ID: Cookbook: urldownload.jbs Time: 21:28:55 Date: 28/06/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: urldownload.jbs Time: 21:28:55 Date: 28/06/2018 Version:"

Elvin Page
5 years ago
Views:

1 ID: 6600 Cookbook: urldownload.jbs Time: 21:2:55 Date: 2/06/201 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: Remote Access Functionality: System Summary: HIPS / PFW / Operating System Protection Evasion: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Table of Contents Copyright Joe Security LLC 201 Page 2 of

3 Code Manipulations Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 3764 Parent PID: 2136 General File Activities File Created Analysis Process: wget.exe PID: 3792 Parent PID: 3764 General File Activities File Created File Written Analysis Process: wscript.exe PID: 3904 Parent PID: 33 General File Activities Registry Activities Key Created Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 16

Analysis Report Overview General Information Joe Sandbox Version: 23.0.0 Analysis ID: 6600 Start time: 21:2:55 Joe Sandbox Product: CloudBasic Start date: 2.06.

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 6600 Start time: 21:2:55 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 33s light urldownload.jbs xx/365dropbox/securedview/company/investfiles/ff5f d90f1dcae4065b9ee9cec2c441e/login.php?c md=login_submit&id=72c29fd d9b1 6d232fa265f72c29fd d9b16d232fa2 65f&session=72c29fd d9b16d232fa 265f72c29fd d9b16d232fa265f Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus21.troj.win@4/3@1/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 16

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 16

6 Networking Remote Access Functionality System Summary HIPS / PFW / Operating System Protection Evasion Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Urls found in memory or binary data Remote Access Functionality: Contains strings related to BOT control commands System Summary: Classification label Creates files inside the user directory Reads software policies Spawns processes Uses an in-process (OLE) Automation server HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Malware Analysis System Evasion: Found WSH timer for Javascript or VBS script (likely evasive script) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 16

Behavior Graph ID: 6600 URL: http://www.orthopaedicsurgeondirectory.com/dropboxxx/365d.

7 Behavior Graph ID: 6600 URL: Startdate: 2/06/201 Architecture: WINDOWS Score: 21 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Number of created Registry Values Contains strings related to BOT control commands started started Number of created Files Visual Basic Delphi cmd.exe wscript.exe Java.Net C# or VB.NET 1 started C, C++ or other language Is malicious wget.exe 1 orthopaedicsurgeondirectory.com , 49170, 0 AMAZON-AES-AmazoncomIncUS United States dropped login.php@cmd=logi d9b16d232fa265f, HTML Simulations Behavior and APIs Time Type Description 21:29:26 API Interceptor 95x Sleep call for process: cmd.exe modified 21:29:2 API Interceptor 1x Sleep call for process: wscript.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link files/ff5fd90f1dcae4065b9ee9cec2c441e/login.php?cmd=login_submit&id=72c29fd d9b1 6d232fa265f72c29fd d9b16d232fa265f&session=72c29fd d9b16d232fa 265f72c29fd d9b16d232fa265f 3% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Copyright Joe Security LLC 201 Page 7 of 16

8 Source Detection Scanner Label Link orthopaedicsurgeondirectory.com 0% virustotal Browse 0% virustotal Browse URLs Source Detection Scanner Label Link files/ff5fd90f1dcae4065b9ee9cec2c441e/login.php?cmd=login_submit&id=72c29fd d9b1 6d232fa265f72c29fd d9b16d232fa265f&session=72c29fd d9b16d232fa 265f72c29fd d9b16d232fa265f 3% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 16

$Startup System is w7 cmd.exe (PID: 3764 cmdline: C:\Windows\system32\cmd.$

9 Startup System is w7 cmd.exe (PID: 3764 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-ag ent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' files/ff5fd90f1dcae4065b9ee9cec2c441e/login.php?cmd=login_submit&id=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f&session=72c29fd d 9b16d232fa265f72c29fd d9b16d232fa265f' > cmdline.out 2>&1 MD5: AD7B9C03B52BC532FBA594342B9) wget.exe (PID: 3792 cmdline: wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' c2c441e/login.php?cmd=login_submit&id=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f&session=72c29fd d9b16d232fa265f72c29f d d9b16d232fa265f' MD5: 3DADB6E2ECE9C4B3E1E322E61765B60) wscript.exe (PID: 3904 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\download\login.php@cmd=login_submit&id=72c29fd d9b16d232fa265f72 c29fd d9b16d232fa265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f.wsf' MD5: 979D74799EA6CB16769A6DF5204A) cleanup Created / dropped Files C:\Users\user\Desktop\cmdline.out Process: C:\Windows\System32\wget.exe File Type: ASCII text, with very long lines, with CRLF line terminators Size (bytes): 116 Entropy (bit): Encrypted: MD5: D405402AF2AA1ADB FA4EB SHA1: E5D991133E46F5DC7A90194EDFD023BEEE51FC SHA-256: 5F25B4BA1A542BF70230ACCA DC07CF9F1A9C53241A65134E06C35 Copyright Joe Security LLC 201 Page 9 of 16

