ID: Cookbook: browseurl.jbs Time: 18:05:31 Date: 26/12/2017 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 1:05:31 Date: 26/12/2017 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: Data Obfuscation: System Summary: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Copyright Joe Security LLC 2017 Page 2 of 19

3 Behavior System Behavior Analysis Process: iexplore.exe PID: 322 Parent PID: 54 General File Activities Registry Activities Analysis Process: iexplore.exe PID: 320 Parent PID: 322 General File Activities Registry Activities Analysis Process: ssvagent.exe PID: 3336 Parent PID: 320 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 19

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 1:05:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 4m 29s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean3.win@5/20@4/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 100% (good quality ratio 5.2%) Quality average: 64.4% Quality standard deviation: 36.1% Warnings: Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 2017 Page 4 of 19

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Copyright Joe Security LLC 2017 Page 5 of 19

6 Signature Overview Networking Data Obfuscation System Summary Anti Debugging Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Networking: Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Social media urls found in memory data Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) System Summary: Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Classification label Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Searches the installation path of Mozilla Firefox Anti Debugging: Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 2017 Page 6 of 19

7 Extensive use of GetProcAddress (often used to hide API calls) Language, Device and Operating System Detection: Contains functionality to query local / system time Contains functionality to query windows version Behavior Graph Behavior Graph ID: Sample: Startdate: 26/12/2017 Architecture: WINDOWS Score: 3 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values iexplore.exe Number of created Files Visual Basic iexplore.exe started Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious 17 images2.vudu.com , 0 LLNW-LimelightNetworksIncUS United Kingdom 4 similar packets combined: images2.vudu.com started ssvagent.exe 6 Simulations Behavior and APIs No simulations Antivirus Detection Copyright Joe Security LLC 2017 Page 7 of 19

8 Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Detection Cloud Link images2.vudu.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 2017 Page of 19

9 Startup System is w7 iexplore.exe (PID: 322 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding CA1F703CD66567E132D2946FB55750) iexplore.exe (PID: 320 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:322 CREDAT: /prefetch:2 CA1F703CD66567E132D2946FB55750) ssvagent.exe (PID: 3336 cmdline: 'C:\PROGRA~1\Java\JRE1~1.0_1\bin\ssvagent.exe' -new 0953A026479FD1E655B75B63B903B7) cleanup Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log ASCII text, with CRLF line terminators DB3E1D5EDFB4A3EAB536C364F5C63C2 D36476BADD159EF101E CC1A673F1260 AF3DF503CE02E134A71FB6C164D44F63D59ECF2CBDFD06EA721FA2010CE06 301FA D1FFCA77235BBC1D23F4314B1996A597DC9E7E0591FC0F330A40200DC229D5A115AD0D9B BC3B475CD963517B7EDCAFA C:\Users\HERBBL~1\AppData\Local\Temp\~DF91596E2B TMP FoxPro FPT, blocks size 25, next free block index E42626C9F736D10630EEA6ED5A5A 5FE662463CF F02E45619E04531D6 Copyright Joe Security LLC 2017 Page 9 of 19

