ID: Sample Name: MSVCR100.dll Cookbook: default.jbs Time: 16:59:36 Date: 30/04/2018 Version:

Size: px

Start display at page:

Download "ID: Sample Name: MSVCR100.dll Cookbook: default.jbs Time: 16:59:36 Date: 30/04/2018 Version:"

Gabriella Smith
5 years ago
Views:

1 ID: 5734 Sample Name: MSVCR100.dll Cookbook: default.jbs Time: 16:59:36 Date: 30/04/201 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Signature Overview Data Obfuscation: System Summary: Anti Debugging: Malware Analysis System Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Resources Imports Exports Possible Origin Network Behavior Code Manipulations Statistics Behavior Table of Contents Copyright Joe Security LLC 201 Page 2 of

3 System Behavior Analysis Process: loaddll32.exe PID: 342 Parent PID: 3016 File Activities File Written Analysis Process: PID: 3436 Parent PID: 342 Analysis Process: PID: 3472 Parent PID: 342 Analysis Process: PID: 344 Parent PID: 342 Analysis Process: PID: 3492 Parent PID: 342 Analysis Process: PID: 3500 Parent PID: 342 Analysis Process: PID: 350 Parent PID: 342 Analysis Process: PID: 3520 Parent PID: 342 Analysis Process: PID: 352 Parent PID: 342 Analysis Process: PID: 3536 Parent PID: 342 Analysis Process: PID: 354 Parent PID: 342 Analysis Process: PID: 3560 Parent PID: 342 Analysis Process: PID: 356 Parent PID: 342 Analysis Process: PID: 3576 Parent PID: 342 Analysis Process: PID: 35 Parent PID: 342 Analysis Process: PID: 3596 Parent PID: 342 Analysis Process: PID: 3604 Parent PID: 342 Analysis Process: PID: 3612 Parent PID: 342 Analysis Process: PID: 3624 Parent PID: 342 Analysis Process: PID: 3632 Parent PID: 342 Analysis Process: PID: 3640 Parent PID: 342 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 21

Analysis Report Overview Information Joe Sandbox Version: 22.0.0 Analysis ID: 5734 Start time: 16:59:36 Joe Sandbox Product: CloudBasic Start date: 30.04.

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: 5734 Start time: 16:59:36 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 24s light MSVCR100.dll default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 22 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus21.windll@41/1@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.dll Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 21

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 21

6 Data Obfuscation System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section Data Obfuscation: Entry point lies outside standard sections Binary may include packed or encrypted code System Summary: PE file has a writeable.text section Classification label Reads software policies Runs a DLL by calling functions Spawns processes Uses new MSVCR Dlls Contains modern PE file flags such as dynamic base (ASLR) or NX Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: May sleep (evasive loops) to hinder dynamic analysis Program does not show much activity (idle) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 21

7 Hide Legend Behavior Graph ID: 5734 Sample: MSVCR100.dll Startdate: 30/04/201 Architecture: WINDOWS Score: 21 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files PE file has a writeable.text section started Visual Basic Delphi Java.Net C# or VB.NET Is malicious loaddll32.exe started started started 17 other processes Simulations Behavior and APIs Time Type Description 17:00:46 API Interceptor 20x Sleep call for process: modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 21

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 21

$Startup System is w7 loaddll32.exe (PID: 342 cmdline: loaddll32.exe 'C:\Users\user\Desktop\MSVCR100.dll' MD5: D2792A55032CFE25F07DCD4BEC5F40F) (PID: 3436 cmdline: C:\Users\user\Desktop\MSVCR100.dll,?$

9 Startup System is w7 loaddll32.exe (PID: 342 cmdline: loaddll32.exe 'C:\Users\user\Desktop\MSVCR100.dll' MD5: D2792A55032CFE25F07DCD4BEC5F40F) (PID: 3436 cmdline: MD5: ) (PID: 3472 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_XcptFilter MD5: ) (PID: 344 cmdline: C:\Users\user\Desktop\MSVCR100.dll, dllonexit MD5: ) (PID: 3492 cmdline: C:\Users\user\Desktop\MSVCR100.dll, set_app_type MD5: ) (PID: 3500 cmdline: C:\Users\user\Desktop\MSVCR100.dll, setusermatherr MD5: ) (PID: 350 cmdline: C:\Users\user\Desktop\MSVCR100.dll, wgetmainargs MD5: ) (PID: 3520 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_amsg_exit MD5: ) (PID: 352 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_cexit MD5: ) (PID: 3536 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_commode MD5: ) (PID: 354 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_configthreadlocale MD5: ) (PID: 3560 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_controlfp_s MD5: ) (PID: 356 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_crt_debugger_hook MD5: ) (PID: 3576 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_except_handler4_common MD5: ) (PID: 35 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_exit MD5: ) (PID: 3596 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_fmode MD5: ) (PID: 3604 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_initterm MD5: ) (PID: 3612 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_initterm_e MD5: ) (PID: 3624 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_invoke_watson MD5: ) (PID: 3632 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_lock MD5: ) (PID: 3640 cmdline: C:\Users\user\Desktop\MSVCR100.dll,_onexit MD5: ) cleanup Created / dropped Files Copyright Joe Security LLC 201 Page 9 of 21

