ID: Sample Name: pccfvhbyjn.sample Cookbook: default.jbs Time: 13:15:27 Date: 18/01/2018 Version:

Transcription

1 ID: Sample Name: pccfvhbyjn.sample Cookbook: default.jbs Time: 13::27 Date: 1/01/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Key, Mouse, Clipboard, Microphone and Screen Capturing: Networking: Boot Survival: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Resources Imports Version Infos Copyright Joe Security LLC 201 Page 2 of

3 Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: pccfvhbyjn.exe PID: 3092 Parent PID: 244 File Activities Registry Activities Analysis Process: explorer.exe PID: 3144 Parent PID: 204 File Activities File Created Analysis Process: explorer.exe PID: 3172 Parent PID: 54 Analysis Process: pccfvhbyjn.exe PID: 3200 Parent PID: 3172 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 13::27 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 41s false light pccfvhbyjn.sample (renamed file extension from sample to exe) default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 7 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal52.spyw.winexe@5/0@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Warnings: Failed Failed Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: pccfvhbyjn.exe, pccfvhbyjn.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 201 Page 5 of

6 Signature Overview Signature Overview AV Detection Networking Boot Survival Key, Mouse, Clipboard, Microphone and Screen Capturing System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for submitted file Key, Mouse, Clipboard, Microphone and Screen Capturing: Installs a global keyboard hook Networking: Urls found in memory or binary data Boot Survival: Creates an autostart registry key System Summary: PE file contains a COM descriptor data directory Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols Classification label Creates files inside the user directory Launches a second explorer.exe instance PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Spawns processes Uses an in-process (OLE) Automation server PE file contains strange resources Sample file is different than original file name gathered from version info HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Copyright Joe Security LLC 201 Page 6 of

7 Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging Checks for debuggers (devices) Malware Analysis System Evasion: May sleep (evasive loops) to hinder dynamic analysis Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Queries the volume information (name, serial number etc) of a device Behavior Graph Behavior Graph ID: Sample: pccfvhbyjn.sample Startdate: 1/01/201 Architecture: WINDOWS Score: 52 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Number of created Registry Values Antivirus detection for submitted file started started started Number of created Files Visual Basic Delphi Java explorer.exe pccfvhbyjn.exe explorer.exe.net C# or VB.NET C, C++ or other language Is malicious started Installs a global keyboard hook pccfvhbyjn.exe Installs a global keyboard hook Simulations Copyright Joe Security LLC 201 Page 7 of

8 Behavior and APIs Time Type Description 13::1 API Interceptor 4x Sleep call for process: explorer.exe modified from: 60000ms to: 0ms 13::1 Autostart Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run keyl C:\Users\user\Desktop\pcCFvhbyjn.exe Antivirus Detection Initial Sample Source Detection Cloud Link pccfvhbyj.exe 3% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context Copyright Joe Security LLC 201 Page of

9 ASN No context Dropped Files No context Screenshot Startup System is w7 pccfvhbyjn.exe (PID: 3092 cmdline: 'C:\Users\user\Desktop\pcCFvhbyjn.exe' MD5: 0E6A3D62A34C39442FA021C7A92D) explorer.exe (PID: 3144 cmdline: explorer.exe C:\Users\user\Desktop\pcCFvhbyjn.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935) explorer.exe (PID: 3172 cmdline: C:\Windows\explorer.exe /factory,{75dff2b c06-abb-676a7b00b24b} -Embedding MD5: 6DDCA324434FFA506CF7DC4E51DB7935) pccfvhbyjn.exe (PID: 3200 cmdline: 'C:\Users\user\Desktop\pcCFvhbyjn.exe' MD5: 0E6A3D62A34C39442FA021C7A92D) cleanup Created / dropped Files No created / dropped files found Copyright Joe Security LLC 201 Page 9 of

