ID: Sample Name: CRP_Force_Tool.exe Cookbook: default.jbs Time: 20:11:41 Date: 20/07/2018 Version:

Transcription

1 ID: 699 Sample Name: CRP_Force_Tool.exe Cookbook: default.jbs Time: 20:11:41 Date: 20/0/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Anti Debugging: HIPS / PFW / Operating System Protection Evasion: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Network Behavior Copyright Joe Security LLC 201 Page 2 of 14

3 Code Manipulations Statistics System Behavior Analysis Process: CRP_Force_Tool.exe PID: 3464 Parent PID: 3044 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 699 Start time: 20:11:41 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 32s false light CRP_Force_Tool.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: EGA Information: HDC Information: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: CRP_Force_Tool.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 201 Page 4 of 14

5 Confidence Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 201 Page 5 of 14

6 Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Networking System Summary Hooking and other Techniques for Hiding and Protection Anti Debugging HIPS / PFW / Operating System Protection Evasion Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Sample file is different than original file name gathered from version info Classification label Creates files inside the user directory PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads software policies PE file contains a COM descriptor data directory Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Copyright Joe Security LLC 201 Page 6 of 14

7 Behavior Graph Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Behavior Graph ID: 699 Sample: CRP_Force_Tool.exe Startdate: 20/0/201 Architecture: WINDOWS Score: 1 started Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious CRP_Force_Tool.exe 1 5 Simulations Behavior and APIs Time Type Description 20:12:46 API Interceptor 1x Sleep call for process: CRP_Force_Tool.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page of 14

8 URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 14

9 Startup System is w cleanup CRP_Force_Tool.exe (PID: 3464 cmdline: 'C:\Users\user\Desktop\CRP_Force_Tool.exe' MD5: F335AEA4C4E5D629F53A) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of 14

10 Static File Info General File type: PE32 executable (GUI) Intel 036 Mono/.Net assemb ly, for MS Windows Entropy (bit): TrID: Win32 Executable (generic) a ( /4) 99.23% Generic CIL Executable (.NET, Mono, etc.) (3296/5) 0.3% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.00% File name: CRP_Force_Tool.exe File size: MD5: SHA1: SHA256: SHA512: File Content Preview: f335aea4c4e5d629f53a 33fe4b61de416fc1e005f493bc2fa3936b41a9 d33266a6b6ea0e161c09d3f6c99b9e02edb4cd0f c60dedf23 99b5d1ccfb122eecc0b96ebcb91ed4b00692d64 305b032b2dded59e4eb445ff63b11556f95114c21 adbd4b959a2f25056fc0feb615dc903 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l... R[..."...0.."...A......`...@ `... File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: 0x4041c6.text false 0x windows gui EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA 0x5B5204B9 [Fri Jul 20 15:50:1 201 UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f34d5f2d45ed6d9ceec516c1f5a44 Entrypoint Preview Instruction jmp dword ptr [ h] Copyright Joe Security LLC 201 Page 10 of 14

11 Instruction Copyright Joe Security LLC 201 Page 11 of 14

12 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x414 0x4f.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x6000 0x5dc.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x000 0xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x403c 0x1c.text IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x200 0x4.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x21cc 0x2200 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x6000 0x5dc 0x600 False data IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_READ.reloc 0x000 0xc 0x200 False dbase IV DBT of \3101.DBF, blocks size 12, next free block index IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_VERSION 0x6090 0x34c data RT_MANIFEST 0x63ec 0x1ea XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators Imports DLL mscoree.dll Import _CorExeMain Version Infos Copyright Joe Security LLC 201 Page 12 of 14

13 Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright 201 Assembly Version InternalName CRP_Force_Tool.exe FileVersion CompanyName LegalTrademarks Comments ProductName CRP_Force_Tool ProductVersion FileDescription CRP_Force_Tool OriginalFilename CRP_Force_Tool.exe Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: CRP_Force_Tool.exe PID: 3464 Parent PID: 3044 General Start time: 20:12:46 Start date: 20/0/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\CRP_Force_Tool.exe false 'C:\Users\user\Desktop\CRP_Force_Tool.exe' 0xa bytes F335AEA4C4E5D629F53A true.net C# or VB.NET low File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page of 14

14 Key Path Name Type Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14