ID: Cookbook: browseurl.jbs Time: 12:58:02 Date: 02/04/2018 Version:

Transcription

1 ID: 5253 Cookbook: browseurl.jbs Time: 12:5:02 Date: 02/04/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior TCP Packets UDP Packets ICMP Packets DNS Queries Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 3344 Parent PID: 54 General File Activities Copyright Joe Security LLC 201 Page 2 of

3 Registry Activities Analysis iexplore.exe PID: 3400 Parent PID: 3344 General File Activities Registry Activities Analysis ssvagent.exe PID: 3512 Parent PID: 3400 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 20

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 5253 Start time: 12:5:02 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 4m 31s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@5/20@5/2 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3400 because there are no executed function Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 201 Page 4 of 20

5 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 201 Page 5 of 20

6 Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Social media urls found in memory data Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 20

7 Behavior Graph ID: 5253 URL: Startdate: 02/04/201 Architecture: WINDOWS Score: 1 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values Number of created Files iexplore.exe Visual Basic Delphi iexplore.exe started Java.Net C# or VB.NET C, C++ or other language Is malicious 1..., 50323, 51492, GOOGLE-GoogleIncUS unknown wetransfer.com started United States unknown ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 12:5:46 API Interceptor 5943x Sleep call for process: iexplore.exe modified 12:5:4 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 3% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link wetransfer.com 0% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 20

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 20

9 Startup System is w7 cleanup iexplore.exe (PID: 3344 cmdline: '' -Embedding CA1F703CD66567E132D2946FB55750) iexplore.exe (PID: 3400 cmdline: '' SCODEF:3344 CREDAT: /prefetch:2 CA1F703CD66567E132D2946FB55750) ssvagent.exe (PID: 3512 cmdline: 'C:\PROGRA~1\Java\JRE1~1.0_1\bin\ssvagent.exe' -new 0953A026479FD1E655B75B63B903B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 9 ASCII text, with CRLF line terminators Entropy (bit): E39F765F69AA2EC700A166EB24AC6A5 D1C099E60932BCC7A9F20CA2AC7C591A67E1B2E0 96C796D EE3AEE0B411E04D0D CFD90329DE241D1530C 7F9D1CEEEF1BD262244EBF7A05D34FE32A27AB107635BDB120CC9A56743A79533E41F1E9A410E76D252D0F72 A050552D0A2A91609D053CB44D347E Copyright Joe Security LLC 201 Page 9 of 20

10 C:\Users\HERBBL~1\AppData\Local\Temp\~DF10AA94030B7C6FB2.TMP FoxPro FPT, blocks size 25, next free block index Size (bytes): 3713 Entropy (bit): A EE27E72A1B942CD50A2D9 B69C2359D3150C AB94FF4B456D6A1B D30A2FEE66B5991B9F63A69E49BA5436A D6DD1BE1FEEAB7 52BA3A1EBB4BC97B03A5BA370FAC4C025451E4D0BAA7B2A60C5F4B2F27575CB32CAF0FD9B666D A1FCBF97ECCB602A67F3C915EA1A0B6D9BBF C:\Users\HERBBL~1\AppData\Local\Temp\~DF6C2A01001F496FB.TMP FoxPro FPT, blocks size 25, next free block index Size (bytes): Entropy (bit): A2CDFF205A3E9FDA A E6C4EBBEEA6FBBA464F1D5069B6045AA14E5 E7366EE DF1AD3FBDE035BD6A19E56E5F519257F5C27D51699B6 BDB01B15522D347369B9110AD0B76CC53FB5FF5D2FB2C5F10A9DAFBAD7F09134D92F63411E53CBFD344AB E741633B7AB04A51C6F76A74CF029B5BC36A C:\Users\HERBBL~1\AppData\Local\Temp\~DF95CC61D7DC51A91D.TMP FoxPro FPT, blocks size 25, next free block index Size (bytes): Entropy (bit): C49F795A63E A735D0FF 1F5500DDE EB5A701D3AA6B795640A 3BCF441A542C991A31494C24EBEA7DBD3C35A9E5FEAB0B237C323356F 5DC7E4E0BA903ED66FD0E D4BD217CF93E662E25F9AD C5AE010F3DAD1E6EA93012B96C 5B265611DBA26E167AA0FA0CD426C461F191 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA974A10C4BD62CC921D13E43B1_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (bit): B93B055F1ED02AC BFA E49C43005A144BE3DE945B1F9BC4E5A9126D A2649B55B45DF55AC2A374490B42AD312A749BDAAA21B6C00DCE6AD4CED 1A7EC92A1516E9B2E224E239C29EA395C61555A429B5FDF66B794DBBE6336C2BCE435ACD4F145563E5ACB4E DDBE001566E1BB345BF9F6F5EAE0341B9AAB2A6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CB34DD3343FE727DF90D352E0DF data Size (bytes): 4221 Entropy (bit): A4AA4354C410A9F3056B123C9E44 D6E23E452B FBD9153DB633900D7E 057B0E1C559BC5B153C01C19254C4B53D157E45D30272B C79071 Copyright Joe Security LLC 201 Page 10 of 20

