ID: Sample Name: FsQHOWXph8.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:31:13 Date: 16/03/2018 Version:

Transcription

1 ID: Sample Name: FsQHOWXph8.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:31: Date: 16/03/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "FsQHOWXph8.doc" Indicators Streams Stream Path: \x1ole, File Type: data, Stream Size: 272 Stream Path: \x3linkinfo, File Type: data, Stream Size: 183 Table of Contents Stream Path: \x3objinfo, File Type: Non-ISO extended-ascii text, with no line terminators, Stream Size: 6 Network Behavior Code Manipulations Statistics Copyright Joe Security LLC 2018 Page 2 of

3 System Behavior Analysis Process: WINWORD.EXE PID: 3420 Parent PID: 244 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 14

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 20:31: Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 45s light FsQHOWXph8.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.windoc@1/5@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Found content warning dialog Click Ok Number of clicks 40 Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 14

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 14

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 14

7 Click to jump to signature section Networking: Downloads files Urls found in memory or binary data System Summary: Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Document has a 'vbamacros' value indicative for goodware Classification label Creates files inside the user directory Creates temporary files Document contains summary information with irregular field values Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Document contains no OLE stream with summary information Document has an unknown application name Document misses a certain OLE stream usually present in this Microsoft Office document type Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 14

8 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: FsQHOWXph8.doc Startdate: 16/03/2018 Architecture: WINDOWS Score: 1 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description 20:31:50 API Interceptor 3x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample Source Detection Scanner Label Link FsQHOWXph8.doc 5% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Copyright Joe Security LLC 2018 Page 8 of 14

9 Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 2018 Page of 14

10 Startup System is w7 WINWORD.EXE (PID: 3420 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\FsQHOWXph8.doc MD5: 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6852B81-D171-43F7-B465-C53E2F8AB3D}.tmp File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 5D4D4EE7E06BBB0AF B23A DBB11141C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C1454AFDA51624BC2BB2F28BA4 high, very likely benign file C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\FsQHOWXph8.LNK Copyright Joe Security LLC 2018 Page 10 of 14

11 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\FsQHOWXph8.LNK File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :5: , mtime=sun Sep 24 :5: , atime=fri Mar 16 1:31: , length=2560, window=hide Size (bytes): 200 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FDEB6074D6CFEC87A6D6CF7C037433A0 C6ADA00AAAA4DC8203A58FFDD752BAF7FA2 7236C3D35287AE3C8EC62A6FE3085D05B15031DEB4F5C7F387D87B1B 7ECB1B800BBA1ED8F6F2532DA C4348BE5F0D1D0CF563A D2F218877F8B14521B2D3BC23E76 3CB2D028684F4C2F3F7D4F574DF37885C7D low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat File Type: Size (bytes): 68 ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: A21F3EC4C30A68C0D DD5E4C 88C82E55D6555A33F B6ADD50BE58BC F6CB4FD2AFF5D5D4DFD440F8D82CAC21005F7EB153A3F60AB23720DDB30F3 E EB32A614ADCCB0CF821FB40E46BE75ACFF2EA31A4B4DB05D7AF402D1EB0D67508FDB4154 E02AFF3DBBF31E3F1010EC5A724AF3A76027 low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm File Type: data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 moderate, very likely benign file C:\Users\user\Desktop\~$QHOWXph8.doc File Type: data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 2018 Page 11 of 14

12 Static File Info File type: Entropy (8bit): TrID: File name: File size: 2560 MD5: SHA1: SHA256: SHA5: Composite Document File V2 Document, No summary info Generic OLE2 / Multistream Compound File (8008/1) % FsQHOWXph8.doc dc870ccfe5bf207fd8cfe223dd4b86 a07aabbce2cfb c5db588b6b257a0eb db6ef28cb4df57f530be4be253267a a6dd2 e a1e2d 5f00db8ae1afc327cdda3bb3b1e37af87fb1dbf3fbe 63ef2567f6a f225ef6a050a23eb528c8e83b d6a5c166da35e22f776ae48003cbf2fb File Content Preview:...> File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 OLE File "FsQHOWXph8.doc" Indicators Has Summary Info: Application Name: unknown Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Streams Stream Path: \x1ole, File Type: data, Stream Size: 272 Stream Path: File Type: Stream Size: 272 \x1ole Entropy: Base64 Encoded: Data ASCII: data F F % T M P % \\ X X N L 7 T H S Y U N M 8 V A. s c t %. T. M. P. %. \\. X. X. N. L. 7. T. H. S. Y. U. N. M. 8. V. A... s. c. t u ~ * F Data Raw: c c c a d c e 4c e 4d e e 00 ad de Stream Path: \x3linkinfo, File Type: data, Stream Size: 183 Copyright Joe Security LLC 2018 Page of 14

13 Stream Path: File Type: Stream Size: 183 Entropy: 0.0 Base64 Encoded: \x3linkinfo Data ASCII: Data Raw: data Stream Path: \x3objinfo, File Type: Non-ISO extended-ascii text, with no line terminators, Stream Size: 6 Stream Path: \x3objinfo File Type: Non-ISO extended-ascii text, with no line terminators Stream Size: 6 Entropy: Base64 Encoded: Data ASCII:. f `. 7. Data Raw: a6 37 b5 Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3420 Parent PID: 244 Start time: 20:31:48 Start date: 16/03/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Deskt op\fsqhowxph8.doc 0x2f8d bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities Copyright Joe Security LLC 2018 Page of 14

14 File Path Access Attributes Options Completion Count Source Address Symbol File Path Completion Count Source Address Symbol Old File Path New File Path Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Key Path Name Type Old Data New Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 14 of 14