ID: Sample Name: Dxd1yOZMU1.bin Cookbook: defaultwindowsofficecookbook.jbs Time: 09:43:59 Date: 21/10/2017 Version:

Transcription

1 ID: Sample Name: Dxd1yOZMU1.bin Cookbook: defaultwindowsofficecookbook.jbs Time: 0:43:5 Date: 21/10/2017 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Software Vulnerabilities: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior TCP Packets HTTP Packets Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3108 Parent PID: 2864 General File Activities Registry Activities Disassembly Copyright Joe Security LLC 2017 Page 2 of

3 Code Analysis Copyright Joe Security LLC 2017 Page 3 of

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 0:43:5 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h m 13s light Dxd1yOZMU1.bin (renamed file extension from bin to docx) defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal52.evad.windocx@1/16@0/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 2 Close Viewer Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2017 Page 4 of

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2017 Page 5 of

6 Ransomware Evader Spreading malicious malicious malicious suspicious suspicious suspicious Exploiter Phishing clean clean clean Spyware Banker Adware Trojan / Bot Signature Overview Detection AV Vulnerabilities Software Networking Summary System Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Copyright Joe Security LLC 2017 Page 6 of

7 Antivirus detection for submitted file Software Vulnerabilities: Potential document exploit detected (unknown TCP traffic) Networking: Downloads files Urls found in memory or binary System Summary: Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Document is a ZIP file with path names indicative for goodware Checks if Microsoft Office is installed Uses new MSVCR Dlls Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) System process connects to network (likely due to code injection or exploit) Behavior Graph Copyright Joe Security LLC 2017 Page 7 of

8 Behavior Graph ID: Sample: Dxd1yOZMU1.bin Startdate: 21/10/2017 Architecture: WINDOWS Score: 52 started Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java WINWORD.EXE.Net C# or VB.NET C, C++ or other language Is malicious , 80 SOFTLAYER-SoftLayerTechnologiesIncUS Netherlands System process connects to network (likely due to code injection or exploit) Simulations Behavior and APIs Time Type Description 0:44:14 API Interceptor 2x Sleep call for process: WINWORD.EXE modified from: 60000ms to: 500ms Antivirus Detection Initial Sample Detection Cloud Link Dxd1yOZMU.docx 4% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2017 Page 8 of

9 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN Match Associated Sample Name / URL SHA 256 Detection Link Context SOFTLAYER-SoftLayerTechnologiesIncUS ao87si5uju.apk 6341be88be00042c68511fd8 malicious Browse c7c618e610afac40fdf5bed5 2383bcdf18e 3order pdf.exe 4ca6d1dedf5d75522c4e2c75c malicious Browse c6ecdbe86d443c 6a858538e6 wccftech.com malicious Browse LATEST_My Photo Editor_v _apkpure.com.a pk 63INVOICE.pdf.exe e431ccc0af0bed4387b50f306d malicious Browse b3b3caddebc425c574da67d 0bd17cde171 a cb26ba5c53a57dc6 malicious Browse a635f07b33a6ccf81834c5 e1f7cbfefed Dropped Files No context Screenshot Copyright Joe Security LLC 2017 Page of

10 Startup System is w7 WINWORD.EXE (PID: 3108 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\Dxd1yOZMU1.docx 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\mso1BE.tmp GIF image, version 8a, x 831AFBB64A04617E0A42EA88756FE0E0BCCA 03FE7B74E6D3D561E32D4AF570E6CA70DB6BB371835BE2BF278BE60127A C7B765BAFBB810B6674DBC5C5064ED6A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D8CEE008D7D5FB ADC5CB486DA4BC4323B7AA C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD A5CEE3425DF17F3E4BC30AF038CB AD0 2AD6051BAD3A8F31DD514A5A413A88837B424BEF0101FEC385D3651B2A32 Copyright Joe Security LLC 2017 Page 10 of