11 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CB34DD3343FE727DF90D352E0DF 4D5CBD5B62991BF7C2034E3A0FF D5910A3B73A709D1BEEF DDBDD5EF33B55232C E FBF5A2F0A10B24D304FF9F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57CEDB95DF3F0AD4EE2DC2BCFD4157 data Size (bytes): 340 Entropy (bit): C5D5C77B7B6AA4A75BA900DA13 72E1B4E2C565CB39525DCC24CF4BCE5CD202A D1207AA1FEDFBE2AAA31DCCE5D6960F6FE9279EB1E69EF66059C60A5709 A DDD36FD6AF2B1BA13BBFDEC992E7053DED71BB9D647A456B0ABF0002CB51FFCC577DF2DDF3 79D6664ABAE29BF3BD5ADFF621BFBB477F1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA974A10C4BD62CC921D13E43B1_BEB37ABADF B E04 data Size (bytes): 434 Entropy (bit): A E69779B99A6D543F1FE 94039EAE14C7D527BB9062C7BEAC0EBB0C2F94C 0D5FB72DA A1DC9E2449DDBBCA9DA6F E0AD159413B69B0CC 7ABBD5F7541F5A4B4B246F990CF1E001661BE904FA7FC6B477E7216ECB712FE4E1441CA9FFF5A EA41290D7D91452FADBF9607B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CB34DD3343FE727DF90D352E0DF data Size (bytes): 226 Entropy (bit): FC496CFEFB5B07D34EB6F9C4C079EBDB 7FD705AF3A6BC56FA3C23054D4C3DD2060B525 FC1D0B6F7DF5BCC1625A39D44A3E2A0CD0EE7E460C9EA7F6CFEB0F32B33C7 ADA2B7426B7D4EE56E32A E61EA4ECAF65BA3E34AB735ED2AC95D9B4B4C62DB4EE266271F6F6A19 2DE3A4A354DCC610FC409053CB0F433A C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): 1176 Entropy (bit): A34CB996293FDE2CB7A4AC957393A 3C96C D1A7773CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A4AD296BE25C0CC05A1F34DBAD E1B7D F E70F6B1BE6FD0CA65DCCF4FF D4427D3A77F704AEDFF59D2DBC0D56A6 09B2590CEC0DD6BC4AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators Size (bytes): Copyright Joe Security LLC 201 Page 11 of 20

