ID: Cookbook: urldownload.jbs Time: 18:48:38 Date: 19/06/2018 Version:

Transcription

1 ID: Cookbook: urldownload.jbs Time: 1:4:3 Date: 19/06/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Copyright Joe Security LLC 201 Page 2 of

3 Behavior System Behavior Analysis Process: cmd.exe PID: 2664 Parent PID: 3012 General File Activities File Created Analysis Process: wget.exe PID: 260 Parent PID: 2664 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 1:4:3 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 10s light urldownload.jbs act=getconfig&appid=0&pnid=4&proto=2 Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.win@3/2@1/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of

6 Networking System Summary HIPS / PFW / Operating System Protection Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Urls found in memory or binary data System Summary: Classification label Creates files inside the program directory Reads software policies Spawns processes Creates a directory in C:\Program Files HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 6 of

7 Behavior Graph ID: URL: Startdate: 19/06/201 Architecture: WINDOWS Score: 0 started cmd.exe Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET 1 C, C++ or other language Is malicious started wget.exe nt-www-prod-lb us-east-1.elb.amazonaws.com , 4916, 0 AMAZON-AES-AmazoncomIncUS United States Simulations Behavior and APIs Time Type Description 1:49:30 API Interceptor 14x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link 4% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link 6% virustotal Browse Copyright Joe Security LLC 201 Page of

8 URLs Source Detection Scanner Label Link 4% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Startup System is w cmd.exe (PID: 2664 cmdline: C:\Windows\system32\cmd.exe /c wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent=' Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' > cmd line.out 2>&1 MD5: ADB9C1403B52BC532FBA594342B9) wget.exe (PID: 260 cmdline: wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WO W64; Trident/.0; AS; rv:11.0) like Gecko' ' MD5: 3DADB6E2ECE9C4B3E1E322E6165B60) cleanup Copyright Joe Security LLC 201 Page of

9 Created / dropped Files C:\Program Files\AutoIt3\cmdline.out Process: File Type: Size (bytes): 430 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 5C1ED1BDF6F5FE5AD24C9C62 2E4A05D0CBBCA14EFBD49502DABFF5FF92BF 40DFEE5DC503B63D64116E9ACD9193FF05BC1F4E419DAA69F4EAF09A40B6F A4DE5BF9CBBC2AC2960BC2B699121A5A56034E55AEE123FECE6CA45E5ADC3FA23530E3B4A664 56BD0112B49DBCBA51FDEB6A25A042 low \Endpoint Process: File Type: Size (bytes): 256 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 04365CB91516CED25F33A199AFD36 BCB5B220144FF F309AAAB4D6A3D3C0 0DC49D61CBEE19EF6D9DFFD0FDB5CBE421160FF916C9AD1AC0A0FA3CA F3DFC103432CE5FC19C31054CCE3EE4E559ACECC1DBCDECF4DF09CB6F353DFF32EA05F22BA6392F1 453AEB0C3CB4CAF0649EE4ACDE22F1A3 low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation nt-www-prod-lb us-east- 1.elb.amazonaws.com true high unknown unknown 6%, virustotal, Browse low Contacted URLs Name Process C:\Windows\System32\wget.exe Contacted IPs Copyright Joe Security LLC 201 Page 9 of

10 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 5% 5% < No. of IPs Public IP Country Flag ASN ASN Name Malicious United States 1461 AMAZON-AES-AmazoncomIncUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: 0 (HTTP) 53 (DNS) TCP Packets Copyright Joe Security LLC 201 Page 10 of

11 Timestamp Source Port Dest Port Source IP Dest IP Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Jun 19, 201 1:49: CEST x902 Standard query (0) extensions.com A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Jun 19, x902 No error (0) 1:49: extensions.com CEST Jun 19, 201 1:49: CEST Jun 19, 201 1:49: CEST x902 No error (0) nt-www-prod-lb useast-1.elb.a mazonaws.com x902 No error (0) nt-www-prod-lb useast-1.elb.a mazonaws.com nt-www-prod-lb us-east- 1.elb.amazonaws.com CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\wget.exe Timestamp kbytes transferred Direction Data Jun 19, 201 1:49: CEST 0 OUT GET /advplatform/api.cgi?act=getconfig&appid=0&pnid=4&proto=2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko Accept: */* Accept-Encoding: identity Host: Connection: Keep-Alive Copyright Joe Security LLC 201 Page 11 of

12 Timestamp kbytes transferred Direction Data Jun 19, 201 1:49: CEST 1 IN HTTP/ Internal Server Error Date: Tue, 19 Jun :49:15 GMT Content-Type: text/html; charset=iso-59-1 Content-Length: 621 Connection: keep-alive Server: Apache/2.4.1 (Ubuntu) Data Raw: 3c f d 4c c d 2f 2f f 2f d 4c e 30 2f 2f 45 4e 22 3e 0a 3c 6 4 6d 6c 3e 3c e 0a 3c c 65 3e e e 61 6c f 2 3c 2f c 65 3e 0a 3c 2f e 3c 62 6f e 0a 3c e 49 6e e 61 6c f 2 3c 2f e 0a 3c 0 3e e 63 6f 5 6e e e e 61 6c f f 2 0a 6d f 6e f 6e e e c f f 6d 0 6c a 9 6f e 3c 2f 0 3e 0a 3c 0 3e 50 6c f 6e d 69 6e f a 20 5b 6e 6f e 5d f e 66 6f 2 6d d 20 6f d f f c 0a e f 6e f f 2 6d a f f 2 2e 3c 2f 0 3e 0a 3c 0 3e 4d 6f e 66 6f 2 6d f 6e f f d c c 65 0a 69 6e f c 6f 6 2e 3c 2f 0 3e 0a 3c 6 2 3e 0a 3c e f 32 2e 34 2e e e 6e e f 6e 3 2e 63 6f 6d f c 2f e 0a 3c 2f 62 6f e 3c 2f 6 4 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</ti tle></head><body><h1>internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>more information about this error may be availablein the server error log.</p><hr><address>apache/2.4.1 (Ubuntu) Server at s.com Port 0</address></body></html> Code Manipulations Statistics Behavior cmd.exe wget.exe Click to jump to process System Behavior Analysis Process: cmd.exe PID: 2664 Parent PID: 3012 General Start time: 1:49:29 Copyright Joe Security LLC 201 Page 12 of

13 Start date: 19/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wget -v -T 60 -P 'C:\Users\user\Desktop\download' --nocheck-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' =getconfig&appid=0&pnid=4&proto=2' > cmdline.out 2>&1 0x4a bytes ADB9C1403B52BC532FBA594342B9 true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Program Files\AutoIt3\cmdline.out read attributes synchronize generic write normal synchronous io non alert non directory file Source Address Symbol success or wait 1 4A063A9 CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 260 Parent PID: 2664 General Start time: 1:49:29 Start date: 19/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wget.exe wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' 'http: // 0x bytes 3DADB6E2ECE9C4B3E1E322E6165B60 true C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page of