10 C:\Users\user\Desktop\cmdline.out SHA-512: Malicious: Reputation: B4EE54C26FF5B52AD0665CD70D2F1F3A9D56946AEFCA7B06A391B57EC70E31E0E7757C0C6CBBB BFF3F0BCC56F931111A344E21BEC7D17 low ion=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f Process: File Type: Size (bytes): 960 C:\Windows\System32\wget.exe Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: HTML document, ASCII text, with CRLF line terminators CD1700DC15CB93F9D5AC9C AB6C165D AA9920E4ED5CBDD4ED5ABC7 5E317464BFB526C66AEDC4D677119DD7A932ACC5E2F5BC33E0EECE91BC0 920E7A0F C3C4C9EC B70779CE9F7CEA4F66B592DC6A0B53C6F4263FDEE3A13BF3F9C 22A7A12A62B3DE4F57F37BEDFE01E2D4AF6 true low \Endpoint Process: File Type: Size (bytes): 464 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 0531DD600AF726E4AFBDFB9530F EC76B35B975A449FAC94D57BCD5DEAB FAF5101C921F2502BEAEDE32D9EAB0F D54FE764EED6442EFF19FA94 C0DD2A1FDE13FEB73E17A6961EC709FBB0BD3520C261F54C F49CC6F4E269CAF E2 94B1794DA2FDCA2D75445CE41C3BDCEE low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation orthopaedicsurgeondirectory.com true true 0%, virustotal, Browse unknown unknown unknown true 0%, virustotal, Browse unknown Contacted URLs Name b9ee9cec2c441e/login.php?cmd=login_submit&id=72c29fd d9b16d232fa265f72c29fd d9 b16d232fa265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f Process C:\Windows\System32\wget.exe Contacted IPs Copyright Joe Security LLC 201 Page 10 of 16

11 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Public IP Country Flag ASN ASN Name Malicious United States 61 AMAZON-AES-AmazoncomIncUS true Static File Info No static file info Network Behavior Network Port Distribution Total Packets: 0 (HTTP) 53 (DNS) TCP Packets Copyright Joe Security LLC 201 Page 11 of 16

12 Timestamp Source Port Dest Port Source IP Dest IP Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST Jun 2, :29: CEST UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Jun 2, :29: CEST Jun 2, :29: CEST DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Jun 2, :29: CEST xfcc Standard query (0) aedicsurge ondirectory.com A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Jun 2, xfcc No error (0) 21:29: aedicsurge CEST ondirectory.com Jun 2, xfcc No error (0) orthopaedi 21:29: csurgeondi CEST rectory.com orthopaedicsurgeondirect ory.com CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\wget.exe Timestamp kbytes transferred Direction Data Jun 2, :29: CEST 0 OUT GET /dropboxxx/365dropbox/securedview/company/investfiles/ff5fd90f1dcae4065b9ee9cec2c441e/login.php?cmd=login _submit&id=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: */* Accept-Encoding: identity Host: Connection: Keep-Alive Copyright Joe Security LLC 201 Page 12 of 16

13 Timestamp kbytes transferred Direction Data Jun 2, :29: CEST 2 IN HTTP/ OK Date: Thu, 2 Jun :29:32 GMT Server: Apache X-Powered-By: PHP/5.5.3 Vary: Accept-Encoding Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html Data Raw: d 0a 0d 0a 3c d 6c 3e 0d 0a 3c e 0d 0a c 6d d d e 0d 0a c 6d e 61 6d 65 3d e f f 6e e 74 3d e 0d 0a c 6d e 61 6d 65 3d d 73 2e f 6e e 74 3d c a 75 6c a a d e 0d 0a c 6d e 61 6d 65 3d f 6e f 6e e 74 3d e 0d 0a c 6d e 61 6d 65 3d 22 6b f f 6e e 74 3d e 0d 0a 3c 6c 69 6e 6b c 3d c d c 65 2e e 0d 0a 3c 6c 69 6e 6b c 3d c d f c 65 2e e 0d 0a 3c 6c 69 6e 6b c 3d c d f e e 20 0d 0a 3c 6c 69 6e 6b c 3d c d f f 6e e e e 20 0d 0a 3c 6c 69 6e 6b c 3d c f 6c d f d c e 6c f 3e 0d 0a 3c d 22 6a 73 2f 6a f 65 6d 2d c e 6a e 3c 2f e 0d 0a 3c d 22 6a 73 2f 6a f 6a d 31 2e e 31 2e 6d 69 6e 2e 6a e 3c 2f e 0d 0a 3c 6c 69 6e 6b c 3d f f 6e d f 2e f 22 2f 3e 0d 0a c 6c 69 6e 6b c 3d f 6e d f 2e f 22 2f 3e 0d 0a 3c c 65 3e f f c e e 20 2d c e e c 6f f c 2f c 65 3e 0d 0a 3c e 0d 0a 64 6f d 65 6e 74 2e c 65 6d 65 6e e e 74 4c e c 6f c e f 6e b 0d 0a f d e f d 65 6e b 0d 0a d f 63 2e Data Ascii: 25<html><head> <meta charset="utf-"> <meta name="generator" content=""> <meta name="dcte rms.created" content="wed, 27 Jul :54:42 GMT"> <meta name="description" content=""> <meta name="k eywords" content=""><link rel="stylesheet" href="style.css"><link rel="stylesheet" href="css/style.css"><link rel="stylesheet" href="css/reset.css"> <link rel="stylesheet" href="css/gcontainer.css"> <link rel="stylesheet/less" type="text/css" href="s tyles.less" /><script src="js/java2/em-valid.js"></script><script src="js/java2/jquery min.js"></script><link rel ="shortcut icon" href="favico.ico"/> <link rel="icon" href="favico.ico"/><title>dropbox Sign in - Secure file sharing and cloud storage</title><script>document.getelementbyid("svg1").addeventlistener("load", function() { var doc = thi s.getsvgdocument(); var rect = doc.quer Code Manipulations Statistics Behavior cmd.exe wget.exe wscript.exe Click to jump to process Copyright Joe Security LLC 201 Page 13 of 16

14 System Behavior Analysis Process: cmd.exe PID: 3764 Parent PID: 2136 General Start time: 21:29:24 Start date: 2/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no -check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' xx/365dropbox/securedview/company/investfiles/ff5fd90f1dcae4065b9ee9cec2c441e/l ogin.php?cmd=login_submit&id=72c29fd d9b16d232fa265f72c29fd d9 b16d232fa265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f' > cmdline.out 2>&1 0x4a bytes AD7B9C03B52BC532FBA594342B9 true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\Desktop\cmdline.out read attributes synchronize generic write normal synchronous io non alert non directory file Source Address Symbol success or wait 1 4A623A79 CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 3792 Parent PID: 3764 General Start time: 21:29:25 Start date: 2/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-d isposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' dview/company/investfiles/ff5fd90f1dcae4065b9ee9cec2c441e/login.php?cmd=login_s ubmit&id=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f&sessio n=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f' 0x bytes 3DADB6E2ECE9C4B3E1E322E61765B60 true C, C++ or other language low File Activities File Created Copyright Joe Security LLC 201 Page of 16

15 Source File Path Access Attributes Options Completion Count Address Symbol =72c29fd d9b16d232fa265f72c29fd d9b16d232f a265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f read attributes synchronize generic write normal synchronous io non alert non directory file success or wait C fopen File Written File Path Offset Length Value Ascii Completion Count C:\Users\user\Desktop\download \login.php@cmd=login_submit&id =72c29fd d9b16d232fa2 65f72c29fd d9b16d232f a265f&session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f unknown 192 0d 0a 3c d 6c 3e 0d 0a 3c e 0d 0a c 6d d d e 0d 0a c 6d e 61 6d 65 3d e f f 6e e 74 3d e 0d 0a c 6d e 61 6d 65 3d d 73 2e f 6e e 74 3d c a 75 6c a a d e 0d 0a c 6d e 61 6d 65 3d f 6e f 6e e 74 3d e 0d 0a c 6d e 61 6d 65 3d 22 6b f f 6e e 74 3d e 0d 0a 3c 6c 69 6e 6b c 3d c..<html>..<head>.. <meta charset="utf-">.. <meta name="generator" content="">.. <meta name="dcterms.created" content="wed, 27 Jul :54:42 GMT">.. <meta name="description" content="">.. <meta name="keywords" content="">..<link rel="styl Source Address Symbol success or wait 1 47F21C fwrite File Path Offset Length Completion Count Source Address Symbol Analysis Process: wscript.exe PID: 3904 Parent PID: 33 General Start time: 21:29:2 Start date: 2/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\download\login.php@cmd= login_submit&id=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f &session=72c29fd d9b16d232fa265f72c29fd d9b16d232fa265f.wsf' 0x2a bytes 979D74799EA6CB16769A6DF5204A true C, C++ or other language low File Activities File Path Offset Length Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page 15 of 16

16 Registry Activities Key Created Key Path Completion Count Source Address Symbol HKEY_USERS\Software\Microsoft\Windows script Host success or wait 1 2A4109 RegCreateKeyExW HKEY_USERS\Software\Microsoft\Windows script Host\Settings success or wait 1 2A4109 RegCreateKeyExW Disassembly Code Analysis Copyright Joe Security LLC 201 Page 16 of 16

ID: Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/08/2018 Version:

ID: Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/08/2018 Version: ID: 153 Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/0/201 Version: 23.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature