ID: Sample Name: MSM- 24_Supply_List RU_518.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 17:15:48 Date: 19/06/2018 Version: 22.0.

Transcription

1 ID: Sample Name: MSM- 24_Supply_List RU_518.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 17::48 Date: 1/06/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "MSM-24_Supply_List RU_518.doc" Indicators Summary Document Summary Streams Stream Path: \x1compobj, data, Stream Size: 1 Table of Contents Stream Path: \x5documentsummaryinformation, FoxPro FPT, blocks size 256, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation, FoxPro FPT, blocks size 256, next free block index , Stream Size: 406 Copyright Joe Security LLC 2018 Page 2 of

3 Stream Path: 1Table, ARC archive data, crunched, Stream Size: 31 Stream Path: Data, MPEG-4 LOAS, 8 or more streams, Stream Size: Stream Path: MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Item, ASCII text, with no line terminators, Stream Size: 216 Stream Path: MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Properties, XML document text, Stream Size: 341 Stream Path: WordDocument, data, Stream Size: 275 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 34 Parent PID: 280 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 16

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 17::48 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 52s light MSM-24_Supply_List RU_518.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windoc@1/6@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 86 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 16

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 16

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Vulnerabilities Software Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 16

7 Click to jump to signature section Software Vulnerabilities: Allocates a big amount of memory (probably used for heap spraying) Networking: Downloads files Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Document contains summary information with irregular field values Reads ini files Reads software policies Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Submission file is bigger than most known malware samples Uses new MSVCR Dlls Document has a 'lastprinted' value indicative for goodware Document has a 'vbamacros' value indicative for goodware Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Document contains OLE streams with high entropy indicating encrypted embedded content Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 16

8 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: MSM-24_Supply_List RU_518.doc Startdate: 1/06/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description 17:16:46 API Interceptor 3x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample Source Detection Scanner Label Link MSM-24_Supply_List RU_518.doc 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 2018 Page 8 of 16

9 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 16

10 Startup System is w7 WINWORD.EXE (PID: 34 cmdline: 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\MSM-24_Supply_List RU_518.doc MD5: 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{87716E38-32F A358-EF0A80280E}.tmp Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 5D4D4EE7E06BBB0AF B23A DBB111C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C54AFDA51624BC2BB2F28BA4 high, very likely benign file Copyright Joe Security LLC 2018 Page 10 of 16

11 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8D D3-47B6-B02E-7B76BE660AD}.tmp Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 36 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FA0436ED54B57B05C160C8E5E BB26304D4BA433BDEFAA7C7207FE5461B6FE2C 3AA1A0107ACFD5AA8340BCF077774A043FD563AFFE1DA23338F5175ADA AAF2D8C33F1EFDC8C6427EC57DACB27BAE1728EEF36516F8C4FDBC26A1233AFB2054C5E6C8F C7738CE2402CA2410C35D1C217A816CAA543 low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MSM-24_Supply_List RU_518.LNK Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :5: , mtime=sun Sep 24 13:5: , atime=tue Jun 1 :16: , length= , window=hide Size (bytes): 2250 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: AED03AB75AC6F22206B7E31D54EBAE A6EEFFE1BAD4F27CF28C48574DEBDEE624C2F 8D2FA44E808407D5B1AE70834BAFA0FFE54E3D634C88EC1ED26E6D0D21 E6BD1E6F506CA0B6A0FA77220C3F73E2D6B8EEED260E6E400ABC620F6656E2D5CA86BC3C73634ACE 5B2A0328F2CCC5D63B22213FFB25E61B low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: Size (bytes): 116 C:\Program Files\Microsoft Office\Office\WINWORD.EXE ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 1FB641EFBF5AA54DC3A5AE52F3E4B6 76D556FF5F88C0BF7AB8580D8F04F0DD820 CD5D3EC2A8E81E73E6C65DA52DC4CB25D8ABAE2D6DCB8C5FD1A1E2AD75E7D CAE0DB8BF52AFBD2A13FAE2383C030BEDCB1C56D5CB6B077DDFEDA7A8535F52B0C A68AA8BAEC2 8DF EBF8F21DD887B373252C752E4B00 low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file C:\Users\user\Desktop\~$M-24_Supply_List RU_518.doc Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: FF21ADF1F74826EE3AA31EA36ADEC1C SHA1: E647BCB5778C1D08CB02D73ECD04823B5C5 SHA-256: 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 Copyright Joe Security LLC 2018 Page 11 of 16