10 C:\Users\HERBBL~1\AppData\Local\Temp\~DF91596E2B TMP B6E76D72B F5BE1BC2E3035A5FE4D1743A74F55AB627CFB47FEE12 A2BB9EB5C0D20A54E02F21F00AA77F0F09B7CCA9501D41F920BFEF10E0C42A1C1E BDDCAC74CDBF53BF 50A5C032EE2C2BA4944C3631F2EF4759 C:\Users\HERBBL~1\AppData\Local\Temp\~DFAE2C99053B39D4BE.TMP data 7A59CCC422C6224A2793CB956A A2153BB44F614B237BE107AE799EA6A12C A443D39356BDB6EB774AFA346C7CAB E3BD3731CF1315 C2BEF4761D956064D29F351E646D566B625B419249A5439CCB6AABF23D03AFAC4E6FA74EBABB37BBABC511C BA57F1AA422BFD5F7D705A961F514A C:\Users\HERBBL~1\AppData\Local\Temp\~DFEC1A653CCDCC1D94.TMP FoxPro FPT, blocks size 25, next free block index C97D605A0E9A3B7B60DA7EEFC6D5 5DD72FECC7ADE35B44F02AAE96CAA32FC5D 9DC4A91AB0A41C47969A03DE E9EF7D77F646A32BF276DBD69E907D 3737BEFB0D44A69DF74577A122C072F9B7FC6952B B1C4B55E405FAC59EB5F35C3BC9DD3524FF21B597 BA46D47AFCB03F6317E045BAACAA3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA974A10C4BD62CC921D13E43B1_BEB37ABADF B E0 4 data B556CDA9CB7DD3505EFF20407FE6AFAA 9FF906CBEB2C5BFDCC9C1DFF27536E43C A2993EDF94DAA4D7206BDAADDD1A4BF61EF5E5E65CEB0B0212BAD1 6AD756739D92B490E20D4916BA6FB9C E07DDDFD9473EAFF7AC5635A7D D1EEE6CE1077CD 1ACCE3F92F01D700F775CDB5EEDB9E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57CEDB95DF3F0AD4EE2DC2BCFD4157 data 076BE59244D9D24AF156AFDFE42A2F 5DB E5A1CCFA0E5D6A506052BA1FD6 60F20CFB33E17BFEF535392A69CE32EC4BE14AA2FC0E29DE7B6D7BB010A EDDE504293B6CC992B759A4DEB405A95CBCF1BF45BAB C09B29B393E3F666A20D6EF3EA D 14CCCDD234DE7961AEA5C1273BE3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA974A10C4BD62CC921D13E43B1_BEB37ABADF B E04 data 3F F4A65B7F1377F6C955 FC7DBFA64EA527BB AEBC066ED3CD22 9BEE5C F192F4F03DB5E493956AFD3EC0A96F0732C150A517F4E 0CBE3C6EC D721B64B12C0BD90C957AF263F4D99CB7F37FCF24573CE1C030BB7E3DDD66B72C244ED 1F97D051BADCC63DD77272CCC2CAB C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416BB2E3A}.ico PNG image data, 16 x 16, -bit/color RGBA, non-interlaced 5B1904E3BC E7AC4A4A 96607BA DF3A A5E3BA63D 507C6472EB17E23D90C7BE73B3105C32B D0647B35046A32BE BF5DBCCBAD4CA240A2DDAD2DE73BFC434193A4F A EC92D99AA6B0C569C702FD155663DF 2916F74561CAE1FC73C0D9DD1A9FF7 Copyright Joe Security LLC 2017 Page 10 of 19

11 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators E6306BB52BF6F6D5D91B9D0B1E36F14 3F409FAE3E27D64695D977FF7B92AF3EE06024C4 1E096E9B5D61EF9203FEE7246B FE954DF36075FA0F2CE1B4677 0A913C7C1546F59CF1B173D65FDEA3DBBFE4D5B30909EDA1AA27CB4BC0ABDD1BD9A4D496515D633575D3EA5 50BDA06AE91D95FD654D7614C5CD C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F12A0FD1-EA5E-11E7-B7AC-B2C276BF9C}.dat Microsoft Word Document FF F2DD562CF22CB5AC7C674 A0E512BE2C E44A997D692ED10DC3493 6A0141BEFB0772B56F2D11F03255EE159502EA950F4FB3F93D219A9A C0EACECC39759EBAA CFB59B3C3D39FA4437FE59C72A3E0509EE637536EBE2E91BE7FE742DE16A4B6 EC4EA7E BBD100F74111 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F12A0FD3-EA5E-11E7-B7AC-B2C276BF9C}.dat Microsoft Word Document F6B640B7435FA6E1976CB5F9BF2C7 3C7A02D2C131F E30F09719B6D9DF0C 4EA0C9F32BDD2DFD1EEE24C51233BCFB637C3B4C454552F019019A4E9E F4FFCCDB56C45ED6264F26F6AC5EC5B2F5A19052C0769B DE910A139A F9CA23D5A33BB0C7E 6FFFB6949C4E5C5A1139D75660DE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FBD7CA40-EA5E-11E7-B7AC-B2C276BF9C}.dat Microsoft Word Document 9C79FD2EF73AD42A79BB4D76B42E13FE BB47765DF52FF791B9F7F93BB72663FC0E03A610 57F609C7B9B761C5DDDAAE4A942EFDB9E0D0D5070C1593B4F4D1DDBCFD7 92DE04B999FE4DCE2F5F753922A2322BAEE6657A41FEACEF03F2799D4BAF7AA6630DA5A B4CC30DC FCE1EA0AE33643D67B7E9277FBE554 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver9C46.tmp XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators A37D535A4A14C9BFAD79C3B719F3C F21CF355B4515C09174F5D5E5BADBF3319DD70F0 F0B53707B CA2C39C72DD32BCB60DF970313A029D605B719AC1BF9 079F412666F02FE93F2AA4DEC7CBC22B91BE70B71037C B66EA5A60590CE92DDEE64D2DD9345B44A4C97A CE53660F42069FD31047E4ED0A25C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data 461DED251B3B00EDD04EAC467BAF 17F3FA9CADC73FF6F7A357AA6EA196EA70B6D BE05DE3DC4E5C1CD3A5279EB299E006962EB4FF2EEA96525E2C7E73E667C4 D703CB70B3E23C733E24CEC5A013B99979ACAB3A5FF97A15F2E95C31BCDB0F33ED5226BD6BEAE3C44D259AA914 27FDC6955BC3BFDFB19B9763E1DA014DB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico MS Windows icon resource - 1 icon 7ACFE2AA04BA694792A9954FE609FB1B 6F01106D F9C1F5EF6ABBF19567BF 4B11231F5FDD5DCCC19A242C03FADCB5C651C5C642727F75BD7D6157CDCCC CAEF03BCA5333ED FAA4215DDB3AEF317F5A49533E3751DD1EA349A9313EF66A DDB55B29A5C DA3190FFCCC5E3E6E972EEC22D3 Copyright Joe Security LLC 2017 Page 11 of 19

12 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\urlblockindex[1].bin data FA51E3DFAECA3A0E495460FD60C791 E4F30E D37267C0162FD4A093400C C4B4E5F3F9FD5A27E61C471B3EE126396B6D129499AA7 D21667F3FB01D39B57917E74E9BB1B6E9A97F C165729A5F177DC0ADADD90CD026C7A601D416665A1AC13 A69E49A6A2FE2FDD096793AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\iecompatviewlist[1].xml XML 1.0 document, UTF- Unicode (with BOM) text, with CRLF line terminators E6306BB52BF6F6D5D91B9D0B1E36F14 3F409FAE3E27D64695D977FF7B92AF3EE06024C4 1E096E9B5D61EF9203FEE7246B FE954DF36075FA0F2CE1B4677 0A913C7C1546F59CF1B173D65FDEA3DBBFE4D5B30909EDA1AA27CB4BC0ABDD1BD9A4D496515D633575D3EA5 50BDA06AE91D95FD654D7614C5CD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\spacer[1].png PNG image data, 1 x 1, 1-bit colormap, non-interlaced F455E4DC0A19CD25B4B5992A50BF31 735F1C43563F1593E165DAEB4E EE BA7444BFBD7C20F5710BC949F4D6F0FC0A30DCC92E42BCCC21C3216ABBEF ECA255AE5D5F0BDC75E5713BFBA37EEAA504DA5BFCEABF7022B677D0392BFEE311FB2353F7B227D2A9AAB B6DFD57B52AAEC3B4A9C93AEF16C6920 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\favicon[1].ico PNG image data, 16 x 16, -bit/color RGBA, non-interlaced 5B1904E3BC E7AC4A4A 96607BA DF3A A5E3BA63D 507C6472EB17E23D90C7BE73B3105C32B D0647B35046A32BE BF5DBCCBAD4CA240A2DDAD2DE73BFC434193A4F A EC92D99AA6B0C569C702FD155663DF 2916F74561CAE1FC73C0D9DD1A9FF7 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection images2.vudu.com true 0%, virustotal, Browse Contacted IPs Copyright Joe Security LLC 2017 Page 12 of 19

13 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United Kingdom 2222 LLNW-LimelightNetworksIncUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: 77 0 (HTTP) 53 (DNS) TCP Packets Timestamp Port Dest Port IP Dest IP Dec 26, :06: CET Dec 26, :06: CET Copyright Joe Security LLC 2017 Page 13 of 19

14 Timestamp Port Dest Port IP Dest IP Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Copyright Joe Security LLC 2017 Page 14 of 19

15 Timestamp Port Dest Port IP Dest IP Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET UDP Packets Timestamp Port Dest Port IP Dest IP Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Copyright Joe Security LLC 2017 Page 15 of 19

