Analysis # 2956 Sample: document_73128_91898_pdf.exe (5b94fb32ed60cb839ca4284f80ae3b16) Analysis # /10/ :34 am

Transcription

1 Analysis # /10/ :34 am 1/18

2 Table of Contents Analysis Summary... 3 Analysis Summary... 3 Digital Behavior Traits... 3 File Activity... 4 Deleted Files... 4 Stored Modified Files... 5 Created Mutexes... 6 Created Mutexes... 6 Registry Activity... 8 Created Keys... 8 Set Values... 9 Deleted Values Network Activity Network Events Network Traffic DNS Requests Virus Total Results /18

3 Analysis Summary Submitted File: document_73128_91898_pdf.exe MD5: 5b94fb32ed60cb839ca4284f80ae3b16 File Size: File Type: PE32 executable for MS Windows (GUI) Intel Analysis Time: :34:02 Start Reason: AnalysisTarget Termination Reason: TerminatedBySelf Start Time: Fri, 10 Oct :39: Termination Time: Fri, 10 Oct :40: Analysis Time: :34:02 Sandbox: XP-SP2-00-0C-29-B2-D2-62 Total Processes: 5 Sample Notes: Digital Behavior Traits Alters Windows Firewall Checks For Debugger Copies to Windows Could Not Load Creates DLL in System Creates EXE in System Creates Hidden File Creates Mutex Creates Service Deletes File in System Deletes Original Sample Hooks Keyboard Injected Code Makes Network Connection Modifies File in System Modifies Local DNS More than 5 Processes Opens Physical Memory Starts EXE in Documents Starts EXE in Recycle Starts EXE in System Windows/Run Registry Key Set 3/18

4 Deleted Files C:\document_73128_91898_pdf.exe C:\DOCUME~1\Charlie\LOCALS~1\Temp\onicm.exe 4/18

5 Stored Modified Files [process 1] C:\DOCUME~1\Charlie\LOCALS~1\Temp\skgqm.exe C:\Documents and Settings\Charlie\Local Settings\Temporary Internet Files\Content.IE5\C4 O5PO1W\1010uk1[1].rtf C:\DOCUME~1\Charlie\LOCALS~1\Temp\onicm.exe [process 3] C:\WINDOWS\BrUqKiqVKoCCcgo.exe C:\WINDOWS\system32\config\systemprofile\Application Data\2ete64.vas C:\WINDOWS\system32\config\systemprofile\Application Data\2ete64.vas C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat 5/18

6 Created Mutexes [process 1] [process 1] [process 1] [process 1] [process 1] [process 3] [process 3] [process 3] [process 3] mutex Name: CTF.LBES.MutexDefaultS Name: CTF.Compart.MutexDefaultS Name: CTF.Asm.MutexDefaultS Name: CTF.Layouts.MutexDefaultS Name: CTF.TMD.MutexDefaultS Name: CTF.TimListCache.FMPDefaultS MUTEX.DefaultS Name: CTF.LBES.MutexDefaultS Name: CTF.Compart.MutexDefaultS Name: CTF.Asm.MutexDefaultS Name: CTF.Layouts.MutexDefaultS Name: CTF.TMD.MutexDefaultS Name: CTF.TimListCache.FMPDefaultS MUTEX.DefaultS Name: Local\c:!documents and settings!charlie!local settings!temporary internet files!content.ie5! Name: Local\c:!documents and settings!charlie!cookies! Name: Local\c:!documents and settings!charlie!local settings!history!history.ie5! Name: Local\WininetConnectionMutex Name: RasPbFile Name: Local\ZonesCounterMutex Name: Local\ZoneAttributeCacheCounterMutex Name: Local\ZonesCacheCounterMutex Name: Local\ZonesLockedCacheCounterMutex Name: CTF.LBES.MutexDefaultS Name: CTF.Compart.MutexDefaultS Name: CTF.Asm.MutexDefaultS /18

7 [process 3] [process 3] Name: CTF.Layouts.MutexDefaultS Name: CTF.TMD.MutexDefaultS Name: CTF.TimListCache.FMPDefaultS MUTEX.DefaultS Name: CTF.LBES.MutexDefaultS Name: CTF.Compart.MutexDefaultS Name: CTF.Asm.MutexDefaultS Name: CTF.Layouts.MutexDefaultS Name: CTF.TMD.MutexDefaultS Name: CTF.TimListCache.FMPDefaultS MUTEX.DefaultS Name: Global\1g2hk1hyj Name: Local\c:!windows!system32!config!systemprofile!local settings!temporary internet files!content.ie5! Name: Local\c:!windows!system32!config!systemprofile!cookies! Name: Local\c:!windows!system32!config!systemprofile!local settings!history!history.ie5! Name: RasPbFile Name: Local\ZonesCounterMutex Name: Local\c:!windows!system32!config!systemprofile!ietldcache! Name: Local\ZoneAttributeCacheCounterMutex Name: Local\ZonesCacheCounterMutex 7/18