10 unknown Process: File Type: Size (bytes): 2061 C:\Windows\System32\loaddll32.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 7766DA D25AD AAB7 04A395FCDCAFD1C3ED9D523A7BC29C62F3DFD5A 0604DF05A64D7FE6A5ACCAEC54F2A0BF16226E1DD0BADF9EC6456D402924C C41A364B7DA10631EF02D DE1F7B7012C02A1699FFB6EF45C1D0E61B9A565BF30045E0F6F63DA6 26D31FB5FB5C5E20F0F6BB3767A0EE6C09B low Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Entropy (bit): PE32 executable (DLL) (console) Intel 036, for MS Windows TrID: Win32 Dynamic Link Library (generic) ( /3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: 7160 MD5: SHA1: SHA256: SHA512: File Content Preview: MSVCR100.dll 21b27d2c93f6f41aca20aad76c69904 f1566c970a01679ce33e5250dd77a2aa039fc6 d16133a9ddd0c2f47eb420ee77c044af365952fc744b4d a2dcef0e32b3db577 b13e7453eaee494bcc3c2d7fdc61bff9d959c51a9 c6e12991c1b3a5dede6ce3351d2712aeaf4fc cff0afa f0a6b031a57bd5 is program cannot be run in DOS mode...$...d...*...*...*.5^...*.5^...*.5^...*...* *..b...*...)...*.../...*...*.i....*.:./...*.:.*...*.:...*.:.(...* File Icon Static PE Info Entrypoint: Entrypoint Section: Digitally signed: 0x10025a90.rdata 0x Copyright Joe Security LLC 201 Page 10 of 21

11 Subsystem: windows cui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL DLL Characteristics: DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x5A9E5940 [Tue Mar 6 09:02: UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: 5 OS Version Minor: 1 File Version Major: 5 File Version Minor: 1 Subsystem Version Major: 5 Subsystem Version Minor: 1 Import Hash: ee10752b4d352fce5fe17f443d59 Entrypoint Preview Instruction cmp byte ptr [esp+0h], h jne 00007FBB44F57A5Fh pushad mov esi, h lea edi, dword ptr [esi h] push edi jmp 00007FBB44F57B2h nop nop nop nop nop nop mov al, byte ptr [esi] inc esi mov byte ptr [edi], al inc edi add ebx, ebx jne 00007FBB44F57A9h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jc 00007FBB44F57Fh mov eax, h add ebx, ebx jne 00007FBB44F57A9h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc eax, eax add ebx, ebx jnc 00007FBB44F5791h jne 00007FBB44F57ABh mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jnc 00007FBB44F576h xor ecx, ecx sub eax, 03h jc 00007FBB44F57AFh shl eax, 0h mov al, byte ptr [esi] inc esi xor eax, FFFFFFFFh je 00007FBB44F57916h mov ebp, eax add ebx, ebx Copyright Joe Security LLC 201 Page 11 of 21

12 Instruction jne 00007FBB44F57A9h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx add ebx, ebx jne 00007FBB44F57A9h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx jne 00007FBB44F57C2h inc ecx add ebx, ebx jne 00007FBB44F57A9h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx add ebx, ebx jnc 00007FBB44F5791h jne 00007FBB44F57ABh mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jnc 00007FBB44F576h add ecx, 02h cmp ebp, FFFFF300h adc ecx, 01h lea edx, dword ptr [edi+ebp] cmp ebp, FFFFFFFCh jbe 00007FBB44F57B1h mov al, byte ptr [edx] inc edx mov byte ptr [edi], al inc edi dec ecx jne 00007FBB44F5799h Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x2636c 0x244.rsrc IMAGE_DIRECTORY_ENTRY_IMPORT 0x2620 0xec.rsrc IMAGE_DIRECTORY_ENTRY_RESOURCE 0x x20.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x265b0 0x10.rsrc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x25c5c 0x6.rdata IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x x0 False 0 empty 0.0 IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_ DATA, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 12 of 21

Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.rdata 0x15000 0x11000 0x10e00 False 0.979947916667 data 7.