12 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Entropy (bit): CB5C06CAECCCCB09C12E3109E7A650 D02EC34FE9EEC747CEB5B4E ADAD75 633D4C25AEDE32AEAADE7F423B2E062D2E54C129AF61906D6F5C25DB1D C1720D94EB37BCD03C467E7CFF96EDB5310FAE397EAAFDF9CDD429EB57662C6C33772BA4D2E 505ED9A2D24B639B55459B42EA3F416ACC C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D02520B E-B7AC-B2C276BF9C}.dat Size (bytes): 4660 Microsoft Word Document Entropy (bit): F0A04CAB39F2A925E250B52E9A6 29C643160DFF1AFEBC7B000A23D4E13FB2B6 5BFCCD0E90D0CF0C6A5A4E2456EB74D559A0B360FEB2E4B3A665B2E264DE1 B647F4DB1D3BB DC00BEC96E6CB16162EF7714DD3E77E55FB341B6F2076D00E94CBDD1B2220B53 F065365CBDB6D2330F75E7194A4C41CF7BE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D02520B E-B7AC-B2C276BF9C}.dat Size (bytes): Microsoft Word Document Entropy (bit): DBDA00D46C4A37DCE67042D234FA 9D492B519A976C4A247C1F3C691139C4971 D57B014EA5C2414A1D41EFEBEFD2A07CFA9BB1B2C6EED6D0DF227FAE6DE6 D63C55C12C5B0B0A7563BC5CBDF0745A3519B6C659392A300D399B72C69DD5AF29A54E0752BE079E7A23032E 42EE66392CECEB5CEF3CC61E22E27FABFFF6 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DA E-B7AC-B2C276BF9C}.dat Size (bytes): Microsoft Word Document Entropy (bit): BC5F5F0DA90449B1AD9F19665 EA E63767E9BF5EE9AF3EFB7FCE2 10CCA7F69C5E50D1ED45C6D26E14C1B077D3C127DEE5D94716CBE7FEB95E 36331B13E5DC4B1A3527D2C27EA620ADD00442FAFA70F757AAD5CC659199C07B2B305F7D6B A22 6E7C52755B50D4D977BDFA7E F41E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\NewErrorPageTemplate[1] Size (bytes): 1310 Entropy (bit): UTF- Unicode (with BOM) text, with CRLF line terminators CDF1E591D9CBFB47A7F97A2BCDB70B9 F12010DFAACDECAD77B70A3E71C707CF D95C6FB16136C795BB63E53FE0B11F9E406494BB575B3B0D60C5F651BD 977DCC2C64ACAF0E5970CEF1A7A72C9F9DC6BB2DA54F057E053CE939E4AB01B163EB7A505E093ABC44 ECAD9D060FDC3E67E2AC67FEE4D070A4CC Copyright Joe Security LLC 201 Page 12 of 20

13 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\httpErrorPagesScripts[1] Size (bytes): 714 Entropy (bit): UTF- Unicode (with BOM) text, with CRLF line terminators 3F57B71CB3EF114DD0B B7B CE6A63F996DF3A1CCCB1720E21204B25E023C 46E019FA34465F4ED096A9665D127B AD2E9BE01EDB1DDBC94D3AD CBF4EF52332AE7EA605F910AD6FA4BC FA4F0943A72CAC2CF0FA32B6AF4C20C697E1FAC2C5B A16B5A64A23AF0C11EEFBF69625BF9F90CFA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\dnserror[1] Size (bytes): 157 Entropy (bit): HTML document, UTF- Unicode (with BOM) text, with CRLF line terminators 73C70B34B5FF15D3A94B9D E9EAA065BD655A1B176E13615FD7E6EF96230A9 3EBD3432A436B4EBA1F3D5F1252E7BD13744A B469C13FCF4 927DCD4ACFDEB0F970CB4EE3F05916B37E1E4E04733ED3356F77CA044D2145E1ABDD4F7CE1C6CA23C1E B1797CC56C4C7E73F60E0FC0D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\iecompatviewlist[1].xml Size (bytes): Entropy (bit): XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators CB5C06CAECCCCB09C12E3109E7A650 D02EC34FE9EEC747CEB5B4E ADAD75 633D4C25AEDE32AEAADE7F423B2E062D2E54C129AF61906D6F5C25DB1D C1720D94EB37BCD03C467E7CFF96EDB5310FAE397EAAFDF9CDD429EB57662C6C33772BA4D2E 505ED9A2D24B639B55459B42EA3F416ACC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\suggestions[1].en-US data Size (bytes): 1176 Entropy (bit): A34CB996293FDE2CB7A4AC957393A 3C96C D1A7773CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A4AD296BE25C0CC05A1F34DBAD E1B7D F E70F6B1BE6FD0CA65DCCF4FF D4427D3A77F704AEDFF59D2DBC0D56A6 09B2590CEC0DD6BC4AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\errorPageStrings[1] Size (bytes): 3470 Entropy (bit): UTF- Unicode (with BOM) text, with CRLF line terminators 6B26ECFA5E37D4B5EC61FCDD3F04FA B69CD71F6FE35A9CE0D7EA17B5F1B2BAD9EAFA 7F7D1069CAA52C1CEB36E1D9FE6A9C17ECBEFF1F66FC5EBFEB541723A 1676D43B977C07A3F6A5473F12FD16E564703A1CB9771D0F19B EE7940C33A010F0DC521E57332EC4 C4DD693C6A2323C97750E C3F4 Copyright Joe Security LLC 201 Page 13 of 20

14 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\errorPageStrings[1] Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation wetransfer.com unknown unknown 0%, virustotal, Browse high Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious... United States GOOGLE-GoogleIncUS unknown unknown unknown Static File Info No static file info Network Behavior TCP Packets Timestamp Port Dest Port IP Dest IP Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Copyright Joe Security LLC 201 Page 14 of 20

15 Timestamp Port Dest Port IP Dest IP Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Copyright Joe Security LLC 201 Page 15 of 20

16 Timestamp Port Dest Port IP Dest IP Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST UDP Packets Timestamp Port Dest Port IP Dest IP Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Copyright Joe Security LLC 201 Page 16 of 20

17 Timestamp Port Dest Port IP Dest IP Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :5: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :59: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Copyright Joe Security LLC 201 Page 17 of 20

18 Timestamp Port Dest Port IP Dest IP Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST Apr 2, :00: CEST ICMP Packets Timestamp IP Dest IP Checksum Code Type Apr 2, :59: CEST d00 (Port unreachable) Destination Unreachable DNS Queries Timestamp IP Dest IP Trans ID OP Code Name Type Class Apr 2, :5: CEST x164d Standard query (0) Apr 2, :5: CEST x164d Standard query (0) Apr 2, :5: CEST x164d Standard query (0) Apr 2, :5: CEST x164d Standard query (0) Apr 2, :5: CEST x164d Standard query (0) wetransfer.com A (IP address) IN (0x0001) wetransfer.com A (IP address) IN (0x0001) wetransfer.com A (IP address) IN (0x0001) wetransfer.com A (IP address) IN (0x0001) wetransfer.com A (IP address) IN (0x0001) Code Manipulations Statistics Behavior iexplore.exe iexplore.exe ssvagent.exe Click to jump to process System Behavior Analysis iexplore.exe PID: 3344 Parent PID: 54 Copyright Joe Security LLC 201 Page 1 of 20

19 General Start time: 12:5:46 Start date: 02/04/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' -Embedding 0x12a bytes CA1F703CD66567E132D2946FB55750 true C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Analysis iexplore.exe PID: 3400 Parent PID: 3344 General Start time: 12:5:46 Start date: 02/04/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' SCODEF:3344 CREDAT: /prefetch:2 0x12a bytes CA1F703CD66567E132D2946FB55750 true C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Copyright Joe Security LLC 201 Page 19 of 20

20 Key Path Name Type Old Data New Data Completion Count Analysis ssvagent.exe PID: 3512 Parent PID: 3400 General Start time: 12:5:47 Start date: 02/04/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: C:\Program Files\Java\jre1..0_144\bin\ssvagent.exe 'C:\PROGRA~1\Java\JRE1~1.0_1\bin\ssvagent.exe' -new 0x bytes 0953A026479FD1E655B75B63B903B7 true C, C++ or other language Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 201 Page 20 of 20