10 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Entropy (bit): PE32 executable (GUI) Intel 036 Mono/.Net assemb ly, for MS Windows TrID: Win32 Executable (generic) a (002005/4) 99.23% Generic CIL Executable (.NET, Mono, etc.) (73296/5) 0.73% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: pccfvhbyj.exe File size: 1132 MD5: SHA1: SHA256: SHA512: File Content Preview: 0e6a3d62a34c39442fa021c7a92d 3504aeff2d1a5b79be06003be2e23f3aad2f1 d2da bd26d2ef0afb7af16a aaedad 406ae009a3ecb9 2dfb12b7525a3e321fdcb5d2a9235f9b5af7fcbb 14c5651b24b5e259993b0f7b9175f9c6add5a0f6aad f2b1e56d3b4e0e40f196c74 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l...!z...*...h......`...@ @... File Icon Static PE Info Entrypoint: 0x404ce Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x5A219D7F [Fri Dec 1 1:20: UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Copyright Joe Security LLC 201 Page of

11 Import Hash: f34d5f2d4577ed6d9ceec516c1f5a744 Entrypoint Preview Instruction jmp dword ptr [ h] Copyright Joe Security LLC 201 Page 11 of

12 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x40 0x4b.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x6000 0x1ba.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x47e 0x1c.text IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x200 0x4.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x2d4 0x2a00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x6000 0x1ba 0x1c00 False data IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 12 of

13 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.reloc 0x xc 0x200 False dbase IV DBT of \320.DBF, blocks size 12, next free block index IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x6460 0x2 data RT_ICON 0x16c 0x422 FoxPro FPT, blocks size 0, next free block index RT_ICON 0x1aeb0 0x25a dbase IV DBT of `.DBF, blocks size 4, block length 9216, next free block index 40 RT_ICON 0x1d45 0xa data RT_ICON 0x1e500 0x46 GLS_BINARY_LSB_FIRST RT_GROUP_ICON 0x1e96 0x4c MS Windows icon resource - 5 icons, 256-colors RT_VERSION 0x61f0 0x26c data RT_MANIFEST 0x1e9b 0x1ea XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators Imports DLL mscoree.dll Import _CorExeMain Version Infos Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright 2017 Assembly Version InternalName KeyLogger.exe FileVersion ProductVersion FileDescription OriginalFilename KeyLogger.exe Network Behavior No network behavior found Code Manipulations Statistics Behavior pccfvhbyjn.exe explorer.exe explorer.exe pccfvhbyjn.exe Copyright Joe Security LLC 201 Page 13 of

14 Click to jump to process System Behavior Analysis Process: pccfvhbyjn.exe PID: 3092 Parent PID: 244 Start time: 13:: Start date: 1/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\pcCFvhbyjn.exe false 'C:\Users\user\Desktop\pcCFvhbyjn.exe' 0x63b bytes 0E6A3D62A34C39442FA021C7A92D.Net C# or VB.NET low File Activities File Path Access Attributes Options Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Analysis Process: explorer.exe PID: 3144 Parent PID: 204 Start time: 13::1 Start date: 1/01/201 Path: C:\Windows\explorer.exe Wow64 process (32bit): false Commandline: explorer.exe C:\Users\user\Desktop\pcCFvhbyjn.exe Imagebase: 0x774a0000 File size: bytes MD5 hash: 6DDCA324434FFA506CF7DC4E51DB7935 Copyright Joe Security LLC 201 Page 14 of

15 Programmed in: Reputation: C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\AppData\Local\Microsoft\Windows\Caches read data or list directory and synchronize normal Source Address Symbol directory file and object name collision 1 12D72 ILCreateFromPathW synchronous io non alert and open for backup ident and open reparse point Analysis Process: explorer.exe PID: 3172 Parent PID: 54 Start time: 13::1 Start date: 1/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\explorer.exe false C:\Windows\explorer.exe /factory,{75dff2b c06-abb-676a7b00b24b} -Embedding 0x774a bytes 6DDCA324434FFA506CF7DC4E51DB7935 C, C++ or other language low Analysis Process: pccfvhbyjn.exe PID: 3200 Parent PID: 3172 Start time: 13::1 Start date: 1/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\pcCFvhbyjn.exe false 'C:\Users\user\Desktop\pcCFvhbyjn.exe' 0x73e bytes 0E6A3D62A34C39442FA021C7A92D.Net C# or VB.NET low Disassembly Code Analysis Copyright Joe Security LLC 201 Page of