ID: Cookbook: urldownload.jbs Time: 23:15:42 Date: 15/01/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: urldownload.jbs Time: 23:15:42 Date: 15/01/2018 Version:"

Janel Ashlynn Houston
6 years ago
Views:

1 ID: Cookbook: urldownload.jbs Time: 23:15:42 Date: 15/01/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTPS Packets Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 300 Parent PID: 512 General File Activities Copyright Joe Security LLC 201 Page 2 of

3 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

Analysis Report Overview General Information Joe Sandbox Version: 20.0.0 Analysis ID: 42733 Start time: 23:15:42 Joe Sandbox Product: CloudBasic Start date: 15.01.

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 23:15:42 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 7s false light urldownload.jbs yer.jse Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean0.win@1/0@2/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 14

Strategy Score Range Further Analysis Required?

Ransomware Miner Spreading malicious malicious

suspicious clean clean clean Exploiter Banker

Uses HTTPS for network communication, use the

data' cookbook for further analysis Signature

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Copyright Joe Security LLC 201 Page 5 of 14

6 Networking System Summary HIPS / PFW / Operating System Protection Evasion Click to jump to signature section Networking: Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Classification label HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 14

Hide Legend ID: 42733 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped URL: https://ie9cuking-of-web.net/64103350596736/1516042967561.

7 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped URL: Startdate: 15/01/201 Architecture: WINDOWS Score: 0 started Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language wget.exe Is malicious ie9cuking-of-web.net , 443, SERVER4YOU-server4youIncUS United States Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Source Detection Cloud Link ie9cuking-of-web.net 2% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 14

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 14

$Startup System is w7 wget.exe (PID: 300 cmdline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.$

9 Startup System is w7 wget.exe (PID: 300 cmdline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' MD5: 34C709455BFEFB9B0E976BAD13AF4) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection ie9cuking-of-web.net true false 2%, virustotal, Browse Contacted IPs Copyright Joe Security LLC 201 Page 9 of 14

10 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States 3003 SERVER4YOU-server4youIncUS false Static File Info No static file info Network Behavior Network Port Distribution Total Packets: (HTTPS) 53 (DNS) TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Jan 15, :16: CET Jan 15, :16: CET Copyright Joe Security LLC 201 Page 10 of 14

11 Timestamp Source Port Dest Port Source IP Dest IP Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET Jan 15, :16: CET DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Jan 15, :16: CET xacad Standard query (0) ie9cuking-ofweb.net A (IP address) IN (0x0001) Jan 15, :16: CET xacad Standard query (0) ie9cuking-ofweb.net A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Jan 15, xacad No error (0) ie9cuking-ofweb.net 23:16: CET Jan 15, xacad No error (0) ie9cuking-ofweb.net 23:16: CET A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTPS Packets Timestamp Source Port Dest Port Source IP Dest IP Subject Issuer Not Before Not After Raw Copyright Joe Security LLC 201 Page 11 of 14

