ID: Sample Name: SSI Set Details.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 01:14:07 Date: 13/04/2018 Version: 22.0.

Transcription

1 ID: Sample Name: SSI Set Details.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 01:14:07 Date: /04/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "SSI Set Details.doc" Indicators Summary Document Summary Streams Stream Path: \x5documentsummaryinformation,, Stream Size: 180 Stream Path: \x5summaryinformation,, Stream Size: 552 Stream Path: 1Table,, Stream Size: 3855 Stream Path: Data,, Stream Size: 6 Table of Contents Stream Path: WordDocument,, Stream Size: Copyright Joe Security LLC 2018 Page 2 of

3 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3428 Parent PID: 3008 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 01:14:07 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 57s light SSI Set Details.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windoc@1/7@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 684 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of

7 Click to jump to signature section Networking: Downloads files Urls found in memory or binary System Summary: Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Reads ini files Reads software policies Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Document has a 'codepage(doc)' value indicative for goodware Document has a 'template' value indicative for goodware Uses new MSVCR Dlls Document has a 'vbamacros' value indicative for goodware Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of

8 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: SSI Set Details.doc Startdate: /04/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description 01:14:43 API Interceptor 3x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2018 Page 8 of

9 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of

10 Startup System is w7 WINWORD.EXE (PID: 3428 cmdline: '' /n 'C:\Users\user\Desktop\SSI Set Details.doc 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0F0D8D-A71E-40B5-A535-F6F82B180D4}.tmp Process: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: 5D4D4EE7E06BBB0AF B23A DBB11141C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C1454AFDA51624BC2BB2F28BA4 high, very likely benign file Copyright Joe Security LLC 2018 Page 10 of

11 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7AC6BA38-ACF FB-8F5E7EDC83}.tmp Process: Size (bytes): 36 Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: 52FD1EB5CE0E7716D14E7D62A6C A063BB5EF ABE1E18AA5CDA21E81E 4FF5BAAFBE A37C7C6A1BEDB3F6284D7F47665CDE F D67AA06ACE61D060A87FE04BD5545B35DB4EF8A64542A35C0F1770A1AEBF8850CC8C3505F07B0F 6AA5EE602661F878B324DB82C3B3EE6D6A low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SSI Set Details.LNK Process: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :5: , mtime=sun Sep 24 :5: , atime=thu Apr 23:14: , length=4184, window=hide Size (bytes): 2140 Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: 7B8648E0FF AEF4C0BE F37B3E4ACD866E5B DCCBE851 2E2C6C26F2420EFA05476C8DBD5305EB854D2CFBD CA0D141CFF 5202D787EAE45D411AA234780B2A76CFBF566D487181B EFC7B55B371AD5EF178BBA45A007AC5464F DF811A EF510F8633F518 low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: Size (bytes): 83 ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: E8C40400CAB5E1B23F245775D D17420BFA6DEF042A6DF4F7405B082E F1BCA5BD22F02C748A42C2A631B4E34035B6A114FF8F644EA26631CA30AA A741E2EF670703F64C8E64D1BC22F180C1C6E3020B6184AE381C38C418D8DE2C6B0CF54821CCED 773BD51AEED08FF1704C01F445C027AD17 low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: Size (bytes): 162 Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN040.lex Process: Little-endian UTF-16 Unicode text, with no line terminators Size (bytes): 2 Entropy (8bit): 1.0 Encrypted: F3B25701FE362EC84616A3A45CE8 D62636D8CAECF04E28442A0A6FA1AFEB024BBB SHA-256: B3D510EF04275CA8E68E5B3CBB0ECE34EF252F0CDC83EEE34740A220 Copyright Joe Security LLC 2018 Page 11 of

12 C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN040.lex SHA-5: Malicious: 8C5F56F3DE34060CE58EB7DAC1117F0D4DFFEC4B24FF84510F4B6FFAFD608C0A3DEAC3CFD210F 0EFAF F755ABFDF1C54CA0D84 moderate, very likely benign file C:\Users\user\Desktop\~$I Set Details.doc Process: Size (bytes): 162 Entropy (8bit): Encrypted: SHA-256: SHA-5: Malicious: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: File name: File size: 4184 SHA256: SHA5: File Content Preview: Generic OLE2 / Multistream Compound File (8008/1) % SSI Set Details.doc b07ea b768bb27ccf7886eae2 1ebeced3bc8d1011f03a381cf380c47dbbf16c d37ddd8d6e142442d6cf352501cab7d14c71b7a746 a82ebb2dba402b66b8 84a7788f80b063757dd8522c4b114f0108c55645bac1d 34de4ac67c7ba4b0eee66bbd5328f888c54ff2df476d1e 07a306477b3187fe462ecb54bbb !...N...M...P File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 Copyright Joe Security LLC 2018 Page of

13 OLE File "SSI Set Details.doc" Indicators Has Summary Info: True Application Name: Microsoft Office Outlook Encrypted Document: Contains Word Document Stream: True Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Summary Code Page: 00 Title: Banca CR Firenze SpA Subject: Author: akhtar Keywords: Comments: Template: Normal_Wordconv.dotm Last Saved By: parkerm3 Revion Number: 2 Total Edit Time: 60 Last Printed: :00:00 Create Time: :52:00 Last Saved Time: :52:00 Number of Pages: 1 Number of Words: 0 Number of Characters: 0 Creating Application: Microsoft Office Outlook Security: 0 Document Summary Document Code Page: 00 Number of Lines: 0 Number of Paragraphs: 0 Company: Reed Elsevier Application Version: Streams Stream Path: \x5documentsummaryinformation,, Stream Size: 180 Stream Path: Stream Size: 180 Entropy: Base64 Encoded: \x5documentsummaryinformation Data ASCII: , H l t R. e. e. d.. E. l. s. e. v. i. e. r Data Raw: fe ff d5 cd d5 c 2e 1b b 2c f ae f c c b f e Stream Path: \x5summaryinformation,, Stream Size: 552 Stream Path: \x5summaryinformation Stream Size: 552 Entropy: Base64 Encoded: Copyright Joe Security LLC 2018 Page of

14 Data ASCII: O h ' T \\ h p a. k. h. t. a. Data Raw: fe ff e0 85 f f2 f 4f ab b 27 b3 d f a b c c cc d b e f d c Stream Path: 1Table,, Stream Size: 3855 Stream Path: Stream Size: Table Entropy: Base64 Encoded: Data ASCII: n Data Raw: 6e b 01 0f f f f f f f f Stream Path: Data,, Stream Size: 6 Stream Path: Stream Size: 6 Entropy: Base64 Encoded: Data ASCII: Data Raw: Data... $.. $. I f F. m. ) # Z ) d ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 08 d6 ca 00 0 a6 ff b 6d b f3 1c b6 1e cb 20 ba 23 5a Stream Path: WordDocument,, Stream Size: Stream Path: Stream Size: WordDocument Entropy: Base64 Encoded: True Data ASCII:....! ` A W N D.. >.. > # F F... " " " " F Z Z Z Z D. Data Raw: ec a5 c f8 bf e e e e c e c b 0c ff ff 0f ff ff 0f Network Behavior No network behavior found Copyright Joe Security LLC 2018 Page 14 of

15 Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3428 Parent PID: 3008 Start time: 01:14:43 Start date: /04/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: '' /n 'C:\Users\user\Desktop\SSI Set Details.doc 0x2fb bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count File Path Completion Count Old File Path New File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 2018 Page of