ID: Sample Name: PO xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03:13:36 Date: 08/01/2018 Version:

Transcription

1 ID: Sample Name: PO xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03::36 Date: 08/01/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "xl/vbaproject.bin" Indicators Streams with VBA VBA File Name: Sheet1.cls, Stream Size: 4848 VBA Code Keywords VBA Code VBA File Name: ThisWorkbook.cls, Stream Size: 985 Table of Contents VBA Code Keywords VBA Code Streams Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 423 Stream Path: PROJECTwm, File Type: data, Stream Size: 62 Copyright Joe Security LLC 2018 Page 2 of

3 Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 28 Stream Path: VBA/dir, File Type: VAX-order 68K Blit (standalone) executable, Stream Size: 523 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: EXCEL.EXE PID: 3296 Parent PID: 2948 File Activities File Written Registry Activities Key Created Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 14

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 03::36 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 9m 50s false light PO xls defaultwindowsofficecookbook.jbs Analysis system description: Windows SP1 (with Office 20 SP2, IE, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled GSI enabled (VBA) mal68.evad.expl.winxls@1/3@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.xls Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 1 Close Viewer Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: EXCEL.EXE Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2018 Page 4 of 14

5 Confidence Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Copyright Joe Security LLC 2018 Page 5 of 14

6 Signature Overview AV Detection Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Antivirus detection for submitted file Networking: Urls found in memory or binary data System Summary: Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Binary contains paths to debug symbols Binary contains paths to development resources Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Document contains embedded VBA macros Document misses a certain OLE stream usually present in this Microsoft Office document type Document contains an embedded VBA macro which executes code when the document is opened / closed Document contains an embedded VBA macro which may execute processes Document contains an embedded VBA macro with suspicious strings Document contains an embedded VBA with functions possibly related to ADO stream file operations Document contains an embedded VBA with functions possibly related to HTTP operations Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 2018 Page 6 of 14

7 Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Detection Cloud Link PO xls 25% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context Copyright Joe Security LLC 2018 Page of 14

8 ASN No context Dropped Files No context Screenshot Startup System is w cleanup EXCEL.EXE (PID: 3296 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /dde MD5: 16335EDBB91DA84FC2425BFDA95E) Created / dropped Files C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO LNK File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep 24 :59: , mtime=sun Sep 24 :59:01 201, atime=mon Jan 8 02:14: , length=581, window=hide Copyright Joe Security LLC 2018 Page 8 of 14

9 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO LNK MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 85F99BA3C9C9DB0686CEB66A62B B59CA93F92356DAB55F64B0C9E26 43B60FBD34B062048BAF5206D2D3D E4BEAE299F A 2FFE3FCA183026A453ECF6E6CDDADE922498E9805B34FA495BDAC2508E8986CEE6988E8ACD1A58D988F0A36F1 59B5FD6D8BBB8B2A8BCC5A09D18626 false low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat File Type: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: ASCII text, with CRLF line terminators F34CAABF5E3393DC0C29CFB633C950 6EB99BF5AF966FF6CAC9B91FF602DB5E01D140 1A E3A5DAF0C002B8D1589BCE8940CF1A84593FDAC26C23FFCE6 F0B416E0566EBC0A00A35DEBD8A89AFC023C8B65850A0D08AD4448CB990FF44E8550B1938EB14568CE6435EBCD552E 693A69EAB044EACE16F4428A3336F false low C:\Users\user\Desktop\~$PO xls File Type: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: data 3DB5C825EB33BE838EB8984C BA62E5D5A234CB3D654A4CDD02F8EAA8BEE0 1C6801A064A0D0FD545EE3F68B65EF2900C0C0E93A2AA64918AE31BC444 2AB92DDAD022614DE5FDAD638EE2D3E496AFCC98DA3C6D96A45A1EE43DB9DCB68B6A651EF9EC2201B688ED2 F055A92DCDC5BCA86F9B966A82A1C563 true moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Microsoft Excel 200+ TrID: File name: File size: 431 MD5: SHA1: SHA256: SHA5: Excel Microsoft Office Open XML Format document with Macro (5504/1) 51.34% Excel Microsoft Office Open XML Format document (50504/1) 45.09% ZIP compressed archive (4004/1) 3.5% PO xls 2d ac693bc08fddf60a5e 691a1998dbd4985dd5a4bf6d428f8ad2060 9a3c6b29f1f882beb03eb55fd16b8ef22b85ee5b16 a216fb19e5e3b03e d3d281be94888d256be059d24295acf0dbbaf4645 8bb1cdad3dd236fea86dee5dea32ea8a5f3f5b5 d636bc3d228eb452d b681d69 File Content Preview: PK...!...5Qo...?...[Content_Types].xml...( File Icon Copyright Joe Security LLC 2018 Page 9 of 14

10 Static OLE Info Document Type: OpenXML Number of OLE Files: 1 OLE File "xl/vbaproject.bin" Indicators Has Summary Info: Application Name: unknown Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: True Streams with VBA VBA File Name: Sheet1.cls, Stream Size: 4848 Stream Path: VBA File Name: Stream Size: 4848 VBA/Sheet1 Sheet1.cls Data ASCII: ^ # x M E Data Raw: f c d ff ff ff ff f 0f e 30 bc a ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword "e""" Shell.write bstrm: bstrm xhttp.open CreateObject("M" CreateObject("Ad" xhttp 'this.type VB_Base "b.s" """brightness" comment "ver" VB_Creatable "TTP") VB_Exposed "GET", xhttp.responsebody AutoOpen() Copyright Joe Security LLC 2018 Page of 14