16 Timestamp Port Dest Port IP Dest IP Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET Dec 26, :06: CET DNS Queries Timestamp IP Dest IP Trans ID OP Code Name Type Class Dec 26, :06: CET x679 Standard query (0) images2.vu du.com A (IP address) IN (0x0001) Dec 26, :06: CET x679 Standard query (0) images2.vu du.com A (IP address) IN (0x0001) Dec 26, :06: CET x679 Standard query (0) images2.vu du.com A (IP address) IN (0x0001) Dec 26, :06: CET x679 Standard query (0) images2.vu du.com A (IP address) IN (0x0001) DNS Answers Timestamp IP Dest IP Trans ID Replay Code Name CName Address Type Class Dec 26, x679 No error (0) images2.vu 1:06: du.com CET Dec 26, x679 No error (0) images2.vu 1:06: du.com CET Dec 26, x679 No error (0) images2.vu 1:06: du.com CET Dec 26, x679 No error (0) images2.vu 1:06: du.com CET A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph images2.vudu.com HTTP Packets Timestamp Port Dest Port IP Dest IP Header Total Bytes Transfered (KB) Copyright Joe Security LLC 2017 Page 16 of 19

17 Timestamp Port Dest Port IP Dest IP Header Dec 26, :06: CET GET /spacer.png HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: images2.vudu.com DNT: 1 Connection: Keep-Alive Dec 26, :06: CET HTTP/ OK Server: Apache Accept-Ranges: bytes Cache-Control: max-age= X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Type: image/png Age: Date: Tue, 26 Dec :06:21 GMT Last-Modified: Tue, 14 Nov :54:37 GMT Expires: Mon, 01 Jan :1:00 GMT Content-Length: 95 Connection: keep-alive Data Raw: e 47 0d 0a 1a 0a d db 56 ca c ff ff ff a7 c4 1b c e e6 d a d cf c 35 e e 44 ae Data Ascii: PNGIHDR%VPLTEtRNS@fIDATc`5IENDB` 20 Dec 26, :06: CET GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: images2.vudu.com DNT: 1 Connection: Keep-Alive Dec 26, :06: CET HTTP/ OK Server: Apache Accept-Ranges: bytes Cache-Control: max-age=100 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Type: image/vnd.microsoft.icon Date: Tue, 26 Dec :06:23 GMT Last-Modified: Mon, 1 Dec :07:2 GMT Expires: Tue, 26 Dec :36:23 GMT Content-Length: 1406 Connection: keep-alive Data Raw: ff ff ff 00 e4 7b c 5c 5c 00 b9 b9 b d 0e 00 a df df df c2 69 1e 00 0f 0f 0f 00 c 4b a 1f 0 00 b1 5f 1c 00 0d Data Ascii: 23 Total Bytes Transfered (KB) 5 21 Code Manipulations Statistics Behavior iexplore.exe iexplore.exe Copyright Joe Security LLC 2017 Page 17 of 19

18 ssvagent.exe Click to jump to process System Behavior Analysis Process: iexplore.exe PID: 322 Parent PID: 54 General Start time: 1:05:16 Start date: 26/12/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding 0x774a bytes CA1F703CD66567E132D2946FB55750 C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Completion Count Old File Path New File Path Completion Count File Path Offset Length Value Ascii Completion Count Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Analysis Process: iexplore.exe PID: 320 Parent PID: 322 Copyright Joe Security LLC 2017 Page 1 of 19

19 General Start time: 1:05:16 Start date: 26/12/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:322 CREDAT: /prefetch:2 0x742d bytes CA1F703CD66567E132D2946FB55750 C, C++ or other language File Activities File Path Access Attributes Options Completion Count File Path Offset Length Value Ascii Completion Count Registry Activities Key Path Name Type Old Data New Data Completion Count Analysis Process: ssvagent.exe PID: 3336 Parent PID: 320 General Start time: 1:05:19 Start date: 26/12/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\PROGRA~1\Java\JRE1~1.0_1\bin\ssvagent.exe 'C:\PROGRA~1\Java\JRE1~1.0_1\bin\ssvagent.exe' -new 0x bytes 0953A026479FD1E655B75B63B903B7 C, C++ or other language Registry Activities Key Path Completion Count Key Path Name Type Data Completion Count Key Path Name Type Old Data New Data Completion Count Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 19 of 19