ID: Sample Name: vscdme.exe Cookbook: default.jbs Time: 22:43:24 Date: 22/11/2017 Version:

Transcription

1 ID: 35 Sample Name: vscdme.exe Cookbook: default.jbs Time: 22:43:24 Date: 22//201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Code Manipulations Statistics Copyright Joe Security LLC 201 Page 2 of 12

3 System Behavior Analysis Process: vscdme.exe PID: 309 Parent PID: 2 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 12

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 35 Start time: 22:43:24 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 2s false light vscdme.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal0.evad.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: vscdme.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 12

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 12

6 AV Detection Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for submitted file Data Obfuscation: PE file contains an invalid checksum System Summary: PE file contains a debug data directory Classification label Creates temporary files PE file has an executable.text section and no other executable section Parts of this applications are using VB runtime library.0 (Probably coded in Visual Basic) Reads software policies Sample is known by Antivirus (Virustotal or Metascan) PE file contains strange resources Sample file is different than original file name gathered from version info HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: Contains long sleeps (>= 3 min) May sleep (evasive loops) to hinder dynamic analysis Sample execution stops while process was sleeping (likely an evasion) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Icon mismatch, PE includes an icon from a different legit application in order to fool users Language, Device and Operating System Detection: Copyright Joe Security LLC 201 Page of 12

7 Queries the cryptographic machine GUID Simulations Behavior and APIs Time Type Description 22:45:42 Autostart Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vscdme.vbe Antivirus Detection Initial Sample Source Detection Cloud Link vscdme.exe 43% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Copyright Joe Security LLC 201 Page of 12

8 No context Domains No context ASN No context Dropped Files No context Startup System is w cleanup vscdme.exe (PID: 309 cmdline: 'C:\Users\user\Desktop\vscdme.exe' MD5: F5AB103A4F09CA4F2EF35DE133) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE32 executable (GUI) Intel 03, for MS Windows TrID: Win32 Executable (generic) a ( /4) 99.9% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.00% File name: vscdme.exe File size: MD5: SHA1: SHA25: SHA512: File Content Preview: f5ab103a4f09ca4f2ef35de a2cbc125f1f2fd09bc3192 bb1b2eb325b34a222e3f025233a5c0c4c49c13 e29519b1effb42f9b 0ea1b942a4f5935eb03cf1e1da320fc5205ef ee35cbdca924ffe54afa40e9f3dd24f033f231 3ffad20d4b9cebf2c1e0d10eafa MZ...@...!..L.!Th is program cannot be run in DOS mode...$...o......d...=...rich...pe..l...3..z......$...@... Copyright Joe Security LLC 201 Page of 12

9 File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x text false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x5AFC33 [Sun Nov 19 21:4: UTC] 3f95f35b0dc124f1d9f391 Entrypoint Preview Instruction push h call 0000FDFB91CF3h xor byte ptr [eax], al inc eax add byte ptr [ebx-52h], bh add byte ptr [ecx], dl adc byte ptr [edi-fh], bl dec esp mov ch, 44h cdq sub byte ptr [edx], FFFFFFA3h iretd push ds add dword ptr [eax], eax outsb bound esi, dword ptr [edx+1h] imul edx, dword ptr [ebp+eh], 1h outsd jc 0000FDFB91C90h insd outsb je 0000FDFB91C902h jnc 0000FDFB91C92Ch Copyright Joe Security LLC 201 Page 9 of 12

10 Instruction or eax, h pop es add byte ptr [ebx+ebx+40h], dl add byte ptr [edi], al add al, bh sbb al, byte ptr [eax+00h] pop es add byte ptr [eax ah], bl add byte ptr [eax+1ah], al inc eax add byte ptr [edi], al add al, bl sbb dword ptr [eax+00h], eax add dword ptr [eax], eax add al, byte ptr [eax] xchg eax, esp pop ss inc eax add bh, bh Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x2cd4 0x2.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2b000 0x3e5c.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x2000 0x1a IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x22 0x20 IMAGE_DIRECTORY_ENTRY_IAT 0x1000 0xd0.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x20ac 0x29000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.data 0x2a000 0xb0c 0x1000 False data 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x2b000 0x3e5c 0x3000 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x2b35 0xea data RT_ICON 0x2c200 0xa data RT_ICON 0x2caa 0xc data RT_ICON 0x2d10 0x5 GLS_BINARY_LSB_FIRST Copyright Joe Security LLC 201 Page 10 of 12

11 Name RVA Size Type Language Country RT_ICON 0x2dd 0x4c1 PNG image data, 25 x 25, -bit/color RGBA, noninterlaced RT_ICON 0x33b9c 0x102 data RT_ICON 0x443c4 0x94a data RT_ICON 0x4dc 0xe data RT_ICON 0x x54 data RT_ICON 0x594dc 0x422 dbase IV DBT of \200.DBF, blocks size 4, block length 19, next free block index 40 RT_ICON 0x5d04 0x25a data RT_ICON 0x5fcac 0x10a data RT_ICON 0x0d54 0x9 data RT_ICON 0x1dc 0x4 GLS_BINARY_LSB_FIRST RT_GROUP_ICON 0x1b44 0xca MS Windows icon resource - 14 icons, 4x4, 25-colors RT_VERSION 0x1c10 0x24c data Japanese Japan Imports DLL MSVBVM0.DLL Import vbavartstgt, _CIcos, _adj_fptan, vbavarmove, vbafreevar, vbaend, vbafreevarlist, _adj_fdiv_m4, vbavarfix, _adj_fprem1, vbasetsystemerror, vbahresultcheckobj, _adj_fdiv_m32, _adj_fdiv_m1i, _adj_fdivr_m1i, _CIsin, vbachkstk, EVENT_SINK_AddRef, DllFunctionCall, vbalbound, _adj_fpatan, EVENT_SINK_Release, vbaui1i2, _CIsqrt, EVENT_SINK_QueryInterface, vbaexcepthandler, _adj_fprem, _adj_fdivr_m4, vbavardiv, vbafpexception, _CIlog, vbanew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, vbavartstne, vbai4var, vbavaradd, _CIatan, vbastrmove, _allmul, vbalenvarb, _CItan, _CIexp, vbafreestr Version Infos Description Data Translation 0x04 0x04b0 InternalName Knife4 FileVersion 5.0 ProductName InstrumentS IncorporateD ProductVersion 5.0 FileDescription HOLa Networks LtD. OriginalFilename Knife4.exe Possible Origin Language of compilation system Country where language is spoken Map Japanese Japan Network Behavior No network behavior found Code Manipulations Statistics System Behavior Copyright Joe Security LLC 201 Page of 12

12 Analysis Process: vscdme.exe PID: 309 Parent PID: 2 General Start time: 22:43:1 Start date: 22//201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\vscdme.exe false 'C:\Users\user\Desktop\vscdme.exe' 0x52b bytes F5AB103A4F09CA4F2EF35DE133 Visual Basic low File Activities File Path Access Attributes Options Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 12 of 12