12 C:\Users\user\Desktop\~$M-24_Supply_List RU_518.doc SHA-5: Malicious: Reputation: A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE248162D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: Microsoft Word document (3200/1) 52.8% Microsoft Word document (old ver.) (1008/1) 31.41% Generic OLE2 / Multistream Compound File (8008/1) 13.23% Java Script embedded in Visual Basic Script (00/0) 2.48% File name: File size: MD5: SHA1: SHA256: SHA5: File Content Preview: MSM-24_Supply_List RU_518.doc 0bde6630f6f1fc5c81f4fe23e352 d3886dbb6abda5b2f80e2804d260adb010b7 54bd36ec87e0323f dde17425eba4c345ca73df fe a42e8ff dfecb fa3bf8a658d218c11f64cecbb725348c 4b44db5577b56e0371eec5b6fde2c6befd85270d 4dd6034d4cfa84ebc5c3aaf372034e23...>...S...g)...j)...)...)... )...)...)...)...)...)...)...)...)...).. )..!)..")..#)..$)..%)..&)..')..()..)).. *)..+)..,)..-)...)../)..0)..1)..2)..3)..4)..5)..6)..7)..8)..)..:)..;)..< )..=)..>)..?)..@). File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 OLE File "MSM-24_Supply_List RU_518.doc" Indicators Has Summary Info: Application Name: Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: True Microsoft Office Word True Copyright Joe Security LLC 2018 Page of 16

13 Indicators Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Summary Code Page: Title: Subject: Author: Michael B. McGannon, MD Keywords: Comments: Template: Normal.dotm Last Saved By: EXT McGANNON Michael Revion Number: 2 Total Edit Time: 0 Last Printed: :55:00 Create Time: :32:00 Last Saved Time: :32:00 Number of Pages: 3 Number of Words: 51 Number of Characters: 3371 Creating Application: Microsoft Office Word Security: 0 Document Summary Document Code Page: Number of Lines: 28 Number of Paragraphs: 7 Thumbnail Scaling Desired: Company: Contains Dirty Links: Shared Document: Changed Hyperlinks: Application Version: Streams Stream Path: \x1compobj, data, Stream Size: 1 Stream Path: Stream Size: 1 \x1compobj Entropy: Base64 Encoded: Data ASCII: data True F... M i c r o s o f t W o r d D o c u m e n t..... M S W o r d D o c..... W o r d. D o c u m e n t q Data Raw: fe ff 03 0a ff ff ff ff c d f 73 6f f d f d 65 6e a d f f f e 44 6f d 65 6e 74 2e f4 3 b Stream Path: \x5documentsummaryinformation, FoxPro FPT, blocks size 256, next free block index , Stream Size: 406 Stream Path: \x5documentsummaryinformation FoxPro FPT, blocks size 256, next free block index Stream Size: 406 Entropy: Base64 Encoded: Data ASCII: ,.. D ,.., h p ' s Data Raw: fe ff a 0d d5 cd d5 c 2e 1b b 2c f ae d5 cd d5 c 2e 1b b 2c f ae 2c e c f c c b Copyright Joe Security LLC 2018 Page 13 of 16

