ID: Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/2018 Version:

Transcription

1 ID: Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 3064 Parent PID: 640 General File Activities Disassembly Copyright Joe Security LLC 201 Page 2 of

3 Code Analysis 14 Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 23:23:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 35s false light urldownload.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean0.win@1/1@2/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 14

6 Networking System Summary Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Behavior Graph Copyright Joe Security LLC 201 Page 6 of 14

7 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped URL: Startdate: 11/01/201 Architecture: WINDOWS Score: 0 started Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language wget.exe Is malicious 1 xtrapath3.izatcloud.net , 49165, 0 AMAZON-02-AmazoncomIncUS United States Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Source Detection Cloud Link xtrapath3.izatcloud.net 0% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 14

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 14

9 Startup System is w7 wget.exe (PID: 3064 cmdline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' MD5: 34C709455BFEFB9B0E976BAD13AF4) cleanup Created / dropped Files C:\Users\user\Desktop\download\xtra3grc.bin File Type: data Size (bytes): Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false EB2D3EAFD270C233556AF4B03CADA21 E55AC03210C9566CD CA47A723F2941B F4EBDC3CCA7B7FF47ED7E F4F1C733E72E4D5A174C DFE0F40F659F7DB7036E963BF2307F6D5A916A02B666E947AD359A37A331C756F5E733EF46162CE91E9B AD6BA755AAEBC674C12D2A1A200B5DBACA4 false low Copyright Joe Security LLC 201 Page 9 of 14

10 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection xtrapath3.izatcloud.net true false 0%, virustotal, Browse Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States AMAZON-02-AmazoncomIncUS false Static File Info No static file info Network Behavior Network Port Distribution Total Packets: 22 0 (HTTP) 53 (DNS) Copyright Joe Security LLC 201 Page 10 of 14

11 TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Copyright Joe Security LLC 201 Page 11 of 14

12 Timestamp Source Port Dest Port Source IP Dest IP Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET Jan 11, :24: CET UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET Jan 11, :23: CET DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Jan 11, :23: CET x1eda Standard query (0) xtrapath3. izatcloud.net A (IP address) IN (0x0001) Jan 11, :23: CET x1eda Standard query (0) xtrapath3. izatcloud.net A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Jan 11, x1eda No error (0) xtrapath3. 23:23: izatcloud.net CET Jan 11, x1eda No error (0) xtrapath3. 23:23: izatcloud.net CET A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph xtrapath3.izatcloud.net HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\wget.exe Timestamp Jan 11, :23: CET Jan 11, :24: CET kbytes transferred Direction Data 0 OUT HEAD /xtra3grc.bin HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: */* Host: xtrapath3.izatcloud.net Connection: Keep-Alive 1 IN HTTP/ OK Content-Type: application/octet-stream Content-Length: Connection: keep-alive Date: Thu, 11 Jan :53:15 GMT Last-Modified: Thu, 11 Jan :43:09 GMT ETag: "eb2d3eafd270c233556af4b03cada21" Cache-Control: max-age=900 x-amz-meta-source: WS0.YYZ Accept-Ranges: bytes Server: AmazonS3 Age: 47 X-Cache: Hit from cloudfront Via: 1.1 f1afacded5dbe063f3cfe6da61fdea64.cloudfront.net (CloudFront) X-Amz-Cf-Id: 6qgMBeoIxQLhZKglWex9AkiPry1gQr_xgedMDjMOqD2OUjXjmEAHIg== Copyright Joe Security LLC 201 Page 12 of 14

13 Timestamp Jan 11, :24: CET Jan 11, :24: CET kbytes transferred Direction Data 1 OUT GET /xtra3grc.bin HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: */* Host: xtrapath3.izatcloud.net Connection: Keep-Alive 3 IN HTTP/ OK Content-Type: application/octet-stream Content-Length: Connection: keep-alive Date: Thu, 11 Jan :53:15 GMT Last-Modified: Thu, 11 Jan :43:09 GMT ETag: "eb2d3eafd270c233556af4b03cada21" Cache-Control: max-age=900 x-amz-meta-source: WS0.YYZ Accept-Ranges: bytes Server: AmazonS3 Age: 47 X-Cache: Hit from cloudfront Via: 1.1 f1afacded5dbe063f3cfe6da61fdea64.cloudfront.net (CloudFront) X-Amz-Cf-Id: JlwABkArkPbzYkf23zYmOK6GWE0rw6pmjASAWRC4FdyXveRLL_DFw== Data Raw: a a bb d fd b 07 bf f bf 07 bf 19 1b c c f a2 1f a2 1f f5 ed a2 1f a2 1f a2 1f f5 ed a2 20 a2 20 a2 1f a2 1f f5 ed ba ba c b a f d 1d a a2 22 a2 1f f5 ed 00 0 a2 1f a2 1f a2 20 f5 ed a2 1f a2 1f a2 1f a2 1f f5 ed ba bb c c2 1f b fd a1 0d 14 ff f6 02 cd f bc e3 ff e bf fd a1 0c ea ff f3 a2 fd ff b2 09 b a f0 ff fd 07 bf a 90 0b c7 fd a1 0c 2a a 1e e5 ec 00 2e d5 d7 ff f bf b fd a1 0c f a c1 4 ff d0 9a dd ff ee bf e5 fd a1 0c 19 ff f5 ab e3 ff cb c b4 01 b bf b b 9 fd a1 0d e6 ff 9 4f c f a ff ff 07 bf a c fd 3f 00 a1 0 d 96 ff ca a5 c1 ff e7 bb d7 ff c3 bc 43 ff a bf fd 4a 00 a1 0d 1f 00 4a a4 ca ff bb cb cd bf 0a eb 90 0b db fd a1 0c e ff b bf 0b f 90 e6 d6 fd a1 0d f ff e4 fb 7f c 1a 00 3c fc ff bf 0c ab 90 1d b fd 4f 00 a1 0c ef ff a2 f e0 d ff ff 07 bf 0d 00 1e e4 fd a1 0c d6 00 4f ed fa b0 c f ec ff 9c bf 0e 00 4b e 90 0c 03 fd a1 0d 5f 00 4e 42 2d ff b ff a3 d 66 ff 9f bf 0f f6 97 fd a1 0c da e5 b2 00 1a de 4a ff e 7c 67 fe bf f d d3 fd 4e 00 a1 0c 2f ff a3 b c ad ff d6 6a ca bf fd a1 0d 9a ff cd 1f 1e ff b ff ae 1 23 ff bf c 90 f5 9 fd a1 0c a 00 1e 46 ab ff b 4a 16 ff ee ab f bf f b d6 fd 4e 00 a1 0d 33 ff cf 0c a2 00 2d 53 6b fe 1a bf a 90 f6 7e fd a1 0d ab 00 1c 32 a fa 15 ff a bf c6 d fd a1 0d e3 ff f3 f4 33 ff be cf 9d fe bf a ec 90 f4 51 fd 2f 00 a1 0c 6a 00 1e 40 9e ff bd ff fe f4 ff fc 07 bf d fd a1 0c a a1 01 ff 9e ee 32 ff 1a bf ac fd a1 0c e b 3d c e9 43 ff d bf fd a1 0d 3a ff a bc 1c e 53 fd dd ff fe 07 bf 1a Data Ascii: 2jPVsX-44BOG z.+b@bhiwc[`@vo<?cjjfwyq U(7Bqc_'F<77O%"A$uUY OBu_KR_NB-YrfS0GJ gon/j$e9pri#w\5fjon3-sk)%j~52gsp!r3y&0:q/j@graw@gjwy26utt;=<bc9f:s S Code Manipulations Statistics System Behavior Analysis Process: wget.exe PID: 3064 Parent PID: 640 General Start time: 23:23:1 Start date: 11/01/201 Path: Wow64 process (32bit): Commandline: C:\Windows\System32\wget.exe false wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --useragent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' rapath3.izatcloud.net/xtra3grc.bin' Copyright Joe Security LLC 201 Page 13 of 14

14 Imagebase: File size: MD5 hash: Programmed in: Reputation: 0x755c bytes 34C709455BFEFB9B0E976BAD13AF4 C, C++ or other language low File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14