11 Keyword plpl,.open Attribute VB_PredeclaredId VB_GlobalNameSpace VB_Name "brightness" "p://drsc.rw/fzi/oki" xhttp.send.savetofile VB_Customizable xhttp: VB_TemplateDerived VBA Code VBA File Name: ThisWorkbook.cls, Stream Size: 985 Stream Path: VBA File Name: Stream Size: 985 VBA/ThisWorkbook ThisWorkbook.cls Data ASCII: ^ # x M E Data Raw: f c d ff ff ff ff cb f e b ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable "ThisWorkbook" VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code Streams Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 423 Stream Path: File Type: Stream Size: 423 PROJECT Entropy: Base64 Encoded: Data ASCII: ASCII text, with CRLF line terminators True I D = " { A 1 D E - F 6 8 F - 4 B B E - D 8 E D E E 3 4 } ".. D o c u m e n t = T h i s W o r k b o o k / & H D o c u m e n t = S h e e t 1 / & H N a m e = " V B A P r o j e c t ".. H e l p C o n t e x t I D = " 0 ".. V e r s i o n C o m p a t i b l e 3 2 = " ".. C M G = " F F 8 0 E F C 0 E F C 0 E F C 0 E F C ".. D P B = " A F 4 0 F 5 0 F 5 0 ".. G C = " 0 C 0 E F 0 0 E F F Copyright Joe Security LLC 2018 Page of 14

12 Data Raw: d 22 b d d d d d 22 0d 0a 44 6f d 65 6e 4 3d f 2 6b 62 6f 6f 6b 2f d 0a 44 6f d 65 6e 4 3d f d 0a 4e 61 6d 65 3d f 6a d 0a Stream Path: PROJECTwm, File Type: data, Stream Size: 62 Stream Path: File Type: Stream Size: 62 PROJECTwm Entropy: Base64 Encoded: Data ASCII: T h i s W o r k b o o k. T. h. i. s. W. o. r. k. b. o. o. k... S h e e t 1. S. h. e. e. t Data Raw: f 2 6b 62 6f 6f 6b f b f 00 6f 00 6b data Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 28 Stream Path: File Type: Stream Size: 28 VBA/_VBA_PROJECT Entropy: Base64 Encoded: data Data ASCII:. a *. \\. G. { E. F C }. # #. 9. #. C. :. \\. P. R. O. G. R. A. ~. 2. \\. C. O. M. M. O. N. ~. 1. \\. M. I. C. R. O. S. ~. 1. \\. V. B. A. \\. V. B. A \\. V. B. E.... D. L. L. #. V. i. s. u. a. l.. B. a. s. i. c. Data Raw: cc 61 a ff e fe 00 2a 00 5c b d d d d d e Stream Path: VBA/dir, File Type: VAX-order 68K Blit (standalone) executable, Stream Size: 523 Stream Path: File Type: Stream Size: 523 VBA/dir Entropy: Base64 Encoded: VAX-order 68K Blit (standalone) executable True Data ASCII: *..... p.. H..... d V B A P r o j e. c t.. j... =.... r b. ' \\..... J <..... r. s t d o l e >... s. t. d. o.. l. e... h. %. ^.. * \\ G { C } # 2. 0 # 0. # C : \\ W i n d. o w s \\ s y s t e m 3 2 \\. e 2.. t l b # O L E. A u t o m a t i. o n. `... E O f f D i c. E O. f.. i.. c. E E. 2 D F 8 D 0 4 C. - Data Raw: 01 0 b a e a 00 1c f 6a a a 3d 02 0a a1 2 5c c 02 4a 3c 02 0a f 6c 65 3e f c d e a 5c 4 Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 2018 Page of 14

13 Statistics System Behavior Analysis Process: EXCEL.EXE PID: 3296 Parent PID: 2948 Start time: 03:14:1 Start date: 08/01/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE false 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /dde 0x4a bytes 16335EDBB91DA84FC2425BFDA95E C, C++ or other language moderate File Activities File Path Access Attributes Options Completion Count Address Symbol File Path Completion Count Address Symbol Old File Path New File Path Completion Count Address Symbol File Written File Path Offset Length Value Ascii Completion Count C:\Users\user\Desktop\~$PO xls unknown 55 0e c b e C:\Users\user\Desktop\~$PO xls unknown 1 0e c b e Address Symbol.user success or wait 1 2F86B3AB WriteFile..H.e.r.b..B.l.a.c.k.b.u.r.n success or wait 1 2F86B40A WriteFile Registry Activities Key Created Key Path Completion Count Address HKEY_USERS\Software\Microsoft\VBA success or wait 1 60A4AC61 RegCreateKeyExA HKEY_USERS\Software\Microsoft\VBA\.0 success or wait 1 60A4AC61 RegCreateKeyExA Copyright Joe Security LLC 2018 Page of 14 Symbol

14 Key Path Completion Count Address HKEY_USERS\Software\Microsoft\VBA\.0\Common success or wait 1 60A4AC61 RegCreateKeyExA Symbol Key Path Name Type Data Completion Count Address Symbol Key Path Name Type Old Data New Data Completion Count Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 14 of 14