8 Created Keys key \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extens ible Cache\ietld \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation 8/18

9 Set Values [process 1] key rentversion\explorer\shell Folders Value: Cache rentversion\explorer\shell Folders Value: Cookies rentversion\explorer\shell Folders Value: History Key Name: \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Common AppData rentversion\explorer\shell Folders Value: AppData rentversion\internet Settings Value: ProxyEnable Key Name: \REGISTRY\USER\S \Software\Microsoft\windows\Cur rentversion\internet Settings\Connections Value: SavedLegacySettings rentversion\internet Settings\ZoneMap Value: ProxyBypass rentversion\internet Settings\ZoneMap Value: IntranetName rentversion\internet Settings\ZoneMap Value: UNCAsIntranet rentversion\internet Settings\ZoneMap 9/18

10 Value: AutoDetect [process 3] rentversion\internet Settings\ZoneMap Value: ProxyBypass rentversion\internet Settings\ZoneMap Value: IntranetName rentversion\internet Settings\ZoneMap Value: UNCAsIntranet rentversion\internet Settings\ZoneMap Value: AutoDetect rentversion\internet Settings Value: ProxyEnable Key Name: \REGISTRY\USER\S \Software\Microsoft\windows\Cur rentversion\internet Settings\Connections Value: SavedLegacySettings Key Name: \REGISTRY\MACHINE\Software\Microsoft\Rpc Value: UuidSequenceNumber Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: AppData Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Cache Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Cookies Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: History Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec 10/18

11 Key Name: \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Common AppData Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: AppData Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyEnable Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connec tions Value: SavedLegacySettings Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CachePath Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CachePrefix Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CacheLimit Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CacheOptions Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CachePath Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Ca che\extensible Cache\ietld Value: CacheRepair Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld Value: IETldDllVersionHigh Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld Value: IETldDllVersionLow Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld Value: IETldVersionHigh Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld Value: IETldVersionLow Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld Value: StaleIETldCache Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation Value: TLDUpdates Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: ProxyBypass Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: IntranetName Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: UNCAsIntranet Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa 11/18

12 p Value: AutoDetect Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: ProxyBypass Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: IntranetName Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: UNCAsIntranet Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMa p Value: AutoDetect Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyEnable Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connec tions Value: SavedLegacySettings Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E DF5E45B Value: Blob Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec Key Name: \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value: ParseAutoexec 12/18

13 Deleted Values key rentversion\internet Settings Value: ProxyServer rentversion\internet Settings Value: ProxyOverride rentversion\internet Settings Value: AutoConfigURL rentversion\internet Settings Value: ProxyServer rentversion\internet Settings Value: ProxyOverride rentversion\internet Settings Value: AutoConfigURL Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyServer Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyOverride Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: AutoConfigURL Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyServer Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: ProxyOverride Key Name: \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Value: AutoConfigURL Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates Value: 02FAF3E DF5E45B /18

14 Network Events Remote IP Local IP HTTP Command GET /1010uk1/NODE01/0/51-SP3/0/ GET /1010uk1/NODE01/1/0/0/ GET /beanz/1010uk1.rtf GET /1010uk1/NODE01/41/5/1/ POST /private/sandbox_status.php none none none none GET /msdownload/update/v3/static/trustedr/en/authroots eq.txt GET /msdownload/update/v3/static/trustedr/en/authroots tl.cab 14/18

15 Network Traffic Remote IP Local IP Connection # Connection # Connection # /18

16 DNS Requests Request Result beanztech.com google.com numb.viagenie.ca /18

17 Virus Total Results No Results 17/18

18 Powered by TCPDF ( Analysis # 2956 ThreatTrack Security, Inc. 33 North Garden Avenue, Suite 1200, Clearwater, Florida, USA Telephone: (855) Intl: +1(813) Sales@ThreatTrack.com Disclaimer ThreatTrack Security, Inc. All rights reserved. All product and company names herein may be trademarks of their respective owners. The information and content in this document is provided for informational purposes only and is provided as is with no warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement. ThreatTrack Security, Inc. is not liable for any damages, including any consequential damages, of any kind that may result from the use of this document. The information is obtained from publicly available sources. Though reasonable effort has been made to ensure the accuracy of the data provided, ThreatTrack Security makes no claim, promise or guarantee about the completeness, accuracy, recency or adequacy of information and is not responsible for misprints, out-of-date information, or errors. ThreatTrack Security makes no warranty, express or implied, and assumes no legal liability or responsibility for the accuracy or completeness of any information contained in this document. If you believe there are any factual errors in this document, please contact us and we will review your concerns as soon as practical. 18/18