ID: Cookbook: urldownload.jbs Time: 20:47:24 Date: 09/12/2017 Version:

Transcription

1 ID: 0 Cookbook: urldownload.jbs Time: 20:4:24 Date: 0/12/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior TCP Packets UDP Packets DNS Queries DNS Answers Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 2 Parent PID: 12 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 2 of

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 0 Start time: 20:4:24 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 1s false light urldownload.jbs 001/FlashPlayer.jse Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean1.win@1/0@/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page of

4 Strategy Score Range Further Analysis Required? Threshold 4 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice All domains contacted by the sample do not resolve. Likely the sample is an old dropper which does no longer work Signature Overview Copyright Joe Security LLC 201 Page 4 of

5 Networking System Summary HIPS / PFW / Operating System Protection Evasion Click to jump to signature section Networking: Performs DNS lookups Urls found in memory or binary data Tries to resolve domain names, but no domain seems valid (expired dropper behavior) System Summary: Classification label HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches No Antivirus matches Domains Source Detection Cloud Link ieng4gethifi.org 2% virustotal Browse Copyright Joe Security LLC 201 Page of

6 Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshot Copyright Joe Security LLC 201 Page of

7 Startup System is w wget.exe (PID: 2 cmdline: wget -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' MD: 4C04BFEFBB0EBAD1AF4) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection ieng4gethifi.org unknown unknown false 2%, virustotal, Browse Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page of

8 Static File Info No static file info Network Behavior TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: Dec, :4: DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Dec, :4: xf4 Standard query Dec, :4: xf4 Standard query Dec, :4: xf4 Standard query Dec, :4: xf4 Standard query Dec, :4: xf4 Standard query DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Dec, xf4 Name error () ieng4gethifi.org none none A (IP address) IN (0x0001) 20:4: Dec, xf4 Name error () ieng4gethifi.org none none A (IP address) IN (0x0001) 20:4: Dec, xf4 Name error () ieng4gethifi.org none none A (IP address) IN (0x0001) 20:4: Dec, xf4 Name error () ieng4gethifi.org none none A (IP address) IN (0x0001) 20:4: Copyright Joe Security LLC 201 Page of

9 Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Dec, xf4 Name error () ieng4gethifi.org none none A (IP address) IN (0x0001) 20:4: Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 2 Parent PID: 12 General Start time: 20:4:22 Start date: 0/12/201 Path: Wow4 process (2bit): Commandline: Imagebase: File size: MD hash: Programmed in: Reputation: C:\Windows\System2\wget.exe false wget -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --useragent='mozilla/.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' eng4gethifi.org/ / /flashplayer.jse' 0x4a bytes 4C04BFEFBB0EBAD1AF4 C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page of