ID: Cookbook: urldownload.jbs Time: 16:41:45 Date: 23/06/2018 Version:

Transcription

1 ID: 52 Cookbook: urldownload.jbs Time: 1:41:45 Date: 23/0/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 3344 Parent PID: 124 General File Activities File Created Analysis Process: wget.exe PID: 33 Parent PID: 3344 General File Activities Copyright Joe Security LLC 201 Page 2 of 11

3 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 52 Start time: 1:41:45 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m s light urldownload.jbs jsdkfjsdfjksdfjsdkfasdfjnadsfjnasdnj/utorrent.exe Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal4.win@3/1@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 11

6 AV Detection Networking System Summary HIPS / PFW / Operating System Protection Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Multi AV Scanner detection for domain / URL Networking: Urls found in memory or binary data System Summary: Classification label Creates files inside the program directory Reads software policies Spawns processes Creates a directory in C:\Program Files HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page of 11

7 Hide Legend Behavior Graph ID: 52 URL: Startdate: 23/0/201 Architecture: WINDOWS Score: 4 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Multi AV Scanner detection for domain / URL started Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious cmd.exe 1 started wget.exe Simulations Behavior and APIs Time Type Description 1:42:4 API Interceptor 14x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link % virustotal Browse No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of 11

8 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Startup System is w cmd.exe (PID: 3344 cmdline: C:\Windows\system32\cmd.exe /c wget -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent=' Mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' > cm dline.out 2>&1 MD5: ADBC1403B52BC532FBA54342B) wget.exe (PID: 33 cmdline: wget -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT.1; WO W4; Trident/.0; AS; rv:11.0) like Gecko' ' MD5: 3DADBE2ECEC4B3E1E322E15B0) cleanup Created / dropped Files Copyright Joe Security LLC 201 Page of 11

9 C:\Program Files\AutoIt3\cmdline.out Process: File Type: Size (bytes): 324 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-25: SHA-512: Malicious: Reputation: 2B4CF1A3BCCF433AFB551D3CE13 3DD14C3BDDD3FAF5CF1AD3BCF2AA 0FF1BB5C20441D2C214CB3B14B C0A2D1E31 3C520DF0BF1BEEECE3ECFD524D45D2354F441F35203C22F1FEB5DDBABDAD FBEAEE4C3E454A33CD2FA5454E low Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info No static file info Network Behavior No network behavior found Code Manipulations Statistics Behavior cmd.exe wget.exe Copyright Joe Security LLC 201 Page of 11

10 Click to jump to process System Behavior Analysis Process: cmd.exe PID: 3344 Parent PID: 124 General Start time: 1:42:4 Start date: 23/0/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wget -v -T 0 -P 'C:\Users\user\Desktop\download' --nocheck-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' ' jsdfjksdfjsdkfasdfjnadsfjnasdnj/utorrent.exe' > cmdline.out 2>&1 0x4a5f bytes ADBC1403B52BC532FBA54342B true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Program Files\AutoIt3\cmdline.out read attributes synchronize generic write normal synchronous io non alert non directory file Source Address Symbol success or wait 1 4A5F3A CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 33 Parent PID: 3344 General Start time: 1:42:4 Start date: 23/0/201 Path: Wow4 process (32bit): C:\Windows\System32\wget.exe Copyright Joe Security LLC 201 Page of 11

11 Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: wget -v -T 0 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT.1; WOW4; Trident/.0; AS; rv:11.0) like Gecko' 'http: // [.]13/dropbox/filesfhjdfkjsjdkfjsdkfjsdfjksdfjsdkfasdfjnadsfjnasdnj/utorrent.exe' 0x bytes 3DADBE2ECEC4B3E1E322E15B0 true C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11