ID: Sample Name: Liste_az.docx Cookbook: defaultwindowsofficecookbook.jbs Time: 00:17:54 Date: 30/12/2017 Version:

Transcription

1 ID: Sample Name: Liste_az.docx Cookbook: defaultwindowsofficecookbook.jbs Time: 00:17:54 Date: 30/12/2017 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Software Vulnerabilities: Networking: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "word/embeddings/oleobject1.bin" Indicators Streams Stream Path: \x1compobj, data, Stream Size: 72 Stream Path: \x1ole, data, Stream Size: 20 Stream Path: \x1ole10native, data, Stream Size: Stream Path: \x3objinfo, data, Stream Size: Copyright Joe Security LLC 2017 Page 2 of 16

3 Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: WINWORD.EXE PID: 3284 Parent PID: 236 File Activities Registry Activities Analysis Process: javaw.exe PID: 3412 Parent PID: 3284 File Activities File Created File Written Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 16

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 00:17:54 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 10m 32s light Liste_az.docx defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal60.expl.windocx@3/11@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.docx Found Word or Excel or PowerPoint document Simulate clicks Found warning dialog Click Ok Number of clicks 2 Close Viewer Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE, javaw.exe Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2017 Page 4 of 16

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2017 Page 5 of 16

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Detection AV Vulnerabilities Software Networking Summary System Debugging Anti Analysis System Evasion Malware Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2017 Page 6 of 16

7 Click to jump to signature section AV Detection: Antivirus detection for submitted file Software Vulnerabilities: Document exploit detected (process start blacklist hit) Networking: Downloads files Urls found in memory or binary data System Summary: Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Document is a ZIP file with path names indicative for goodware Checks if Microsoft Office is installed Uses new MSVCR Dlls Document has a 'vbamacros' value indicative for goodware Classification label Creates files inside the user directory Creates temporary files Document contains summary information with irregular field values Executable is probably coded in java Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Spawns processes Document contains no OLE stream with summary information Document has an unknown application name Document misses a certain OLE stream usually present in this Microsoft Office document type Document contains OLE streams which likely are hidden ActiveX objects Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Document contains OLE streams with high entropy indicating encrypted embedded content Behavior Graph Copyright Joe Security LLC 2017 Page 7 of 16

8 Hide Legend Behavior Graph ID: Sample: Liste_az.docx Startdate: 30/12/2017 Architecture: WINDOWS Score: 60 started WINWORD.EXE Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious Document exploit detected (process start blacklist hit) started javaw.exe 2 Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Detection Cloud Link Liste_az.docx 22% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2017 Page 8 of 16

9 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 2017 Page of 16

10 Startup System is w7 WINWORD.EXE (PID: 3284 cmdline: 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\Liste_az.docx 5D78FF0BE2A870D ACFDD) javaw.exe (PID: 3412 cmdline: 'C:\Program Files\Java\jre1.8.0_4\bin\javaw.exe' -jar 'C:\Users\HERBBL~1\AppData\Local\Temp\Listehz.jar' F233D34C8F6BB32BB3B3CE7E740EB84) cleanup Created / dropped Files C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc221c7c46.timestamp ASCII text, with CRLF line terminators 2D20DDB67078AA1E6BC83A118DE12 C6B1CFEB173870BE85AA8E05EEBB7A5F 76DEB1FF7ADA6AC CEE5C4C18F0AC4D46F32A605BFE7173BC6EA2C0BF F EE8410A4EB B00EF2CFD3D36386D0AEF85FFF0EF64FC7CB56552DA86F32F73B85C1BC E66B475866BAA7CB25ECE38C84 low C:\Users\HERBBL~1\AppData\Local\Temp\Listehz.jar Zip archive data, at least v2.0 to extract 25ECC6CD2C78E288B3DA3B2C5F4B F52DEF8CCA487E575EFCC6F3FED4BC4076D2F Copyright Joe Security LLC 2017 Page 10 of 16

11 C:\Users\HERBBL~1\AppData\Local\Temp\Listehz.jar 7D1DBD108FCD04B82ABAB6822C78ED E1A68F3BF0EB7DEF1CF AB4004B8E50A10C5EBD37054E5244ABD744DC84301D7F64A0B2FFAEF020EDC850D5C06E7C7E6FB2DEDC AE36F3DCF7D547C20D38FAB3A low C:\Users\HERBBL~1\AppData\Local\Temp\Listehz.jar:Zone.Identifier ASCII text, with CRLF line terminators 833C0EFD FD6A71565CA115CCD 0E6D2A1D4B6AFA705EA6267EEED3655FD2B3BD 4A86B6E7D2544AFC717EAC2B60ADBED0F0C68D4D723B2123F65C64C7657FBF 536C2BB6ED8C10CE8BE01A31BD05FE03D0532B5B4CAA58671F43AD4D65F7F828D8AC1F43A6ADCA DA04CA4DACAEFACB8D01FC48CCEB7A moderate, very likely benign file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C52F448.emf Windows Enhanced Metafile (EMF) image data version 0x BD8060CECA7120F886B7BE31E2AF D52C6BBC32246B62A82D467E53B005EC1D8 2EE68B12DB32BFCC23CF01DA1187EA8CA0187A880B31D4E1A6F5CFC5 CA7118CAF52021E5F1D8A60B38A6AFEE6703B47A1B33CE83BFEC1EBF751CC50D4E1DE580C72565D8B 2F2037AE6D60F735AB2BA60DFF low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C8317A.jpeg JPEG image data, EXIF standard 11D1D51EB470A03FD77AB6ABF5B577A E44EE0C E155CD6E2C5F2CD58BBB2 FB6156C33F061BCFB B70C2C273BEF355334CC0C6EA1CF4376C0B0 F2C5F3E1A220A1D4F0EAC1AC5538C11F1885F332322D48C7FFA86D0FB83748BB3A718D655B02BF5FF47F26A275 EC1F287DEF173D CDD348ED low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0F2C46F-FF F4C6D804A53}.tmp FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" 5D4D4EE7E06BBB0AF B23A DBB111C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A18B7783 F0E1C54AFDA51624BC2BB2F28BA4 high, very likely benign file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{68E775C2-EC55-4E3E-2FD-36EC0C0BD18}.tmp data 57B88BDBDD4346ACBB BD77 B0FE5C4FDBAA E5F8BF36B4B3CA5D80D5A 2B8C50F47D077B203C5170E0D678068AFA2CCB74671B B4641E6 8D112E7B3D1EAF28055B4AA465407B56377EE0EE7BBD0F743466B755D B7A54275FA0DA87C2200A5ED30 3DA08620E6FEBFAC64EF6377A low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Liste_az.LNK MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep 24 :5: , mtime=sun Sep 24 :5: , atime=fri Dec 2 23:18: , length=165870, window=hide 1AF3F8A116472F04D0DE F52F030D1D3B0D BB1771C8334 A67CA8D8202D3E166E CA0455D26A4E3F8E87D80D1E7EE344103F 4A052115AC CAAD5E42675F78EAEA8B F C8DFCFCD430D26488FAC35B8C0B4 1F30C1C BB2F27A6AB5 low Copyright Joe Security LLC 2017 Page 11 of 16

12 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat ASCII text, with CRLF line terminators C57CAED60021B3D753F8D068B6FD5 8BCAB1F786F832C5F3155E0E4A77641D76 A1A7F2BDD5DA8D8BD72178CEEAA C8E1D10A DA17D5D78BEBD16D258B0C1DF882BF3E08F20DB0E382B F707C35FBFDB6C3018FC5C3B121F6BD1A02A5 2584ED BB61A656E5E7ACBF low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm data FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18EF F00B671F751B5FCC3BABB31C5A2 moderate, very likely benign file C:\Users\user\Desktop\~$ste_az.docx data FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18EF F00B671F751B5FCC3BABB31C5A2 moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Microsoft Word TrID: File name: Word Microsoft Office Open XML Format document (41004/1) 68.33% Java Archive (504/1) 22.50% ZIP compressed archive (4004/1) 6.67% Java Script embedded in Visual Basic Script (1500/0) 2.50% Liste_az.docx File size: SHA256: SHA512: c82e8b126460c7038ee7d1256fee8a aff6406e7e aa574b76728a2eae88be 1f53adcd885a3a80deee72ee5bf2bb8d83a120fc 7e2db6df123ed ed702605c74ab48bfcf53c5d07d053b32e28a 6403dc5f4c7f4e200d1d20bde6803caa1c8dfb0f3d7865 afc87bb4eb478a3a8385f572b7e22c7 File Content Preview: PK...!.\...l...[Content_Types].xml...( Copyright Joe Security LLC 2017 Page 12 of 16