11 C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD 2D21AFB64552AAB00573E0BDD4F3247AF2A484021F71B25FD8118DC6FC5167B651FE14BD1FBC8C8A3CF37E43E B1F856DF3E24B7723F38F1E7D1 C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{3E F8D-4D3B-A5D4-E65FA057622B}.FSD C1D4A1E76358C5EDF04AC1DA8E52845C41A8E A22EF8435BADF4542C47D0C4770E8B B81D AC A FA00B243EBAC5544FCA3E238F5FD73E3BF643BE1722B8B8B0B5465FE4E3EA7AE55E0087AAE87F3D4CAF5 F2B4414B576D8AA75E0320E01F C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF B6E3BB50635FF8FC4F CFF4516E87EB 140DA054EA5F DBFCEA5D08348D1D8EC4F3A780B48BDAF443F C1BADEB87268D4E33B74CAABF575C05C04CF462E3B6668B52B1D2A FE7D2EB0DB76A28507FFF2F2DD61D63 3ED74E276CC0BCDED A27 C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD 8FA312DE1CF814A31DE8EC380E6010CFF25B3 4ADA38FE710AAB7E83F5F365B12DCCE1F026E83421F72ECCF0D3C4CA13707A E221F34370FCF82A725FBA82D2DE74B8578F67446A4FF C6CB1BB2B34C0EC0BF210BA47330A7DA FB6F468310C C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{D6CC8F D7-BF12-5D37A7C88F}.FSD BAC1BA86A625F2EBC1FED5FEDD3B B72B1FD1BBA1A642DDCE85F676742D8FACCFF5BB483053DE4775DCD761D75C 2B531DE1717CA85B86C5337BE1CB87CA12BC3D84F77472CDF2C4134A05B B5DA44BE50E4313FC423D63C 61B75006F8D120CDAC36FCE0 C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-75-63CF07FD888}.FSF 1A55CFFEA21307FE5CCA227F18CD57AA68D 2AD3EBE462E78444AE8F54A0AD5C4EAB6B1F4A64B BE B2BDA5AB12AF6E0BAB06D63DB6B408603FC FC2EA6A81C432D6FB72375F718E3E7EAD785ADCBE4548EEFC D24C2C03B73866FD1B80DF2C16BBF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{277F23D5-E33A-41E3-A00-6CECC8B01C3C}.tmp FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" DBB11141C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A18B7783F0 E1C1454AFDA51624BC2BB2F28BA4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2483AC B3-0AC-6CC71320DFC}.tmp 40424B0286BBDC38C7512E8F2FC4B6F7BA2843 0A1FF8378C74384B4B6E747FC014AAC0E11DA8FF2DDFC141B38760B88 D2506CA87BB36D1B4AA844E1B1E3FA46C E4760F8AC475EF2661EF7147E0B AF1C5163AC8648 F58EE63212D36DD2A1C75A64 Copyright Joe Security LLC 2017 Page 11 of

