ID: Sample Name: FD-1 Phase Out Notice.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 14:36:29 Date: 04/05/2018 Version: 22.0.

Transcription

1 ID: 5762 Sample Name: FD-1 Phase Out Notice.doc Cookbook: defaultwindowsofficecookbook.jbs Time: :36:2 Date: 04/05/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "FD-1 Phase Out Notice.doc" Indicators Summary Document Summary Streams Stream Path: \x1compobj, File Type: data, Stream Size: 1 Table of Contents Stream Path: \x5documentsummaryinformation, File Type: data, Stream Size: 406 Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: 1Table, File Type: FoxPro FPT, blocks size 256, next free block index , Stream Size: Stream Path: Data, File Type: dbase IV DBT of D\002C\002.DBF, blocks size , next free block index 16608, 1st item "", Stream Size: Copyright Joe Security LLC 2018 Page 2 of

3 Stream Path: WordDocument, File Type: data, Stream Size: Network Behavior Code Manipulations Statistics System Behavior Analysis Process: WINWORD.EXE PID: 3440 Parent PID: 3024 File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 15

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: 5762 Start time: :36:2 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 23s light FD-1 Phase Out Notice.doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windoc@1/5@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 0 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 15

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 15

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 15

7 Click to jump to signature section Networking: Downloads files Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Reads ini files Reads software policies Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Checks if Microsoft Office is installed Document has a 'template' value indicative for goodware Uses new MSVCR Dlls Document has a 'lastprinted' value indicative for goodware Document has a 'vbamacros' value indicative for goodware Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Document contains OLE streams with high entropy indicating encrypted embedded content Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 15

8 Hide Legend ID: 5762 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: FD-1 Phase Out Notice.doc Startdate: 04/05/2018 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started WINWORD.EXE Simulations Behavior and APIs Time Type Description :36:44 API Interceptor 3x Sleep call for process: WINWORD.EXE modified Antivirus Detection Initial Sample Detection Scanner Label Link FD-1 Phase Out Notice.doc 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2018 Page 8 of 15

9 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 15

10 Startup System is w7 WINWORD.EXE (PID: 3440 cmdline: 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\FD-1 Phase Out Notice.doc MD5: 5D78FF0BE2A870D ACFDD) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{81C86F4-355A-4001-B4DA-FA504A57CB7}.tmp Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 5D4D4EE7E06BBB0AF B23A DBB111C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D7CC5FD1 5F83AE84CAFCCED5EAF C34D5F710E5CA2D F2FBECCB25FCF50BBFC272BD75E1A66A 18B7783F0E1C54AFDA51624BC2BB2F28BA4 high, very likely benign file Copyright Joe Security LLC 2018 Page 10 of 15

11 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\FD-1 Phase Out Notice.LNK Process: C:\Program Files\Microsoft Office\Office\WINWORD.EXE File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :5: , mtime=sun Sep 24 :5: , atime=fri May 4 :36: , length=2480, window=hide Size (bytes): 2200 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 74640B2A4BF04BC4575C5AB1552DB65B CC1DA6D062A3E28FA323F6D6446F316A8B08FAA A3F42C032E8763F5E61EF3236B561782E415B60DD8B10EA2E261FBE3D8277 EF852C22E31858F1027B7AC1661B5D5DC0F772C A1A38DB2BBEF4BEB4E77EF506054AF76C D5F776D53BD6C03208C0A5508F233 low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: File Type: Size (bytes): 101 C:\Program Files\Microsoft Office\Office\WINWORD.EXE ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: CC7C D258166AA6F C46783EC65BE4C8C6BA2D2748DCC B83D1DFB11AB8B516FDBE3784F815FE18F37C604FCBCB0E20A55CCE407245E1 8875B048A06BB66D0DA85D81C06C23C2300BAD2D35B6CD17DB87EBD ABF D67B8F1772F A5A5E75B4F4840DB68F3ECDF68C44 low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: File Type: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file C:\Users\user\Desktop\~$-1 Phase Out Notice.doc Process: File Type: C:\Program Files\Microsoft Office\Office\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: FF21ADF1F74826EE3AA31EA36ADEC1C E647BCB5778C1D08CB02D73ECD04823B5C5 08B022FEFDA6C82FEEA4C0B2736E6FF757EA0DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB444FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F867116F00B671F751B5FCC3BABB31C5A2 high, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Copyright Joe Security LLC 2018 Page 11 of 15

12 Contacted IPs No contacted IP infos Static File Info File type: 0 Entropy (8bit): TrID: Microsoft Word document (3200/1) 54.23% Microsoft Word document (old ver.) (1008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1).57% File name: File size: 2480 MD5: SHA1: SHA256: SHA5: FD-1 Phase Out Notice.doc 8ad0a87c5b37e6fa3d2ee0353b47 d783ec3e31b337b1b2c566c38ecde2ae4 e367fee3b3040f51f072bf0331ebbb3a0c4c07f30dc af1f8c8c475dfad 04e4d182ac bbc1a426d7d5dce61e1bf2ebe 58ca2e33781f2aa65d181a5f84cdc784633d3ddcaf37 aede610d24b6818bcf4c2d8ecfe802c0723 File Content Preview:...> File Icon Static OLE Info Document Type: OLE Number of OLE Files: 1 OLE File "FD-1 Phase Out Notice.doc" Indicators Has Summary Info: True Application Name: Microsoft Office Word Encrypted Document: Contains Word Document Stream: True Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: Summary Code Page: 52 Title: STATE OF CALIFORNIA Subject: Author: ids_guest Keywords: Template: HQ Memo Last Saved By: Dator, Justin Revion Number: 6 Total Edit Time: 180 Last Printed: :53:00 Create Time: :42:00 Copyright Joe Security LLC 2018 Page of 15

13 Summary Last Saved Time: ::00 Number of Pages: 1 Number of Words: 278 Number of Characters: 158 Creating Application: Microsoft Office Word Security: 0 Document Summary Document Code Page: 52 Number of Lines: Number of Paragraphs: 3 Thumbnail Scaling Desired: Company: State of California Contains Dirty Links: Shared Document: Changed Hyperlinks: Application Version: Streams Stream Path: \x1compobj, File Type: data, Stream Size: 1 Stream Path: File Type: Stream Size: 1 \x1compobj Entropy: Base64 Encoded: Data ASCII: data True F... M i c r o s o f t W o r d D o c u m e n t..... M S W o r d D o c..... W o r d. D o c u m e n t q Data Raw: fe ff 03 0a ff ff ff ff c d f 73 6f f d f d 65 6e a d f f f e 44 6f d 65 6e 74 2e f4 3 b Stream Path: \x5documentsummaryinformation, File Type: data, Stream Size: 406 Stream Path: File Type: Stream Size: 406 Entropy: Base64 Encoded: \x5documentsummaryinformation Data ASCII: ,.. D ,.. P h p S t a t e o f C a l i f o r n i a H Data Raw: data fe ff d5 cd d5 c 2e 1b b 2c f ae d5 cd d5 c 2e 1b b 2c f ae c c f c c a b Stream Path: \x5summaryinformation, File Type: FoxPro FPT, blocks size 5, next free block index , Stream Size: 406 Stream Path: \x5summaryinformation File Type: FoxPro FPT, blocks size 5, next free block index Stream Size: 406 Entropy: Base64 Encoded: True Data ASCII: O h ' < H T ` l t S T A T E O F C A L I F O R N I A i d s _ g u e s Data Raw: fe ff e0 85 f f2 f 4f ab b 27 b3 d c b c d e f c Copyright Joe Security LLC 2018 Page of 15

14 Stream Path: 1Table, File Type: FoxPro FPT, blocks size 256, next free block index , Stream Size: Stream Path: File Type: FoxPro FPT, blocks size 256, next free block index Table Stream Size: Entropy: Base64 Encoded: Data ASCII: w Data Raw: 0e f e e e e True Stream Path: Data, File Type: dbase IV DBT of D\002C\002.DBF, blocks size , next free block index 16608, 1st item "", Stream Size: Stream Path: File Type: Stream Size: Entropy: Base64 Encoded: Data ASCII: Data dbase IV DBT of D\002C\002.DBF, blocks size , next free block index 16608, 1st item "" True.... D. d. D. C !.! b c... >.... A S. t. a. t. e. S. e. a. l. _. B. W R r. Y, D.!. C X 1. c D F r. Y, D.!. C X 1. c J F I F... Data Raw: fc 21 ed 21 b1 00 b f f b2 04 0a f a b f0 3e c1 1a bf Stream Path: WordDocument, File Type: data, Stream Size: Stream Path: File Type: Stream Size: WordDocument Entropy: Base64 Encoded: data True Data ASCII:.... ) b j b j H *.... d d. d d K i i i } } D. Data Raw: ec a5 c f8 bf e a 62 6a d0 fa d0 fa a b b b ff ff 0f ff ff 0f Network Behavior No network behavior found Code Manipulations Statistics Copyright Joe Security LLC 2018 Page of 15

15 System Behavior Analysis Process: WINWORD.EXE PID: 3440 Parent PID: 3024 Start time: :36:44 Start date: 04/05/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Program Files\Microsoft Office\Office\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office\WINWORD.EXE' /n 'C:\Users\user\Desktop\FD-1 Phase Out Notice.doc 0x2f6b bytes 5D78FF0BE2A870D ACFDD true C, C++ or other language high File Activities File Path Access Attributes Options Completion Count File Path Completion Count Old File Path New File Path Completion Count File Path Offset Length Value Ascii Completion Count File Path Offset Length Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 15 of 15