ID: Sample Name: NEW ORDER LIST.jar Cookbook: default.jbs Time: 10:19:47 Date: 19/02/2018 Version:

Transcription

1 ID: Sample Name: NEW ORDER LIST.jar Cookbook: default.jbs Time: :19:47 Date: 19/02/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Signature Overview Persistence and Installation Behavior: Data Obfuscation: Spreading: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 344 Parent PID: 33 Analysis Process: 7za.exe PID: 352 Parent PID: 344 Copyright Joe Security LLC 201 Page 2 of

3 File Activities File Written Analysis Process: cmd.exe PID: 3 Parent PID: 33 File Activities File Created Analysis Process: java.exe PID: 39 Parent PID: 3 File Activities File Written Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 13

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: :19:47 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m s light NEW ORDER LIST.jar default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE, FF 54, Chrome 0, Acrobat Reader DC 17, Flash 2, Java ) Number of analysed new started processes analysed: Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean4.winjar@/2@0/0 HCA Information: Successful, ratio: 9% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 0% HDC Information: Successful, ratio: 99.5% (good quality ratio 94.7%) Quality average: 4.2% Quality standard deviation: 2% Cookbook Comments: Adjust boot time Found application associated with file extension:.jar Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 13

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 13

6 Persistence and Installation Behavior Data Obfuscation Spreading System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Persistence and Installation Behavior: May use bcdedit to modify the Windows boot settings Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) Spreading: Contains functionality to enumerate / list files inside a directory System Summary: Binary contains paths to debug symbols Classification label Contains functionality for error logging Reads software policies Spawns processes Detected potential crypto function Found potential string decryption / allocating functions Anti Debugging: Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Contains functionality which may be used to detect a debugger (GetProcessHeap) Malware Analysis System Evasion: Contains functionality to enumerate / list files inside a directory Found evasive API chain (may stop execution after checking a module file name) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Copyright Joe Security LLC 201 Page of 13

7 Contains functionality to query local / system time Contains functionality to query time zone information Behavior Graph Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Sample: NEW ORDER LIST.jar Startdate: 19/02/201 Architecture: WINDOWS Score: 4 started cmd.exe cmd.exe started Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious 1 started started 7za.exe java.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 13

8 Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 13

9 Startup System is w7 cmd.exe (PID: 344 cmdline: C:\Windows\system32\cmd.exe /c 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' MD5: AD7B9C1403B52BC532FBA594342B9) 7za.exe (PID: 352 cmdline: 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' MD5: 42BADC1D2F03AB1E475740D3D4933) cmd.exe (PID: 3 cmdline: 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' >> C:\cmdlinestart.log 2>&1 MD5: AD7B9C1403B52BC532FBA594342B9) java.exe (PID: 39 cmdline: java.exe -jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' MD5: 02E2F23B FB5E33DB3BF0C) cleanup Created / dropped Files C:\cmdlinestart.log File Type: ASCII text, with CRLF line terminators Size (bytes): 3 Entropy (bit): Encrypted: MD5: 59B277EE52B3C3CA0BFD4329CB0 SHA1: DBD5FB91542F1DB430DDEF70FD3A92A7D2D SHA-25: 5ABB204F9C55D94BC0CC33A1B247097D775904F9BBF377BB4F9239 SHA-5: 17F724077D43C7C4EB9BEA5BBC39FE4F1DAB3CD02EA3EAFD5B44359C2515AFAE14F5AE4 A27E47DAD5A4B0DA792BEFF072B2F7F Malicious: Reputation: low Copyright Joe Security LLC 201 Page 9 of 13

10 unknown File Type: Size (bytes): 179 ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-25: SHA-5: Malicious: Reputation: 0E55B2E5E00BDFCEE39A40FD2DE99 D52E14FE2B0D59DCBB20C47C1EBBADA3 4BEB9A27B4ADFE053009D4C3D3C031D1BFE5E3D45A DDA5CD0B455092EFF D0EF0037DB30A4FA1D2D7DF7BF7ADC1D9F DAD5E1A2A7 F FB1C0B4C090B3DFCAB4B2 low Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Java Jar file data (zip) Entropy (bit): TrID: Java Archive (13504/1) 77.13% ZIP compressed archive (4004/1) 22.7% File name: File size: MD5: SHA1: SHA25: SHA5: File Content Preview: NEW ORDER LIST.jar d07c54015f1ba27f3cf29ae1a99 c75ff572dc4f1729aa77eaddeaca2 39f42900ffe29a3f2079faff44c324a1ef0a454be4 f9e9c450c40e 1abaace003d7ecd09c73e92ad3d5fe5ec772250b9 ef729a39a921d3e1fd057c2c29a53a90c13 e05c0d39a94b91f4d437ea35fd4 `...,..._UYW..x.P.u.d <A.5ZR...DF.&.]... Yn`V.l...a.!.y7..w...}.l 0.X...S.B..PK...U...PK...AS L... File Icon Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 201 Page of 13

11 Statistics Behavior cmd.exe 7za.exe cmd.exe java.exe Click to jump to process System Behavior Analysis Process: cmd.exe PID: 344 Parent PID: 33 Start time: :20:29 Start date: 19/02/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' 0x4a bytes AD7B9C1403B52BC532FBA594342B9 true C, C++ or other language high Analysis Process: 7za.exe PID: 352 Parent PID: 344 Start time: :20:29 Start date: 19/02/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\7za.exe 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' 0x bytes 42BADC1D2F03AB1E475740D3D4933 true C, C++ or other language moderate Copyright Joe Security LLC 201 Page of 13

12 File Activities File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol unknown unknown 179 0d 0a 37 2d 5a Zip (A) 9.20 Copyright success or wait FD WriteFile e (c) Igor Pavlov f Processing archive: C :\Users\user\Desktop\NEW 2d ORDER LIST.jar...Error: 7 f c Can not open file as f archive... 2d d d 0a 0d 0a f e a a 5c c 53 1 d c c 5c b 74 f 70 5c 4e f c e a d 0a 0d 0a f 72 3a e 20 e f f 70 5 e 20 9 c d 0a 0d 0a Analysis Process: cmd.exe PID: 3 Parent PID: 33 Start time: :20:30 Start date: 19/02/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' >> C:\cmdlinestart.log 2>&1 0x4aba bytes AD7B9C1403B52BC532FBA594342B9 true C, C++ or other language high File Activities File Created File Path Access Attributes Options Completion Count C:\cmdlinestart.log read attributes and synchroniz e and generic write normal synchronous io non alert and n on directory file Source Address Symbol success or wait 1 4ABADF1 CreateFileW Analysis Process: java.exe PID: 39 Parent PID: 3 Start time: :20:30 Start date: 19/02/201 Path: Wow4 process (32bit): C:\ProgramData\Oracle\Java\javapath_target_27509\java.exe Copyright Joe Security LLC 201 Page of 13

13 Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: java.exe -jar 'C:\Users\user\Desktop\NEW ORDER LIST.jar' 0x1c bytes 02E2F23B FB5E33DB3BF0C true C, C++ or other language moderate File Activities File Written File Path Offset Length Value Ascii Completion Count C:\cmdlinestart.log unknown f 72 3a e 7 1 c f f a c a 5c c 53 1 d c c 5c b 74 f 70 5c 4e f c e a d 0a Error: Invalid or corrupt jarf ile C:\Users\user\Desktop\NE W ORDER LIST.jar.. Source Address Symbol success or wait 1 1D2FD3 WriteFile Disassembly Code Analysis Copyright Joe Security LLC 201 Page 13 of 13