13 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.rdata 0x x x10e00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x x1000 0x600 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_MANIFEST 0x2605c 0x224 XML 1.0 document, UTF- Unicode (with BOM) text, with very long lines, with CRLF line terminators English United States Imports DLL ADVAPI32.dll KERNEL32.DLL SHELL32.dll Import OpenProcessToken LoadLibraryA, GetProcAddress, VirtualProtect CommandLineToArgvW Exports Name Ordinal 0 0x100072f0 _XcptFilter 1 0x100072f0 dllonexit 2 0x100072f0 set_app_type 3 0x100072f0 setusermatherr 4 0x100072f0 wgetmainargs 5 0x100072f0 _amsg_exit 6 0x100072f0 _cexit 7 0x100072f0 _commode 0x100072f0 _configthreadlocale 9 0x100072f0 _controlfp_s 10 0x100072f0 _crt_debugger_hook 11 0x100072f0 _except_handler4_common 12 0x100072f0 _exit 13 0x100072f0 _fmode 14 0x100072f0 _initterm 15 0x100072f0 _initterm_e 16 0x100072f0 _invoke_watson 17 0x100072f0 _lock 1 0x100072f0 _onexit 19 0x100072f0 _unlock 20 0x100072f0 _wcmdln 21 0x100072f0 exit 22 0x100072f0 wcsstr 23 0x100072f0 Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Copyright Joe Security LLC 201 Page 13 of 21

14 Code Manipulations Statistics Behavior loaddll32.exe Click to jump to process System Behavior Analysis Process: loaddll32.exe PID: 342 Parent PID: 3016 Start time: 17:00:46 C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\MSVCR100.dll' 0xe bytes D2792A55032CFE25F07DCD4BEC5F40F File Activities File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page 14 of 21

15 File Path Offset Length Value Ascii Completion Count Source Address Symbol unknown unknown f 75 6e 64 3a Found: 4 exports, success or wait 1 E9A7D2 WriteFile f calling..call exports 73 2c c 6c Successfully called 6e 67 0d 0a c cmd line C:\ 6c f Users\user\Desktop\MSVC d 0a 53 R100.dll,? terminate@@yaxxz..suc 75 6c 6c cessfully called cmd line 6c 6c d c 69 6e C:\Users\user\Desktop\MS e 64 6c 6c 33 VCR 32 2e dll,_XcptFilter..Succ 3a 5c c c b e 5c b 74 6f 70 5c 4d e 64 6c 6c 2c 3f d 69 6e a 0d 0a c 6c c 6c d c 69 6e e 64 6c 6c e a 5c c c b e 5c b 74 6f 70 5c 4d e 64 6c 6c 2c 5f c d 0a Analysis Process: PID: 3436 Parent PID: 342 Start time: 17:00:46 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,?terminate@@YAXXZ 0x Analysis Process: PID: 3472 Parent PID: 342 Start time: 17:00:49 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_XcptFilter 0x Copyright Joe Security LLC 201 Page 15 of 21

16 Analysis Process: PID: 344 Parent PID: 342 Start time: 17:00:53 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll, dllonexit 0x4f0000 Analysis Process: PID: 3492 Parent PID: 342 Start time: 17:00:56 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll, set_app_type 0x Analysis Process: PID: 3500 Parent PID: 342 Start time: 17:00:59 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll, setusermatherr 0x50000 Analysis Process: PID: 350 Parent PID: 342 Start time: 17:01:03 C:\Windows\System32\ Copyright Joe Security LLC 201 Page 16 of 21

17 C:\Users\user\Desktop\MSVCR100.dll, wgetmainargs 0xf10000 Analysis Process: PID: 3520 Parent PID: 342 Start time: 17:01:06 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_amsg_exit 0xd20000 Analysis Process: PID: 352 Parent PID: 342 Start time: 17:01:10 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_cexit 0xb0000 Analysis Process: PID: 3536 Parent PID: 342 Start time: 17:01:13 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_commode 0xfb0000 Copyright Joe Security LLC 201 Page 17 of 21

18 Analysis Process: PID: 354 Parent PID: 342 Start time: 17:01:16 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_configthreadlocale 0xc0000 Analysis Process: PID: 3560 Parent PID: 342 Start time: 17:01:20 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_controlfp_s 0x Analysis Process: PID: 356 Parent PID: 342 Start time: 17:01:23 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_crt_debugger_hook 0x Analysis Process: PID: 3576 Parent PID: 342 Start time: 17:01:27 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_except_handler4_common 0xf70000 Copyright Joe Security LLC 201 Page 1 of 21

19 Analysis Process: PID: 35 Parent PID: 342 Start time: 17:01:30 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_exit 0x Analysis Process: PID: 3596 Parent PID: 342 Start time: 17:01:33 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_fmode 0x Analysis Process: PID: 3604 Parent PID: 342 Start time: 17:01:37 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_initterm 0x7d0000 Analysis Process: PID: 3612 Parent PID: 342 Copyright Joe Security LLC 201 Page 19 of 21

20 Start time: 17:01:40 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_initterm_e 0xcb0000 Analysis Process: PID: 3624 Parent PID: 342 Start time: 17:01:44 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_invoke_watson 0xd90000 Analysis Process: PID: 3632 Parent PID: 342 Start time: 17:01:47 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_lock 0x60000 Analysis Process: PID: 3640 Parent PID: 342 Start time: 17:01:51 C:\Windows\System32\ C:\Users\user\Desktop\MSVCR100.dll,_onexit 0x Copyright Joe Security LLC 201 Page 20 of 21

21 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 21 of 21

ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version:

ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version: ID: 54295 Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:1:42 Date: 12/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence