ID: Cookbook: browseurl.jbs Time: 15:46:38 Date: 29/03/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 15:46:3 Date: 29/03/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 3696 Parent PID: 54 General File Activities 1 Copyright Joe Security LLC 201 Page 2 of

3 Registry Activities Analysis iexplore.exe PID: 3796 Parent PID: 3696 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 19

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:46:3 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 7m 27s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.win@3/11@5/2 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3796 because there are no executed function Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 201 Page 4 of 19

5 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 201 Page 5 of 19

6 Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Networking System Summary Click to jump to signature section Networking: Social media urls found in memory data Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Behavior Graph Copyright Joe Security LLC 201 Page 6 of 19

7 Behavior Graph ID: URL: Startdate: 29/03/201 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Architecture: Score: 0 WINDOWS Is Windows Process Number of created Registry Values Number of created Files started Visual Basic Delphi iexplore.exe 34 Java.Net C# or VB.NET C, C++ or other language Is malicious started iexplore.exe 13..., 5156, 52046, GOOGLE-GoogleIncUS United States unknown unknown Simulations Behavior and APIs Time Type Description 15:47:25 API Interceptor 727x Sleep call for process: iexplore.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link 0% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 19

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 19

9 Startup System is w7 iexplore.exe (PID: 3696 cmdline: '' -Embedding CA1F703CD66567E132D2946FB55750) iexplore.exe (PID: 3796 cmdline: '' SCODEF:3696 CREDAT: /prefetch:2 CA1F703CD66567E132D2946FB55750) cleanup Created / dropped Files C:\Users\SAMTAR~1\AppData\Local\Temp\JavaDeployReg.log File Type: Size (bytes): 9 ASCII text, with CRLF line terminators Entropy (bit): BA1DBCD936F4C7503C95FAD7DE12C1E D DCE3C73B1AB F59A3E243F26D A5ED6E1AF905ECB3A BCCFF4C924AFC44A52036D734F973FF 43E56440F702B9F9E2EC0E331D30BEF7AFDA162DF2CBAD27CE16A4A70940DEEA6E17DFD90F5A5B1C1FF6 F74EA32F492BF15E99E626CB097551F232E9660 Copyright Joe Security LLC 201 Page 9 of 19

10 C:\Users\SAMTAR~1\AppData\Local\Temp\~DF72B6F61D203FBA.TMP File Type: FoxPro FPT, blocks size 25, next free block index Size (bytes): Entropy (bit): A1E619BC43A1B20700B277F2DEEF0 E4FEB10F77CBF57AE970A071E4250F6CFB0E5F 1DCA11F651D37F577497B199FD11AB741253A51312DA5DDD53EC164BD5DB 343AEC56EB AFC5E137E5CC93D142B55AC3E1EE65A416CA10ADF37A7B270E73CF401391AC0520D F6E1E64CC7A E177DCB09B5B C:\Users\SAMTAR~1\AppData\Local\Temp\~DF D3AFE4.TMP File Type: FoxPro FPT, blocks size 25, next free block index Size (bytes): Entropy (bit): CD4CCAC20D41DC6D510437E7433 CF5000B063994E44A5FE42B51A106C1CEB2B79 B95ADADA442DDB727F6F92F037D96E029C7540E6D31C1D76BEC3B250E75 622F5C91F5ADB CEC641ADAF35E12C5BD3DBF3EA5BDA3945A572F642A59BB9C56DB70BB D29AEED9CDBC2C4CBC52EFB0C3F2B5D C:\Users\SAMTAR~1\AppData\Local\Temp\~DFAC B453.TMP File Type: FoxPro FPT, blocks size 25, next free block index Size (bytes): 3905 Entropy (bit): BA364272E5D1013D25E3D79A1D77EE1B 5639CEFF215DF7AF2C43AE51BF32B297C312 51AC03CCDB0DBC432B6A9E55F2A17545E25A253560AD6BEC545E7D2C27F A4195E6DEAF37309E9FC1DF00369CADCB A5FEF4F1F1F27197FF63670C353FEB6EE091C4 AA65D4C3FECCB10647AEE11730CC0B6F6 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B60AB E-B3E3-CCDA62336E41}.dat File Type: Size (bytes): 4660 Microsoft Word Document Entropy (bit): F9B11C23B1721DE4D B02D 46C9AC2115A4060E0E21DC3E7E06D B0FDFC6D2E2A606C992EAD545CDA17F6791AF926414F631F7BEB01DA 3F5EB46DD4D471FC99B11F0A992BD937211D3B557B0DAC212F227CD EE09652AD31A610BABD1 D4C6E4FD55137CA73DC03FE1DA11551FC31C26 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B60AB E-B3E3-CCDA62336E41}.dat File Type: Size (bytes): 2640 Microsoft Word Document Entropy (bit): D1391D6F3FC5C9F242970D0EF7B43 46C21237E72D904C2B774B7BD2D04E73E75FC AB5C5C9FDF301D037CAC959F21F6C0FB0CE9D23F0B5F64020ADE779C FCD4B0B22D FD5EF34F CA7DB5B4C6E C45C D7445EC59D52159 FA3DE439ED9B4BAF419F1FDB4591B39 Copyright Joe Security LLC 201 Page 10 of 19

