ID: Sample Name: test.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 18:57:54 Date: 12/04/2018 Version:

Transcription

1 ID: Sample Name: test.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 18:57:54 Date: /04/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "test.doc" Indicators Summary Document Summary Streams Stream Path: \x1compobj, File Type: data, Stream Size: 5 Table of Contents Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: 1Table, File Type: data, Stream Size: 6425 Stream Path: Data, File Type: data, Stream Size: 406 Copyright Joe Security LLC 2018 Page 2 of

3 Stream Path: WordDocument, File Type: data, Stream Size: 406 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 2872 Parent PID: 22 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 15

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 18:57:54 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 10m s light test.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windoc@1/5@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 5 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): OSPPSVC.EXE, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 15

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 15

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 15

7 Click to jump to signature section Networking: Downloads files Found strings which match to known social media urls Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Document contains summary information with irregular field values Reads ini files Reads software policies Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Uses new MSVCR Dlls Document has a 'vbamacros' value indicative for goodware Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 15

8 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: test.doc Startdate: /04/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description 18:58:28 API Interceptor 5x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2018 Page 8 of 15

9 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 15

10 Startup System is w7 WINWORD.EXE (PID: 2872 cmdline: 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\test.doc MD5: 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{10118FC-B150-4C78-B0D-61CF31D11A07}.tmp Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 5D4D4EE7E06BBB0AF B23A DBB111C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C54AFDA51624BC2BB2F28BA4 high, very likely benign file Copyright Joe Security LLC 2018 Page 10 of 15

11 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: File Type: Size (bytes): 50 C:\Program Files\Microsoft Office\Office\WINWORD.EXE ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 050F0D78A608F20434EF561ADE2 5BE2ADC3EF F0F6625BBC2E6062CB4 C38DBD37E B8FF0AA4BB557847A8C6FEF0187FCEB723E74DA B1536BB4361BC08A38C8226DB3CBACC352E6C7D8044E05F1D36FDE7F4BA27DFB44FFAA2A1CECA36DE30 21C24BB586A8A FD37A2EC54EDC83D32 low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\test.LNK Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :04: , mtime=sun Sep 24 :04: , atime=thu Apr 16:58: , length=261, window=hide Size (bytes): 2004 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 430D2EA4E777BEB6FC16632EB55B7 331E5F57EAFD574CE7CAFA4D45D7B AEF6807F077084BCFAE67046D8472CAF4CE C86F024161E6867E C4D1B2CF72BAC B8CF3F53D50182ECBA6027F5E5E300F1B5C777B07758BB1EA066BD83C2B26 B78B5433A445280D85D718C5B6CBB61DD7 low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: File Type: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 70DBC E4D63A802F5CD0FD0E 1E7371AB16A2B402BBF51AFDF1C6D26E477B3C 1C6364A030BC163BEC86BA3AFBDD1B A7E0A28826C1EC34177A32C0C 7FE0002D3A8ACE5C1168F44252EF2B247CD1BF7CA881A5886C0A88F50BB8310D5D7DF1E0D FC0B 17B3E652F50FECB16ED3F1E5BED18E1 moderate, very likely benign file C:\Users\user\Desktop\~$test.doc Process: File Type: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 70DBC E4D63A802F5CD0FD0E 1E7371AB16A2B402BBF51AFDF1C6D26E477B3C 1C6364A030BC163BEC86BA3AFBDD1B A7E0A28826C1EC34177A32C0C 7FE0002D3A8ACE5C1168F44252EF2B247CD1BF7CA881A5886C0A88F50BB8310D5D7DF1E0D FC0 B17B3E652F50FECB16ED3F1E5BED18E1 moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Copyright Joe Security LLC 2018 Page 11 of 15

12 Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: Microsoft Word document (3200/1) 7.% Generic OLE2 / Multistream Compound File (8008/1) 20.01% File name: File size: 261 MD5: SHA1: SHA256: SHA5: test.doc 50688afbef46aadedfd02888a 8428e0f8e84beeefc5a00636f8a84a7ca40f 5ffe772c56cc5d7f8b8e8206d011bd2837fefe3e4 b6da30ce8e1fdce db1a1dd1bcc2d24e41e22b8dd1a185cc82cb0b6e6 7a4eba e3b83841b3aaea56bf260d0cfa70c a2bfc7b6c7ba1c7ed10285 File Content Preview:...> File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 OLE File "test.doc" Indicators Has Summary Info: True Application Name: Microsoft Office Word Encrypted Document: Contains Word Document Stream: True Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Summary Code Page: 52 Author: Template: Normal.dotm Last Saved By: Revion Number: 2 Total Edit Time: 0 Create Time: :56:00 Last Saved Time: :56:00 Number of Pages: 1 Number of Words: 0 Number of Characters: 4 Creating Application: Microsoft Office Word Security: 0 Copyright Joe Security LLC 2018 Page of 15

13 Document Summary Document Code Page: 52 Number of Lines: 1 Number of Paragraphs: 1 Thumbnail Scaling Desired: Company: Contains Dirty Links: Shared Document: Changed Hyperlinks: Application Version: Streams Stream Path: \x1compobj, File Type: data, Stream Size: 5 Stream Path: File Type: \x1compobj data Stream Size: 5 Entropy: Base64 Encoded: Data ASCII: True F +... D o c u m e n t o d e M i c r o s o f t O f f i c e W o r d M S W o r d D o c..... W o r d. D o c u m e n t q Data Raw: fe ff 03 0a ff ff ff ff c b f d 65 6e 74 6f d f 73 6f f f d a d f f f e 44 6f d 65 6e 74 2e f4 3 b Stream Path: \x5documentsummaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5documentsummaryinformation File Type: FoxPro FPT, blocks size 5, next free block index Stream Size: 406 Entropy: Base64 Encoded: Data ASCII: , h p Data Raw: fe ff d5 cd d5 c 2e 1b b 2c f ae e c f c c b c a ac Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation File Type: FoxPro FPT, blocks size 5, next free block index Stream Size: 406 Entropy: Base64 Encoded: True Data ASCII: O h ' $ p x N o r m a l. d o t m M i c r o s o f Data Raw: fe ff e0 85 f f2 f 4f ab b 27 b3 d d c a b c a e c ec d f Stream Path: 1Table, File Type: data, Stream Size: 6425 Stream Path: File Type: 1Table data Stream Size: 6425 Entropy: Copyright Joe Security LLC 2018 Page of 15

14 Base64 Encoded: True Data ASCII: j v... v... v... v... v... v... v... v... v > Data Raw: 6a 04 0f b 01 0f e e e e e e e e Stream Path: Data, File Type: data, Stream Size: 406 Stream Path: File Type: Stream Size: 406 Entropy: 0.0 Base64 Encoded: Data ASCII: Data Raw: Data data Stream Path: WordDocument, File Type: data, Stream Size: 406 Stream Path: File Type: Stream Size: 406 WordDocument Entropy: Base64 Encoded: Data ASCII:.... [ b j b j Data Raw: ec a5 c1 00 5b f0 bf e a 62 6a ac fa ac fa a 0c e ce ce ff ff 0f ff ff 0f data Network Behavior No network behavior found Code Manipulations Statistics System Behavior Copyright Joe Security LLC 2018 Page of 15

15 Analysis Process: WINWORD.EXE PID: 2872 Parent PID: 22 Start time: 18:58:28 Start date: /04/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Program Files\Microsoft Office\Office\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\test.do c 0x2f7f bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count File Path Completion Count Old File Path New File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 15 of 15