ID: Sample Name: TBSERV.exe Cookbook: default.jbs Time: 01:52:14 Date: 23/11/2017 Version:

Transcription

1 ID: 301 Sample Name: TBSERV.exe Cookbook: default.jbs Time: 01:52:14 Date: 23/11/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Code Manipulations Statistics System Behavior Copyright Joe Security LLC 201 Page 2 of 13

3 Analysis Process: TBSERV.exe PID: 345 Parent PID: 2 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 13

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 301 Start time: 01:52:14 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 24s false light TBSERV.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal48.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): WMIADAP.exe, dllhost.exe Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: TBSERV.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 13

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 13

6 AV Detection System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for submitted file System Summary: Binary contains paths to development resources Classification label Creates temporary files PE file has an executable.text section and no other executable section Parts of this applications are using VB runtime library.0 (Probably coded in Visual Basic) Reads software policies Sample is known by Antivirus (Virustotal or Metascan) PE file contains strange resources Sample file is different than original file name gathered from version info Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: May sleep (evasive loops) to hinder dynamic analysis Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Simulations Behavior and APIs Time Type Description 01:53:02 API Interceptor 1x Sleep call for process: TBSERV.exe modified from: 0000ms to: 500ms Copyright Joe Security LLC 201 Page of 13

7 Antivirus Detection Initial Sample Source Detection Cloud Link TBSERV.exe 35% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files Copyright Joe Security LLC 201 Page of 13

8 No context Screenshot Startup System is w TBSERV.exe (PID: 345 cmdline: 'C:\Users\user\Desktop\TBSERV.exe' MD5: C03D2C22B4F5B00AB24CD33F0) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Copyright Joe Security LLC 201 Page 8 of 13

9 Contacted IPs No contacted IP infos Static File Info General File type: PE32 executable (GUI) Intel 8038, for MS Windows TrID: Win32 Executable (generic) a ( /4).15% Win32 Executable Microsoft Visual Basic (82/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.00% File name: File size: MD5: SHA1: SHA25: SHA5: File Content Preview: TBSERV.exe c03d2c22b4f5b00ab24cd33f0 0fe133b4d2b23cd4ce8e3550d25f2d5 c4af5be4bb1a d015c3a1823aa 1aa2d8ea8c0530b bc0dbccc1c5d1e253bde455152c4bedf5e8de 3a51fe4b82ff4beb800d5bea45131d1fb302c 58c4e3e0231fce5df502c4beb2245f30 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...si..si..si..ld..si.rich.si...pe..l...?a......@...( File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x4011d0.text false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x413FFC8 [Thu Sep 0:4: UTC] f1c4da2018ffa85882e Entrypoint Preview Instruction push 00401A20h call 0000F4B84BD5B3h Copyright Joe Security LLC 201 Page of 13

10 Instruction xor byte ptr [eax], al pushad add byte ptr [eax], bh add byte ptr [edi+ah], bh shr dword ptr [ebx+4f2da1fh], FFFFFFBEh add dword ptr [ebp-2h], edx call far 0000h : 0081DADh add byte ptr [ecx], al add byte ptr [eax+540ad5h], cl inc edx push ebx inc ebp push edx push esi add byte ptr [ecx], al push esp xor dword ptr [eax], esp inc esp imul esi, dword ptr [ebx+4h], 522h je 0000F4B84BD582h and byte ptr fs:[eax+2h], dl outsd arpl word ptr [ebp+3h], sp jnc 0000F4B84BD5831h jc 0000F4B84BD5E2h push ebx jc 0000F4B84BD583h imul esp, dword ptr [ebx+5h], 0A300h and cl, al inc eax add bh, bh int3 xor dword ptr [eax], eax pop es js 0000F4B84BD5ADh jc 0000F4B84BD5815h lodsb xor al, 45h xchg eax, ebx wait movsb aas push ebp dec esp xchg eax, ecx mov al, 5Fh xchg dh, bh sub al, F4h mov byte ptr [ Fh], al lodsd dec edi push esp add al, 04h dec ecx cmp cl, byte ptr [edi-53h] xor ebx, dword ptr [ecx-48ee30ah] Copyright Joe Security LLC 201 Page 10 of 13

11 Instruction or al, 00h stosb add byte ptr [eax-2dh], ah xchg eax, ebx Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0xb804 0x28.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0xd000 0x828.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x228 0x20 IMAGE_DIRECTORY_ENTRY_IAT 0x1000 0xb8.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0xad4 0xb000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.data 0xc000 0xd0 0x0 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0xd000 0x828 0x1000 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0xd540 0x2e8 data RT_ICON 0xd418 0x8 GLS_BINARY_LSB_FIRST RT_GROUP_ICON 0xd3f4 0x24 MS Windows icon resource - 2 icons, 32x32, 1-colors RT_VERSION 0xd0 0x2d4 data English United States Imports DLL MSVBVM0.DLL Import EVENT_SINK_GetIDsOfNames, MethCallEngine, EVENT_SINK_Invoke, Zombie_GetTypeInfo, EVENT_SINK_AddRef, DllFunctionCall, Zombie_GetTypeInfoCount, EVENT_SINK_Release, EVENT_SINK_QueryInterface, vbaexcepthandler Version Infos Copyright Joe Security LLC 201 Page 11 of 13

12 Description Data Translation 0x040 0x04b0 LegalCopyright Copyright 2001 All rights reserved InternalName TBSERV FileVersion CompanyName Technology One Ltd ProductName T1 Distributed Processor Service ProductVersion OriginalFilename TBSERV.exe Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: TBSERV.exe PID: 345 Parent PID: 2 General Start time: 01:53:02 Start date: 23/11/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\TBSERV.exe false 'C:\Users\user\Desktop\TBSERV.exe' 0x4db bytes C03D2C22B4F5B00AB24CD33F0 Visual Basic low File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page of 13

13 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 13 of 13