12 Timestamp Source Port Dest Port Source IP Dest IP Subject Issuer Jan 15, CN=ie9cukingof-web.net 23:16: CET CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Not Before Mon Jan 15 04:40:25 CET 201 Not After Sun Apr 15 05:40:25 CEST 201 Raw [[ Version: V3 Subject: CN=ie9cuking-of-web.net Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 204 bits modulus: public exponent: Validity: [From: Mon Jan 15 04:40:25 CET 201, To: Sun Apr 15 05:40:25 CEST 201] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03f296c4 0b1322c 70591eb c35962e 27d9]Certificate Extensions: [1]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: accessmethod: caissuers accesslocation: URIName: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A 4A 6A D DD BA E6 D1 39 B7 A EF.Jjc...9..Ee.0010: F3 A EC A1...]] [3]: ObjectId: Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ][] ] [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1A A 2F 2F E 6C E E 6F sencrypt.org], PolicyQualifierInfo: [ qualifierid: qualifier: 0000: E 0C 1 9B This Certi0010: D F 6E 6C ficate may only 0020: C F 6E be relied upon b0030: C E y Relying Partie0040: E F 6E 6C E s and only in ac0050: 63 6F E cordance with th0060: F e Certificate Po0070: 6C F 75 6E licy found at ht000: A 2F 2F 6C E tps://letsencryp0090: 74 2E 6F F F F t.org/repository00a0: 2F /]] ]][5]: ObjectId: Criticality=falseExtendedKeyUsages [ serverauth clientauth] [6]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][7]: ObjectId: Criticality=falseSubjectAlternativeName [ DNSName: ie9cukingof-web.net][]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: B A9 C2 A1 FE AF 43 4 E5 2 BF 17 9A 5F v$...ch. (..._0010: 9F EE PG]]] Algorithm: [SHA256withRSA] Signature:0000: 3A B6 A9 E7 0C F2 7C A4 1C 27 BB B9 FF :...0.A..' : E C1 D1 A7 07 5B 7A 9 2F AB B A.sD... [z./.6@[.0020: DB 5D 49 1F 4C C 77 F6 BC 7E FA 5E 9C A9 D9 DF.]I.L.w...^ : C0 E AB 77 AA 39 3F 34 C7 0F Eg...s..w.9? : BD 3D E E E AD 0 0D A 1C 4D 5D A5.=...r...M].0050: DB 1E 14 C3 C F B F2...qc#%h.Vb.[.0060: 7A 9F F4 D0 0F 0B 0C EC DA CC 9A 75 5C 50 0D 61 z...u\p.a0070: A3 6E F CE 49 0A CF n.VT@..R.I...fi000: 16 3B C0 AE 29 AE AE 14 1B 27 C E5 A0 F7 0F 60.;..)...'...`0090: 04 2 A F1 A9 5B F5 0 AB E0 1B A F 0F.(...[...H4O.00A0: F BD 22 9E 67 4D F5 3D F..y`.".gM.=&...?00B0: 14 1F C BA 5C 1D 06 A Dp..!!.\...00C0: 2 A1 93 9A 74 BC F9 AE F0 5F E1 56 A2 17 F2 C9...t..._.V...00D0: 32 E7 DA D6 6C 5A 6C B7 EA 29 4 C6 B lZl..)H..00E0: 50 3 E0 9E 24 3E D0 73 4B 60 E3 7D 21 A9 1B F1 P...$>.sK`..!...00F0: A 0B B 6C F 41.1gb:.(...[l#.?A] Copyright Joe Security LLC 201 Page 12 of 14

13 Timestamp Source Port Dest Port Source IP Dest IP Subject Issuer Jan 15, :16: CET CN=Let's Encrypt Authority X3, CN=DST Root CA X3, O=Digital O=Let's Encrypt, Signature C=US Trust Co. Not Before Thu Mar 17 17:40:46 CET 2016 Not After Wed Mar 17 17:40:46 CET 2021 Raw [[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 204 bits modulus: public exponent: Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a a0b 5eca70]Certificate Extensions: 7[1]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: accessmethod: caissuers accesslocation: URIName: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B FF C ,q...K.u : `...]] [3]: ObjectId: Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ][] ] [CertificatePolicyId: [ ][PolicyQualifierInfo: [ qualifierid: qualifier: 0000: A 2F 2F E 72 6F 6F." 74 2D E 6C E t-x1.letsencrypt0020: 2E 6F org]] ]][6]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A 4A 6A D DD BA E6 D1 39 B7 A EF.Jjc...9..Ee.0010: F3 A EC A1...]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F DD 1 15 FB BE cX...U.v0010: 56 B A B C F1 5A 1F V.pH.iG'..$...Z.0020: 4A C 62 6 B CD E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 2 51 CD 9B E AE 7 9D EA D BA 5A...N(Q...Z0040: A1 01 9A DC F0 DD 6A 1D 6A D 3E E A6 1E...j.j.>W# : A FF D7 05 CA B7 1F 3F C0 0A 4 BC 94 B0.b...?..H : B E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC.eb..T..* : C F6 B5 C3 32 A3 9 CC 77 A E B CB w..ye.+.000: 2 FE 3A CE 52 0C 2E 5F 3 E D (.:.R..R.._ : FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B.wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 3 F0 2F 7B 2C 62 9D D9 ]._3.M.../.,b..00B0: A3 91 6F 25 1B 2F 90 B D F6 7E 1B A6 7A..o%./...F=...z00C0: 7 B9 A3 7A 6D 1 FA 25 A E0 F2 16 2F...zm..%.../00D0: 5 B0 06 2F 2C 6 26 C6 4B 9 CD DA 9F 0C F9 7F X../,h&.K...00E0: 90 ED 43 4A E 6F 73 7A 2 EA A4 AA 6E 7B..CJ.DNosz(...n.00F0: 4C 7D 7 DD E0 C A7 7 AF C3 34 5B B4 42 L...D...4[.B] Code Manipulations Statistics System Behavior Copyright Joe Security LLC 201 Page 13 of 14

14 Analysis Process: wget.exe PID: 300 Parent PID: 512 General Start time: 23:16:16 Start date: 15/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\wget.exe false wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --useragent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' e9cuking-of-web.net/ / /flashplayer.jse' 0x755c bytes 34C709455BFEFB9B0E976BAD13AF4 C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14

ID: Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/2018 Version:

ID: Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/2018 Version: ID: 42417 Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature