ID: Sample Name: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc Cookbook: defaultwindowsofficecookbook.

Transcription

1 ID: Sample Name: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 08:43:14 Date: 10/06/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc" Indicators Summary Document Summary Streams Stream Path: \x1compobj, File Type: data, Stream Size: 113 Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: 1Table, File Type: data, Stream Size: Copyright Joe Security LLC 2018 Page 2 of 16

3 Stream Path: Data, File Type: dbase IV DBT, blocks size , next free block index 10257, 1st item "\002\010\006\007\001\005\011\004\003\377\304", Stream Size: Stream Path: WordDocument, File Type: data, Stream Size: Network Behavior Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 336 Parent PID: 288 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 16

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 08:43:14 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 4m 13s light TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windoc@1/6@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 656 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 16

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 16

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 16

7 Click to jump to signature section Networking: Downloads files Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Reads ini files Reads software policies Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Document has a 'vbamacros' value indicative for goodware Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Document contains OLE streams with high entropy indicating encrypted embedded content Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 16

8 ID: Behavior Graph Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear P... Startdate: 10/06/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description 08:43:46 API Interceptor 3x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 2018 Page 8 of 16

9 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 16

10 Startup System is w7 WINWORD.EXE (PID: 336 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0 130N SALMAN - Dear Prime Minister.doc MD5: 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E8DDB1E-37D5-46A4-AB5B-D1D75A1755C}.tmp Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 5D4D4EE7E06BBB0AF B23A DBB11141C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C1454AFDA51624BC2BB2F28BA4 high, very likely benign file Copyright Joe Security LLC 2018 Page 10 of 16

11 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.LNK Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :5:2 2017, mtime=sun Sep 24 13:5:2 2017, atime=sun Jun 10 06:43: , length=111616, window=hide Size (bytes): 260 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 78B77D67DC54FFB0DD1A4774FD4F26B8 487A5067A810BAFA278822C4CBFE E FF5D7DB5762A7A81B4FFC1CD4AB38C7CF7F06EADF24AA647332FFCA 3F101C8B71AB25A0C6DA86BC86CD54BA28343C AF7D17BBC70181C42244D53CBF87D8BBB EA365FC22FBD B56876DE88DD6FC64 low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: File Type: Size (bytes): 248 C:\Program Files\Microsoft Office\Office14\WINWORD.EXE ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: B53AB65BEEDAD3F646E8F806EE C0FAC4C562CE66CF300A113530BFA8D160 B D7A7B130BFC0EBF7A0111DCDFFD77D7108D102435B7C8EBB5A F5231BF5DBB1EB0CA16FF FFB0CC E022FF7277C57C02F54252D8E05EE060D5335 CDF686A45B57238FC7B08CC6AA42142EBA low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: File Type: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN040.lex Process: File Type: Size (bytes): 2 Entropy (8bit): 1.0 Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Little-endian UTF-16 Unicode text, with no line terminators F3B25701FE362EC84616A3A45CE8 D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB B3D510EF04275CA8E68E5B3CBB0ECE34EF252F0CDC83EEE34740A220 8C5F56F3DE34060C13E58EB7DAC1117F0D4DFFEC4B24FF84510F4B6FFAFD608C0A3DEAC3CFD210F 0EFAF F755ABFDF1C54CA0D84 moderate, very likely benign file C:\Users\user\Desktop\~$_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: FF21ADF1F74826EE3AA31EA36ADEC1C SHA1: E647BCB5778C1D08CB02D73ECD04823B5C5 SHA-256: 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 Copyright Joe Security LLC 2018 Page 11 of 16

12 C:\Users\user\Desktop\~$_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc SHA-5: Malicious: Reputation: A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: Microsoft Word document (3200/1) 54.23% Microsoft Word document (old ver.) (1008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57% File name: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc File size: MD5: SHA1: SHA256: SHA5: bb633388b37f5763cb337a11d21 f52035fe420cb42a170dcb7aab6b7b6cbbbe7d8 3562e41d50fd07d4dada5ec7bf6aecdaac7461c55c0 24c05de6f8c768f6 75c30bf651cb50fdd52a0e76df8f38ed34c61f45a6827 d65c2c661dd6b2e5bf875de035743e73fa4a670ab50503 b32db51e45aeb2c4abc54cf288b8f File Content Preview:...> File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 OLE File "TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc" Indicators Has Summary Info: Application Name: Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: True Microsoft Office Word True Flash Objects Count: 0 Copyright Joe Security LLC 2018 Page of 16

13 Indicators Contains VBA Macros: Summary Code Page: 54 Title: MY NEW FAX - MY NEW FAX - MY NEW FAX Subject: Author: HUSEYIN Keywords: Template: Normal.dotm Last Saved By: Win8 Revion Number: 10 Total Edit Time: 2100 Last Printed: :00:00 Create Time: :20:00 Last Saved Time: :53:00 Number of Pages: 3 Number of Words: 646 Number of Characters: 3684 Creating Application: Microsoft Office Word Security: 0 Document Summary Document Code Page: 54 Number of Lines: 30 Number of Paragraphs: 8 Thumbnail Scaling Desired: Company: Silentall Unattended Installer Contains Dirty Links: Shared Document: Changed Hyperlinks: Application Version: Streams Stream Path: \x1compobj, File Type: data, Stream Size: 113 Stream Path: File Type: Stream Size: 113 \x1compobj Entropy: Base64 Encoded: Data ASCII: F.... M i c r o s o f t W o r d B e l g e s i..... M S W o r d D o c..... W o r d. D o c u m e n t q Data Raw: fe ff 03 0a ff ff ff ff c f d f 73 6f f d c a d f f f e 44 6f d 65 6e 74 2e f4 3 b data True Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5documentsummaryinformation File Type: FoxPro FPT, blocks size 5, next free block index Stream Size: 406 Entropy: Base64 Encoded: Data ASCII: , T h p S i l e n t a l l U n a t t e n d e d I n s t a l l e r Data Raw: fe ff d5 cd d5 c 2e 1b b 2c f ae c f a a b b b c c Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Copyright Joe Security LLC 2018 Page 13 of 16

14 Stream Path: \x5summaryinformation File Type: FoxPro FPT, blocks size 5, next free block index Stream Size: 406 Entropy: Base64 Encoded: Data ASCII: O h ' ( D d p L... M Y N E W F A X - M Y N E W F A X Data Raw: fe ff e0 85 f f2 f 4f ab b 27 b3 d b ec f Stream Path: 1Table, File Type: data, Stream Size: Stream Path: File Type: 1Table Stream Size: Entropy: Base64 Encoded: data True Data ASCII: ^ v... v... v... v... v... v... v... v... v > Data Raw: 5e b 01 0f e e e e e e Stream Path: Data, File Type: dbase IV DBT, blocks size , next free block index 10257, 1st item "\002\010\006\007\001\005\011\004\003\377\304", Stream Size: Stream Path: File Type: Stream Size: Entropy: Base64 Encoded: Data dbase IV DBT, blocks size , next free block index 10257, 1st item "\002\010\006\007\001\005\011\004\003\377\304" True Data ASCII:. (.. D. d S A V... h. q. d. e. f. a. u. l. t.. i. s. r. a. i. l.. b. a. y. r. a i. l. e.. i. l. g. i. l. i.. g..... r. s. e. l.. s. o. n. u. c. u R.... '.. Data Raw: e0 10 e0 10 b f f0 ac b2 04 0a f a b f c ff c Stream Path: WordDocument, File Type: data, Stream Size: Stream Path: File Type: Stream Size: WordDocument Entropy: Base64 Encoded: Data ASCII: /.... b j b j u p u p D, D, <. Data Raw: ec a5 c1 00 0f c0 1f f8 bf f e a 62 6a f a a ea ff ff 0f ff ff 0f data True Copyright Joe Security LLC 2018 Page 14 of 16

15 Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 336 Parent PID: 288 Start time: 08:43:45 Start date: 10/06/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Deskt op\to_hm_crown PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minis ter.doc 0x2fe bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Completion Count Source Address Symbol Old File Path New File Path Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Key Path Name Type Old Data New Data Completion Count Source Address Symbol Copyright Joe Security LLC 2018 Page 15 of 16

16 Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 16 of 16