14 Stream Path: \x5summaryinformation, FoxPro FPT, blocks size 256, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation FoxPro FPT, blocks size 256, next free block index Stream Size: 406 Entropy: Base64 Encoded: Data ASCII: O h ' $ P \\ h t ' M i c h a e l B. M c G a n Data Raw: fe ff a 0d e0 85 f f2 f 4f ab b 27 b3 d a a ac b d e f Stream Path: 1Table, ARC archive data, crunched, Stream Size: 31 Stream Path: 1Table Stream Size: 31 ARC archive data, crunched Entropy: Base64 Encoded: True Data ASCII:.. #..... w v... v... v... v... v... v... v... v... v > Data Raw: 1a f e e e e e e e e Stream Path: Data, MPEG-4 LOAS, 8 or more streams, Stream Size: Stream Path: Stream Size: Entropy: Base64 Encoded: Data MPEG-4 LOAS, 8 or more streams Data ASCII: V. 3. D. d N. ; S... B.... A I. M. G. _ I. M. G. _ " R ] n 7... E E.. d. 8 _.. ^ D F.. V. 3. Data Raw: True 56 f c0 4e 10 3b ac 01 8d f f b2 04 0a f a b f c ff c3 00 Stream Path: MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Item, ASCII text, with no line terminators, Stream Size: 216 Stream Path: Stream Size: 216 Entropy: Base64 Encoded: Data ASCII: MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Item ASCII text, with no line terminators < b : S o u r c e s S e l e c t e d S t y l e = " \\ A P A. X S L " S t y l e N a m e = " A P A " x m l n s : b = " h t t p : / / s c h e m a s. o p e n x m l f o r m a t s. o r g / o f f i c e D o c u m e n t / / b i b l i o g r a p h y " x m l n s = " h t t p : / / s c h e m a s. o p e n x m l f o r m a t s. o r g / o f f i c e D o c u m e n t / / b i b l i o g r a p h y " > < / b : S o u r c e s > Data Raw: 3c 62 3a 53 6f c c 65 3d 22 5c e c c 65 4e 61 6d 65 3d d 6c 6e 73 3a 62 3d a 2f 2f d e 6f e 78 6d 6c 66 6f 72 6d e 6f f 6f f d 65 6e 74 2f f c 6 6f Stream Path: MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Properties, XML document text, Stream Size: 341 Copyright Joe Security LLC 2018 Page of 16

15 Stream Path: Stream Size: 341 MsoDataStore/S\x223\x207L\x206ROTRH\x2\x206MGZG\x183G\x4\x==/Propertie s XML document text Entropy: Base64 Encoded: Data ASCII: <? x m l v e r s i o n = " 1. 0 " e n c o d i n g = " U T F - 8 " s t a n d a l o n e = " n o "? >.. < d s : d a t a s t o r e I t e m d s : i t e m I D = " { B C B F B 4 B D A E D 1 A 0 7 A } " x m l n s : d s = " h t t p : / / s c h e m a s. o p e n x m l f o r m a t s. o r g / o f f i c e D o c u m e n t / / c u s t o m X m l " > < d s : s c h e m a R e f s > < d s : s c h e m a R e f d s : u r i = " h t t p : / / s c h e m a s. o p e n Data Raw: 3c 3f 78 6d 6c f 6e 3d e e 63 6f e 67 3d d e c 6f 6e 65 3d 22 6e 6f 22 3f 3e 0d 0a 3c a f d a d d 22 7b d d d d d d 6c True Stream Path: WordDocument, data, Stream Size: 275 Stream Path: Stream Size: 275 WordDocument Entropy: Base64 Encoded: Data ASCII: data True b j b j r = r = r... W. _ W. _ z K K K K K _ _ _ L. Data Raw: ec a5 c1 00 8b f8 bf fc e a 62 6a 72 3d 72 3d ac 5f ac 5f 7a 0f dd ff ff 0f ff ff 0f Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 34 Parent PID: 280 Start time: 17:16:46 Start date: 1/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: C:\Program Files\Microsoft Office\Office\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\MSM- 24_Supply_List RU_518.doc 0x2f Copyright Joe Security LLC 2018 Page of 16

16 File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Completion Count Source Address Symbol Old File Path New File Path Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Key Path Name Type Old Data New Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 16 of 16