13 File Icon Static OLE Info Document Type: OpenXML Number of OLE Files: 1 OLE File "word/embeddings/oleobject1.bin" Indicators Has Summary Info: Application Name: unknown Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Streams Stream Path: \x1compobj, data, Stream Size: 72 Stream Path: Stream Size: 72 \x1compobj Entropy: Base64 Encoded: Data ASCII: /.... {... P a c k a g e P a c k a g e... q Data Raw: fe ff 03 0a ff ff ff ff 20 a7 0d f2 2f c0 ce b a e b b f4 3 b data Stream Path: \x1ole, data, Stream Size: 20 Stream Path: \x1ole data Stream Size: 20 Entropy: Base64 Encoded: Data ASCII: Data Raw: Stream Path: \x1ole10native, data, Stream Size: Stream Path: Stream Size: \x1ole10native Entropy: Base64 Encoded: Data ASCII: S..... L i s t e h z. j a r. C : \\ U s e r s \\ T E S T \\ D e s k t o p \\ L i s t e h z. j a r C : \\ U s e r s \\ T E S T \\ A p p D a t a \\ L o c a l \\ T e m p \\ L i s t e h z. j a r..... P K B B. c l a s s. I z. \\ [ W.. w. C.. c.!. $... L f... < \\ w j.. ~ $.. W... x. x 8.. N z B z w. v J. R.... data True Copyright Joe Security LLC 2017 Page of 16

14 Data Raw: c a 2e 6a a 5c c c b 74 6f 70 5c 4c a 2e 6a d a 5c c c c 4c 6f c 5c d 70 5c 4c a 2e 6a e b fb b c Stream Path: \x3objinfo, data, Stream Size: 6 Stream Path: \x3objinfo data Stream Size: 6 Entropy: Base64 Encoded: Data Data Raw: Network Behavior No network behavior found Code Manipulations Statistics Behavior WINWORD.EXE javaw.exe Click to jump to process System Behavior Analysis Process: WINWORD.EXE PID: 3284 Parent PID: 236 Start time: 00:18:22 Start date: 30/12/2017 Path: C:\Program Files\Microsoft Office\Office\WINWORD.EXE Copyright Joe Security LLC 2017 Page of 16

15 Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\Liste_a z.docx 0x774a bytes 5D78FF0BE2A870D ACFDD Java moderate File Activities File Path Access Attributes Options Completion Count Address Symbol File Path Completion Count Address Symbol Old File Path New File Path Completion Count Address Symbol File Path Offset Length Value Ascii Completion Count Address Symbol Registry Activities Key Path Completion Count Address Symbol Key Path Name Type Data Completion Count Address Symbol Key Path Name Type Old Data New Data Completion Count Address Symbol Analysis Process: javaw.exe PID: 3412 Parent PID: 3284 Start time: 00:18:46 Start date: 30/12/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Program Files\Java\jre1.8.0_4\bin\javaw.exe 'C:\Program Files\Java\jre1.8.0_4\bin\javaw.exe' -jar 'C:\Users\HERBBL~1\AppData\Local\T emp\listehz.jar' 0x6dfe bytes F233D34C8F6BB32BB3B3CE7E740EB84 C, C++ or other language moderate File Activities File Created File Path Access Attributes Options Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\hsperfdata_user C:\Users\HERBBL~1\AppData\Local\Temp\hsperfdata_user\3412 read data or list directory and synchronize normal read attributes none and delete and synchronize and generic read and generic write Address Symbol directory file and object name collision 1 5E1A505B CreateDirectoryA synchronous io non alert and open for backup ident and open reparse point synchronous io non alert and n on directory file and delete on close success or wait 1 5E1A5158 CreateFileA Copyright Joe Security LLC 2017 Page 15 of 16

16 File Written File Path Offset Length Value Ascii Completion Count C:\ProgramData\Oracle\Java\.or acle_jre_usage\17dfc221c7c46.timestamp unknown a 5c f d c c 4a c 6a e 38 2e 30 5f d 0a d 0a C:\Program Files\Java\jre1.8.0 _ Address Symbol success or wait 1 6DFBA287 WriteFile Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 16 of 16