11 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B60AB E-B3E3-CCDA62336E41}.dat C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C00D4E E-B3E3-CCDA62336E41}.dat File Type: Size (bytes): Microsoft Word Document Entropy (bit): E39F01B E6D BEB3DA40E9C6BD1DECF439F36E32D92D46437F B B9EE71009C7D43E3BF2AA2147B90AF7D5E3EF9610FE22730BE BFBB6927A44DA0C736C622BCA2314DB9E0FCCFA494A0A2153FDFEA7DFC4F550A4295DA0D3AFCA64E1C AD16E73A995CA943CC6F32B1AB96AF55B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\NewErrorPageTemplate[1] File Type: Size (bytes): 1310 Entropy (bit): UTF- Unicode (with BOM) text, with CRLF line terminators CDF1E591D9CBFB47A7F97A2BCDB70B9 F12010DFAACDECAD77B70A3E71C707CF D95C6FB16136C795BB63E53FE0B11F9E406494BB575B3B0D60C5F651BD 977DCC2C64ACAF0E5970CEF1A7A72C9F9DC6BB2DA54F057E053CE939E4AB01B163EB7A505E093ABC44 ECAD9D060FDC3E67E2AC67FEE4D070A4CC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\dnserror[1] File Type: Size (bytes): 157 Entropy (bit): HTML document, UTF- Unicode (with BOM) text, with CRLF line terminators 73C70B34B5FF15D3A94B9D E9EAA065BD655A1B176E13615FD7E6EF96230A9 3EBD3432A436B4EBA1F3D5F1252E7BD13744A B469C13FCF4 927DCD4ACFDEB0F970CB4EE3F05916B37E1E4E04733ED3356F77CA044D2145E1ABDD4F7CE1C6CA23C1E B1797CC56C4C7E73F60E0FC0D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\httpErrorPagesScripts[1] File Type: Size (bytes): 714 Entropy (bit): UTF- Unicode (with BOM) text, with CRLF line terminators 3F57B71CB3EF114DD0B B7B CE6A63F996DF3A1CCCB1720E21204B25E023C 46E019FA34465F4ED096A9665D127B AD2E9BE01EDB1DDBC94D3AD CBF4EF52332AE7EA605F910AD6FA4BC FA4F0943A72CAC2CF0FA32B6AF4C20C697E1FAC2C5 BA16B5A64A23AF0C11EEFBF69625BF9F90CFA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\errorPageStrings[1] File Type: UTF- Unicode (with BOM) text, with CRLF line terminators Size (bytes): 3470 Entropy (bit): B26ECFA5E37D4B5EC61FCDD3F04FA Copyright Joe Security LLC 201 Page 11 of 19

12 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\errorPageStrings[1] B69CD71F6FE35A9CE0D7EA17B5F1B2BAD9EAFA 7F7D1069CAA52C1CEB36E1D9FE6A9C17ECBEFF1F66FC5EBFEB541723A 1676D43B977C07A3F6A5473F12FD16E564703A1CB9771D0F19B EE7940C33A010F0DC521E57332EC4 C4DD693C6A2323C97750E C3F4 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation true 0%, virustotal, Browse high Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious... United States GOOGLE-GoogleIncUS unknown unknown unknown Static File Info No static file info Network Behavior TCP Packets Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Copyright Joe Security LLC 201 Page 12 of 19

13 Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Copyright Joe Security LLC 201 Page 13 of 19

14 Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST UDP Packets Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Copyright Joe Security LLC 201 Page 14 of 19

15 Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Copyright Joe Security LLC 201 Page 15 of 19

16 Timestamp Port Dest Port IP Dest IP Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :47: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST Mar 29, :4: CEST ICMP Packets Timestamp IP Dest IP Checksum Code Type Mar 29, :47: CEST cfff (Port unreachable) Mar 29, :47: CEST cfff (Port unreachable) Mar 29, :4: CEST d009 (Port unreachable) Destination Unreachable Destination Unreachable Destination Unreachable DNS Queries Copyright Joe Security LLC 201 Page 16 of 19

17 Timestamp IP Dest IP Trans ID OP Code Name Type Class Mar 29, :47: CEST xe5a Standard query (0) Mar 29, :47: CEST xe5a Standard query (0) Mar 29, :47: CEST xe5a Standard query (0) Mar 29, :47: CEST xe5a Standard query (0) Mar 29, :47: CEST xe5a Standard query (0) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) DNS Answers Timestamp IP Dest IP Trans ID Replay Code Name CName Address Type Class Mar 29, xe5a No error (0) A (IP address) IN (0x0001) 15:47: CEST Mar 29, xe5a No error (0) A (IP address) IN (0x0001) 15:47: CEST Mar 29, xe5a No error (0) A (IP address) IN (0x0001) 15:47: CEST Mar 29, xe5a No error (0) A (IP address) IN (0x0001) 15:47: CEST Mar 29, xe5a No error (0) A (IP address) IN (0x0001) 15:47: CEST Code Manipulations Statistics Behavior iexplore.exe iexplore.exe Click to jump to process System Behavior Analysis iexplore.exe PID: 3696 Parent PID: 54 General Copyright Joe Security LLC 201 Page 17 of 19

18 Start time: 15:47:25 Start date: 29/03/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' -Embedding 0xd bytes CA1F703CD66567E132D2946FB55750 true C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Analysis iexplore.exe PID: 3796 Parent PID: 3696 General Start time: 15:47:25 Start date: 29/03/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' SCODEF:3696 CREDAT: /prefetch:2 0xd bytes CA1F703CD66567E132D2946FB55750 true C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Copyright Joe Security LLC 201 Page 1 of 19

19 Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 201 Page 19 of 19