ID: Sample Name: oq5wdjgk2r.exe Cookbook: default.jbs Time: 20:25:47 Date: 22/11/2017 Version:

Transcription

1 ID: 388 Sample Name: oq5wdjgk2r.exe Cookbook: default.jbs Time: 20:25:4 Date: 22/11/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: Spreading: System Summary: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Simulations Behavior and APIs Antivirus Detection Initial Sample Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: ntvdm.exe PID: 3120 Parent PID: 284 General File Activities File Created File Deleted File Written Disassembly Code Analysis Copyright Joe Security LLC 201 Page 2 of 11

3 Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 388 Start time: 20:25:4 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 1s false light oq5wdjgk2r.exe default.jbs Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean1.winexe@1/2@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook Sample launched by virtual dos engine, sample likely has a wrong file extension Copyright Joe Security LLC 201 Page 5 of 11

6 Signature Overview Networking Spreading System Summary Anti Debugging Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Urls found in memory or binary data Spreading: Checks for available system drives (often done to infect USB drives) System Summary: Submission file is bigger than most known malware samples Classification label Creates temporary files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Creates driver files Anti Debugging: Checks if the current process is being debugged Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Simulations Behavior and APIs No simulations Antivirus Detection Copyright Joe Security LLC 201 Page of 11

7 Initial Sample Source Detection Cloud Link oq5wdjgk2r.exe 2% virustotal Browse No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshot Copyright Joe Security LLC 201 Page of 11

8 Startup System is w cleanup ntvdm.exe (PID: 3120 cmdline: 'C:\Windows\system32\ntvdm.exe' -i1 MD5: F51A8C1D220FE0F42DF5EF0DE5D) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp File Type: MD5: SHA1: SHA-25: SHA-512: Malicious: Reputation: ASCII text, with CRLF line terminators 8CFDDB5AA5B4F34BCD4F013B 1E3802F435BFF25ADFFE0221B2B1188C0E EE021C3E025B8480A240EAF28C385F8C52C5A08ACC35D3C 44CC0AA0CDAD4BCE43415B3E238BDFCCA0FA8FFFF11FADDCAECCC33358D2D45044F44EB5833ED2E D045FC03BFADBB44421 false moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp File Type: MD5: SHA1: SHA-25: DOS batch file, ASCII text, with CRLF line terminators 4C31DEA38FAEEF453BDC0AB4AB 08C82DA03522D8E18A3F824385A5A05 0D1C23ECA5BDDAD1ECCC42C032CD8FF424AFCFEE5D085D3FFDFD Copyright Joe Security LLC 201 Page 8 of 11

9 C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp SHA-512: Malicious: Reputation: BF05F553C28D45CFBD5DD CDAC0238C2424E52224D3ED51B5FF30CD4D80D04FFEF1D 8C8230E4BF4B8224F42CDD5 false moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: TrID: File name: data oq5wdjgk2r.exe File size: 228 MD5: SHA1: SHA25: SHA512: File Content Preview: c815c0e3884dec fff 484f5c2b440cad8cd0bea382d8235ecf1 abf0dc1dd54ed2884d11811af5eb3b3d844b 2e81c81bbb8adde 8db12883d3234d511f0e3f3c3bd24bf31f5c2a8d5ef845 de35f258205bfd518acf31f2dcae8e5cbb4431c24fd 8bd45e1c53ebc545b5e81 LASTLINE PROCESS DUMP INFO...*...b..Z..pro cess_snapshots_2.tar...,i...b.uc.}.;_ d...d...yd...n.w..z.t3...?...3..?...^...?..?...?...v...j)g..' IH+...'..._...]... File Icon Network Behavior No network behavior found Code Manipulations Statistics Copyright Joe Security LLC 201 Page of 11

10 System Behavior Analysis Process: ntvdm.exe PID: 3120 Parent PID: 284 General Start time: 20:2:1 Start date: 22/11/201 Path: C:\Windows\System32\ntvdm.exe Wow4 process (32bit): false Commandline: 'C:\Windows\system32\ntvdm.exe' -i1 Imagebase: 0x55c0000 File size: bytes MD5 hash: F51A8C1D220FE0F42DF5EF0DE5D Programmed in: C, C++ or other language Reputation: moderate File Activities File Created File Path Access Attributes Options Completion Count C:\MSDOS.SYS C:\IO.SYS C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp read attributes and synchroniz e read attributes and synchroniz e read attributes and synchroniz e and generic read read attributes and synchroniz e and generic read readony and hidden and system readony and hidden and system normal normal synchronous io non alert and n on directory file synchronous io non alert and n on directory file synchronous io non alert and n on directory file synchronous io non alert and n on directory file Source Address Symbol success or wait 1 EDEFEF CreateFileA success or wait 1 EDEA03 CreateFileA success or wait 1 EE11A GetTempFileNameA success or wait 1 EE11A GetTempFileNameA File Deleted File Path Completion Count Source Address C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp success or wait 1 EEDB DeleteFileA C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp success or wait 1 EEFA DeleteFileA Symbol File Written File Path Offset Length Value Ascii Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown 13 4 f 3 3d 8 8 2c 20 5 d 2 Source Address Symbol dos=high, umb success or wait 3 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown 2 0d 0a.. success or wait 3 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown d device= success or wait 1 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown 43 3a 5c 5 e 4 f 3 C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown 4 3 f 5 e 4 2 3d c c 43 3a 5c 5 e 4 f 3 5c d c 3 f 5 e 4 2 2e 3 3 0d 0a C:\Windows success or wait 1 EE32 WriteFile country=001,43,c:\windo ws\system32\country.sys.. success or wait 1 EE32 WriteFile Copyright Joe Security LLC 201 Page of 11

11 File Path Offset Length Value Ascii Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown c c 3d 43 3a 5c 5 e 4 f 3 5c d c 3 f d d 1 e 4 2e 3 f d 20 2f a 5c 5 e 4 f 3 5c d shell=c:\windows\system 32\command.com /p C:\Windows\system32 success or wait 1 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs203.tmp unknown 2 0d 0a.. success or wait 1 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp unknown f 20 off success or wait 5 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp unknown 2 0d 0a.. success or wait 5 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp unknown 3 c 8 20 lh success or wait 3 EE32 WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs208.tmp unknown 43 3a 5c 5 e 4 f 3 Source Address C:\Windows success or wait 3 EE32 WriteFile unknown unknown 1 invalid handle 34 EE0D3 WriteFile Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11