ID: Sample Name: fly.jse Cookbook: default.jbs Time: 18:17:26 Date: 11/11/2017 Version:

Transcription

1 ID: 371 Sample Name: fly.jse Cookbook: default.jbs Time: 1:17:2 Date: 11/11/2017 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Signature Overview Networking: Boot Survival: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Lowering of HIPS / PFW / Operating System Security Settings: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Network Behavior TCP Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: wscript.exe PID: 3100 Parent PID: Copyright Joe Security LLC 2017 Page 2 of 14

3 File Activities File Created File Written Analysis Process: explorer.exe PID: 3240 Parent PID: 200 File Activities File Created Analysis Process: explorer.exe PID: 32 Parent PID: 54 Registry Activities Analysis Process: wscript.exe PID: 329 Parent PID: 32 File Activities Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 14

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: 371 Start time: 1:17:2 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 44s false light fly.jse default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 17, Flash 2, Java ) Number of analysed new started processes analysed: Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal52.evad.troj.winjse@5/1@0/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.jse Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2017 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Evader Spreading malicious malicious malicious suspicious suspicious suspicious Exploiter Phishing clean clean clean Spyware Banker Adware Trojan / Bot Signature Overview Copyright Joe Security LLC 2017 Page 5 of 14

6 Networking Boot Survival Spreading System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Lowering of HIPS / PFW / Operating System Security Settings Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data Detected TCP or UDP traffic on non-standard ports Boot Survival: Creates a start menu entry (Start Menu\Programs\Startup) Stores files to the Windows start menu directory Spreading: Enumerates the file system System Summary: Binary contains paths to debug symbols Classification label Creates files inside the user directory Launches a second explorer.exe instance Queries process information (via WMI, Win32_Process) Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Suspicious javascript / visual basic script found (invalid extension) HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for debuggers (devices) Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Enumerates the file system Found WSH timer for Javascript or VBS script (likely evasive script) Copyright Joe Security LLC 2017 Page of 14

7 May sleep (evasive loops) to hinder dynamic analysis Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) System process connects to network (likely due to code injection or exploit) Lowering of HIPS / PFW / Operating System Security Settings: AV process strings found (often used to terminate AV products) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Behavior Graph ID: 371 Sample: fly.jse Startdate: 11/11/2017 Architecture: WINDOWS Score: 52 Legend: Process Signature Created File DNS/IP Info Is Dropped started started started Is Windows Process Number of created Registry Values wscript.exe explorer.exe explorer.exe Number of created Files Visual Basic Delphi Java.Net C# or VB.NET , 7500 HOSTING-SOLUTIONS-HostingSolutionLtdUS Netherlands C, C++ or other language Is malicious started System process connects to network (likely due to code injection or exploit) Detected TCP or UDP traffic on non-standard ports Suspicious javascript / visual basic script found (invalid extension) Suspicious javascript / visual basic script found (invalid extension) wscript.exe System process connects to network (likely due to code injection or exploit) Simulations Behavior and APIs Time Type Description 1:17:1 API Interceptor x Sleep call for process: wscript.exe modified from: 0000ms to: 500ms 1:1:07 API Interceptor 2x Sleep call for process: explorer.exe modified from: 0000ms to: 500ms Copyright Joe Security LLC 2017 Page 7 of 14

8 Time Type Description 1:1:07 Autostart Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Match Associated Sample Name / URL SHA 25 Detection Link Context Fatt.997.jse 2a25ed7dba3aa9b2f1da40e malicious ab4b027d90c040da019a2d02 992daaa0ef pdf_fattura.n021.jse 343a1b2c9deb3ca59f4c12 malicious 34ad5400ca152cbc0bc93f 92ed7d4 Browse Browse Domains No context Copyright Joe Security LLC 2017 Page of 14

9 ASN Match Associated Sample Name / URL HOSTING-SOLUTIONS-HostingSolutionLtdUS 1771.doc ae4b d01a1d4277 malicious c5c4d2a374fe5bb330a1171b d c Browse &1.pdf.facture.jse 224ad333eb3b2705b9c453a malicious d007aa5a4a13730da77937c7 c2511bf2b4f Browse doc ae4b d01a1d4277 malicious c5c4d2a374fe5bb330a1171b d c Browse armsvc.jse 9c1b95fdf00bc3f5f1abca17 malicious 2fdffc21e1cfe435ae c9a Browse SHA 25 Detection Link Context Dropped Files No context Screenshot Startup Copyright Joe Security LLC 2017 Page 9 of 14

10 System is w7 wscript.exe (PID: 3100 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\fly.jse' MD5: 979D74799EACB179ADF5204A) explorer.exe (PID: 3240 cmdline: explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse MD5: DDCA324434FFA50CF7DC4E51DB7935) explorer.exe (PID: 32 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-93-4c0-abb-7a7b00b24b} -Embedding MD5: DDCA324434FFA50CF7DC4E51DB7935) wscript.exe (PID: 329 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse' MD5: 979D74799EACB179ADF5204A) cleanup Created / dropped Files C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse File Type: MD5: SHA1: SHA-25: SHA-512: Malicious: data 004f51044c20efe99e3d2c5e4c4a7 2F75EC11422DBF07C45D3FE44D954144A27 2B40AA2252DED3D1D190EE441EA01F4EA3D225F51372FB53E41FCD3 DD71755D311FE91D197C90AE3C2970D2C17132FCA577AB2C0BD0A1E40E5C C7A435BFDA133AAB11A 5A0C9F59D4FE41B73BB59C true Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious Netherlands 1457 HOSTING-SOLUTIONS- HostingSolutionLtdUS true Static File Info Copyright Joe Security LLC 2017 Page 10 of 14

11 File type: TrID: File name: File size: MD5: SHA1: SHA25: SHA512: File Content Preview: data fly.jse 00be55cb7af075cdbf19c2799e ce92c924c0ebb3dbe9c774bf12d353da e11f5fd17a0d2a3d13cbfd5777c7cdae4942e7 ccfa3efcf32b7cf 470b3359cad22cfe215ee5579c5ecbc5da3547e3e 9df0e9dd410dee4e3c3bcffdf17df39ade1b00b15e cc499327e7e4229d27d9dccda7c7d3 fx$z~ti:gub3c/hdy.:+{{$!sqyihw.r0lgdt.d,']t~ti: KxrVmD+^nlk+Ny{x$Z~TI:GUb3C+^nmDDGU2F',TBF DisG.kVmEkEl^VH0%{$T~TIhKxk0CY.D:2+x$Z~TI:G Ub3ChbOtO!x,Z~FDIsWUk0CDlV. Z'$Z~DisWUk0lnhb Y*Ox$Z~FYIhW.k0l.+dnmD^t2x$Z File Icon Network Behavior TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Nov 11, :1: CET Nov 11, :1: CET Nov 11, :1: CET Nov 11, :1: CET Nov 11, :1: CET Nov 11, :19: CET Nov 11, :19: CET Nov 11, :19: CET Nov 11, :19: CET Nov 11, :19: CET Nov 11, :19: CET Nov 11, :20: CET Code Manipulations Statistics Behavior wscript.exe explorer.exe explorer.exe wscript.exe Copyright Joe Security LLC 2017 Page 11 of 14

12 Click to jump to process System Behavior Analysis Process: wscript.exe PID: 3100 Parent PID: 24 Start time: 1:17:15 Start date: 11/11/2017 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\wscript.exe false 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\fly.jse' 0x bytes 979D74799EACB179ADF5204A C, C++ or other language File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\P rograms\startup\fly.jse read attributes and synchroniz e and generic write normal synchronous io non alert and n on directory file Source Address Symbol success or wait 1 F2F353E CreateFileW File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 2017 Page 12 of 14

13 File Path Offset Length Value Ascii Completion Count C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fly.jse unknown e 5e 4d 44 f d 3d 4b c b b 7 4f a 7e a c f a 7e a f f 3a 2b 7b 7b c f 44 2c d 54 7e a 4b d 44 2b 5e e c b 2b 4e 79 7b a 7e a b 5e e d c b 5 d 45 b 45 c 5e b e b 7 b f 44 3a 32 2b a 7e a f 74 4f c 5a 7e b c 5 7f 20 5a a 7e b 30 c e a 4f a 7e b 30 c 2e 2b 4 e d 44 5e a Source Address Symbol #@~^MDoIAA==hKxr0lDtk kvox$z~qt p:gub3l4ro4vxrfx$z~ti: GUb3C/HdY.:+ {{$!SqYihW.r0lGDt.D,']T~ TI:KxrVmD+^nlk+Ny{x$Z ~TI:GUb 3C+^nmDDGU2F',TBFDis G.kVmEkEl^VH0% {$T~TIhKxk0CY.D:2+x$Z ~TI :GUb3ChbOtO!x,Z~FDIsW Uk0CDlV. Z'$Z~DisWUk0lnhbY*Ox$ Z~FYIhW. k0l.+dnmd^t2x$z success or wait 1 F2F3FBE WriteFile unknown 2 0d 0a.. success or wait 1 F2F3FBE WriteFile Analysis Process: explorer.exe PID: 3240 Parent PID: 200 Start time: 1:1:07 Start date: 11/11/2017 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\explorer.exe false explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f ly.jse 0x774a bytes DDCA324434FFA50CF7DC4E51DB7935 C, C++ or other language File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\AppData\Local\Microsoft\Windows\Caches read data or list directory and synchronize normal Source Address Symbol directory file and object name collision 1 12D72 ILCreateFromPathW synchronous io non alert and open for backup ident and open reparse point Analysis Process: explorer.exe PID: 32 Parent PID: 54 Copyright Joe Security LLC 2017 Page 13 of 14

14 Start time: 1:1:07 Start date: 11/11/2017 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\explorer.exe false C:\Windows\explorer.exe /factory,{75dff2b7-93-4c0-abb-7a7b00b24b} -Embedding 0x75b bytes DDCA324434FFA50CF7DC4E51DB7935 C, C++ or other language Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Analysis Process: wscript.exe PID: 329 Parent PID: 32 Start time: 1:1:0 Start date: 11/11/2017 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\wscript.exe false 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start M enu\programs\startup\fly.jse' 0xc5b bytes 979D74799EACB179ADF5204A C, C++ or other language File Activities File Path Access Attributes Options Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 14 of 14