ID: Sample Name: 11#Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.exe Cookbook: default.jbs Time: 09:47:21 Date: 02/02/2018 Version: 20.0.

Transcription

1 ID: 4457 Sample Name: #Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.exe Cookbook: default.jbs Time: 09:47:21 Date: 02/02/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: ntvdm.exe PID: 30 Parent PID: 23 General File Activities File Created File Deleted File Written Copyright Joe Security LLC 201 Page 2 of 12

3 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 12

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 4457 Start time: 09:47:21 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 15s false light #Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.e xe default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE, FF 54, Chrome 0, Acrobat Reader DC 17, Flash 2, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: SUS HCA enabled EGA enabled HDC enabled sus21.evad.winexe@1/2@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Found application associated with file extension:.exe Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 12

5 Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample is a picture (JPEG, PNG, GIF etc), nothing to analyze Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook Sample launched by virtual dos engine, sample likely has a wrong file extension Copyright Joe Security LLC 201 Page 5 of 12

6 Signature Overview Networking Spreading System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Urls found in memory or binary data Spreading: Checks for available system drives (often done to infect USB drives) System Summary: Classification label Creates temporary files Reads software policies Creates driver files HIPS / PFW / Operating System Protection Evasion: Modifies the context of a thread in another process (thread injection) Anti Debugging: Checks if the current process is being debugged Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page of 12

7 Hide Legend ID: 4457 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Sample: #Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.exe Startdate: 02/02/201 Architecture: WINDOWS Score: 21 started ntvdm.exe Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious 4 Modifies the context of a thread in another process (thread injection) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 12

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 12

9 Startup System is w7 cleanup ntvdm.exe (PID: 30 cmdline: 'C:\Windows\system32\ntvdm.exe' -i1 MD5: F51A7C1D220FE0F429DF5EF0DE5D) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp File Type: Size (bytes): 174 ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-25: SHA-512: Malicious: Reputation: false CFDDB5AA59B49F34B97CD4F013B 1E302F435BFF25AD9FF7E072721B2B9C0E EE C3E025B40A7240EAF2C375FC52C5A0A9CC35D37C 494CC70AA0CDAD4BCE434175B3E23BDFCC7A90FAFFFFFADDCAEC7CC733357D2D459044F44EB5 33ED2ED FC03BFA7DBB false moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp File Type: DOS batch file, ASCII text, with CRLF line terminators Size (bytes): 139 Copyright Joe Security LLC 201 Page 9 of 12

10 C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp Entropy (bit): Encrypted: MD5: SHA1: SHA-25: SHA-512: Malicious: Reputation: false 4C31DEA39F7AEEF49953BDC0AB4A9B 09C7927DA035272D7E1A3F2435A5A057 0D1C23ECA59B9DDAD179ECCC42C032CDFF424AFCFEE5D05D3FF7DFD BF05F553C2D45CFBD5DD CDAC0723C24294E D93E7D51B75FF30C7D94D0D04FF EF1DE7C230E4BF4B224F4992CDD75 false moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: JPEG image data, JFIF standard 1.01 Entropy (bit): TrID: JFIF JPEG Bitmap (4007/3) 50.02% JPEG Bitmap (3003/1) 37.49% MP3 audio (01/1) 12.50% File name: File size: 715 MD5: SHA1: SHA25: SHA512: File Content Preview: #Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.e xe e2905e53057bdef10d43df5329 fe0e9ace fe1a73aa5f773d dff9fc14a5ff194b214dad7357be7754e717e7c 9249c5932fec32fd dfbb52b477f7e43701e91df52b4c31e320122c04172 a32191a3b9e4ebd7e30c9cf4d0cea13c9017de51d4 b975a4a19a4bd4cda9f2d7c27fb4...jfif...,.,...c......c...i.^.."....}...!1a..qa."q File Icon Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 201 Page of 12

11 Statistics System Behavior Analysis Process: ntvdm.exe PID: 30 Parent PID: 23 General Start time: 09:47:15 Start date: 02/02/201 Path: C:\Windows\System32\ntvdm.exe Wow4 process (32bit): false Commandline: 'C:\Windows\system32\ntvdm.exe' -i1 Imagebase: 0xe4d0000 File size: 524 bytes MD5 hash: F51A7C1D220FE0F429DF5EF0DE5D Programmed in: C, C++ or other language Reputation: moderate File Activities File Created File Path Access Attributes Options Completion Count C:\MSDOS.SYS C:\IO.SYS C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp read attributes and synchroniz e read attributes and synchroniz e read attributes and synchroniz e and generic read read attributes and synchroniz e and generic read readony and hidden and system readony and hidden and system normal normal synchronous io non alert and n on directory file synchronous io non alert and n on directory file synchronous io non alert and n on directory file synchronous io non alert and n on directory file Source Address Symbol success or wait 1 E4F9FEF CreateFileA success or wait 1 E4FA039 CreateFileA success or wait 1 E5217A7 GetTempFileNameA success or wait 1 E5217A7 GetTempFileNameA File Deleted File Path Completion Count Source Address C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp success or wait 1 E5207DB DeleteFileA C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp success or wait 1 E5207FA DeleteFileA Symbol File Written File Path Offset Length Value Ascii Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown 13 4 f 73 3d 9 7 2c d 2 Source Address Symbol dos=high, umb success or wait 3 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown 2 0d 0a.. success or wait 3 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown d device= success or wait 1 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown 43 3a 5c 57 9 e 4 f C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown 49 3 f 75 e d c c 43 3a 5c 57 9 e 4 f c d c 3 f 75 e e d 0a C:\Windows success or wait 1 E WriteFile country=001,437,c:\windo ws\system32\country.sys.. success or wait 1 E WriteFile Copyright Joe Security LLC 201 Page of 12

12 File Path Offset Length Value Ascii Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown c c 3d 43 3a 5c 57 9 e 4 f c d c 3 f d d 1 e 4 2e 3 f d 20 2f a 5c 57 9 e 4 f c d shell=c:\windows\system 32\command.com /p C:\Windows\system32 success or wait 1 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20A9.tmp unknown 2 0d 0a.. success or wait 1 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp unknown f 20 off success or wait 5 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp unknown 2 0d 0a.. success or wait 5 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp unknown 3 c 20 lh success or wait 3 E WriteFile C:\Users\HERBBL~1\AppData\Local\Temp\scs20BE.tmp unknown 43 3a 5c 57 9 e 4 f Source Address Symbol C:\Windows success or wait 3 E WriteFile unknown unknown 1 invalid handle 34 E51D737 WriteFile Disassembly Code Analysis Copyright Joe Security LLC 201 Page 12 of 12