12 C:\Users\user\AppData\Local\Temp\{1BD0BE32-44E2-460A-D0C-F3A3F5F3E6} 25DF1237B055B36A3B01F03810A6D74BD311 7D03F7A551ADB4D71C B7583F13AE53B1ADC52CF3C3827EBD80D435C 3670BD17B FD2D5DAE0BC7EAB476CB7D13A58B8D F760ED24DAB23586D8F0C423FE042A42221F2 24C5A01C702B675D3CC7BEA806E C:\Users\user\AppData\Local\Temp\{BB21A37B-06EE-46B4-BDFC-5F0EDC5AAB5} C8BD5B A516CE0731B0C725 D2BC3DE4DD745AE4FECB2EB28E25BD10E24FD2371CB204C6F412B388C082 B3E008E082B02AFCB46DD7D02E46CFDAE0AF1FDE2F53EE8CABF166A11D3F4FE43CD1A71330C11A3B52AE5F8CF12184 A36B FFA1ABDD1 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Dxd1yOZMU1.LNK MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep 24 13:5: , mtime=sun Sep 24 13:5: , atime=sat Oct 21 07:44: , length=1261, window=hide CB1A2C1B3143F3F38ED4B1E1AEE6BB872AFF4 6CC76A81AC132D87D0CF2F25E14C06D6540D77E5FB14D BEEEAB18821A71F4B51E1F6C1737B142EDEDEAE255CD51D3454D6E855F01DC54042FA5008A37F45BC5A8E37E66 4BCD242D0BC35EA54FC751EE25C C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat ASCII text, with CRLF line terminators 418BFF F43AFCD8B7A0114AEED CF8C7BA86F48C563517A074CA2A1F3D0E711B0457F5D182B85E6872AD8DC C647B1BE2F60E0B3F0F048A B37DE07E3BCB480BA8AE6463E24704C06178CE820654E1D744BD5AFEC5C020B05C 8EDF80CC8F465FE2F7BE44 C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18EF867116F0 0B671F751B5FCC3BABB31C5A2 C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN040.lex Little-endian UTF-16 Unicode text, with no line terminators D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB B3D510EF04275CA8E68E5B3CBB0ECE34EF252F0CDC83EEE34740A220 8C5F56F3DE34060C13E58EB7DAC1117F0D4DFFEC4B24FF84510F4B6FFAFD608C0A3DEAC3CFD210F0EFAF F755ABFDF1C54CA0D84 C:\Users\user\Desktop\~$d1yOZMU1.docx E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18EF867116F0 0B671F751B5FCC3BABB31C5A2 Contacted Domains/Contacted IPs Copyright Joe Security LLC 2017 Page 12 of

13 Contacted Domains No contacted domains info Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious Netherlands SOFTLAYER- SoftLayerTechnologiesIncUS true Static File Info General File type: TrID: File name: File size: 1261 SHA256: SHA512: File Content Preview: Zip archive, at least v2.0 to extract Word Microsoft Office Open XML Format document (41004/1) 1.0% ZIP compressed archive (4004/1) 8.8% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.02% Dxd1yOZMU.docx 7224a36f32ba10e8020a8ad758a7a 2872dcdf108563d16b6cf2ed fc541d2 ac6c1df385af63b864bb33bf30cb3105e247443ddb8f ec4f08 e18d2e81dcbe4a5f334257d286e d0b14af3640 1b a24cf825723fabe4be17360a83b1b4eb14 21c1d54aebe114bc3d4ec288637eae7 PK..._rels/.rels...J.1...m..i...z.Y.`Hf?p.A2j..FPt..{.d...?.vwp.z {...{./...T...Y O$e(.c..P.0..{.l.v...$GR...H..z.M].b...f.T{.!...y.;t.h.!.7.^N<.... *.2.d,iTK.g.`.y*...cU O...,... u..z/. File Icon Copyright Joe Security LLC 2017 Page 13 of

14 Network Behavior TCP Packets Timestamp Port Dest Port IP Dest IP Oct 21, :45: CEST Oct 21, :45: CEST Oct 21, :45: CEST Oct 21, :45: CEST Oct 21, :45: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :46: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST Oct 21, :47: CEST HTTP Packets Timestamp Port Dest Port IP Dest IP Header Oct 21, :45: CEST OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: Oct 21, :46: CEST OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: Oct 21, :46: CEST OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: Oct 21, :47: CEST OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: Total Bytes Transfered (KB) Code Manipulations Copyright Joe Security LLC 2017 Page 14 of

15 Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3108 Parent PID: 2864 General Start time: 0:44:13 Start date: 21/10/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\Dxd1yOZ MU1.docx 0x774a bytes 5D78FF0BE2A870D ACFDD C, C++ or other language File Activities File Path Access Attributes Options Completion Count Address Symbol File Path Completion Count Address Symbol Old File Path New File Path Completion Count Address Symbol File Path Offset Length Value Ascii Completion Count Address Symbol Registry Activities Key Path Completion Count Address Symbol Key Path Name Type Data Completion Count Address Symbol Key Path Name Type Old Data New Data Completion Count Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2017 Page of