% File name: File size: 4502 MD5: SHA1: SHA25: SHA512: File Content Preview: image002.emf cda2da2eb52ee50219bca eaed9afc9da520ce40ff9543a ea00f3b4ff93bc1ea90d13b95f3e499c14940ac 925caa2a4fb9dd defd32193b53e232da4201ff449dedce1ab5d1 953ce5a235b2dca21f1f2d2dfbabf42e5f4a40399 f5a34b592a3411cebe5f22fd02f5...l...g...#...?... File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: mspaint.exe PID: 332 Parent PID: 3312 General Start time: 1:19:2 Start date: 1/05/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\mspaint.exe false 'C:\Windows\system32\mspaint.exe' 'C:\Users\user\Desktop\image002.emf' 0x bytes E9295DE2A9FDE54FEAB4FE41DF1CA true C, C++ or other language low Copyright Joe Security LLC 201 Page of 11

11 File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11