ID: Cookbook: urldownload.jbs Time: 19:58:34 Date: 02/05/2018 Version:

Transcription

1 ID: Cookbook: urldownload.jbs Time: 19:5:34 Date: 02/05/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: Persistence and Installation Behavior: System Summary: HIPS / PFW / Operating System Protection Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Copyright Joe Security LLC 201 Page 2 of 14

3 Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 3620 Parent PID: 244 General File Activities File Created Analysis Process: wget.exe PID: 364 Parent PID: 3620 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 19:5:34 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 1m 27s light urldownload.jbs RzTUGS0QAGXECTmzYTAGQYCQi Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@3/2@5/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Unable to download file Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Copyright Joe Security LLC 201 Page 5 of 14

6 Signature Overview Networking Persistence and Installation Behavior System Summary HIPS / PFW / Operating System Protection Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data Persistence and Installation Behavior: May use bcdedit to modify the Windows boot settings System Summary: Classification label Creates files inside the program directory Reads software policies Spawns processes Creates a directory in C:\Program Files HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 14

7 Behavior Graph ID: URL: Startdate: 02/05/201 Architecture: WINDOWS Score: 1 started cmd.exe Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET 1 C, C++ or other language Is malicious started wget.exe youngsvill , 49172, 0 GOOGLE-GoogleIncUS United States Simulations Behavior and APIs Time Type Description 19:59:2 API Interceptor 57x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link 1% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link youngsvill 1% virustotal Browse Copyright Joe Security LLC 201 Page 7 of 14

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 14

9 Startup System is w7 cmd.exe (PID: 3620 cmdline: C:\Windows\system32\cmd.exe /c wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent=' Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 MD5: AD7B9C1403B52BC532FBA594342B9) wget.exe (PID: 364 cmdline: wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WO W64; Trident/7.0; AS; rv:11.0) like Gecko' ' MD5: 3DADB6E2ECE9C4B3E1E322E61765B60) cleanup Created / dropped Files C:\Program Files\AutoIt3\cmdline.out Process: File Type: Size (bytes): 375 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 7E2BA71C214121B3A00EA132163BBF1 65F2D010A399F5DE96AC4D C5ABFD75 2E19B2AF76E0365CD3FF5DD ECEBFCDA94F77F1371CDD E 34DFCFDBCCC12A477A5F3C7DA2D64F97FFCC57C76C9B5A3BBDB C005AAA65C6D54D539FDFFB9 1F B64CE4C1C95DD5045CAD7ADBD0 low Copyright Joe Security LLC 201 Page 9 of 14

10 \Endpoint Process: File Type: Size (bytes): 233 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: E5D9E76D1F69BDAE531C2DC973F0A32 F232E437EB D6AE4C3176B30 E72E746230D96A5956D207BBB2DDD9F F534A01090D9B0F4CD 60FABFC5DC2234ADCEFC62F1C7E116ED39ADB4D09654C1240B57AFEE997030AD B349952EA0 D6A4DFDAE07A1D6C53B54EA1C2C727066C4E low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation youngsvill true 1%, virustotal, Browse unknown Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States GOOGLE-GoogleIncUS Static File Info No static file info Network Behavior Copyright Joe Security LLC 201 Page 10 of 14

11 Network Behavior Network Port Distribution Total Packets: 15 0 (HTTP) 53 (DNS) TCP Packets Timestamp Source Port Dest Port Source IP Dest IP May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST UDP Packets Timestamp Source Port Dest Port Source IP Dest IP May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST May 2, :59: CEST ICMP Packets Timestamp Source IP Dest IP Checksum Code Type May 2, :59: CEST d00c (Port unreachable) Destination Unreachable Copyright Joe Security LLC 201 Page 11 of 14

12 DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class May 2, :59: CEST x5ab5 Standard query (0) youngsvill A (IP address) IN (0x0001) May 2, :59: CEST x5ab5 Standard query (0) youngsvill A (IP address) IN (0x0001) May 2, :59: CEST x5ab5 Standard query (0) youngsvill A (IP address) IN (0x0001) May 2, :59: CEST x5ab5 Standard query (0) youngsvill A (IP address) IN (0x0001) May 2, :59: CEST x5ab5 Standard query (0) youngsvill A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class May 2, x5ab5 No error (0) youngsvill 19:59: CEST May 2, x5ab5 No error (0) youngsvill 19:59: CEST May 2, x5ab5 No error (0) youngsvill 19:59: CEST May 2, x5ab5 No error (0) youngsvill 19:59: CEST May 2, x5ab5 No error (0) youngsvill 19:59: CEST A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph youngsvill HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\wget.exe Timestamp kbytes transferred Direction Data May 2, :59: CEST 1 OUT GET /?32z2a=RzTUGS0QAGXECTmzYTAGQYCQi HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: */* Accept-Encoding: identity Host: youngsvill Connection: Keep-Alive May 2, :59: CEST 2 IN HTTP/ Not Found Server: nginx Date: Wed, 02 May :59:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/ Data Raw: d 0a 3c d 6c 3e 0a 3c e 20 3c c 65 3e e 6f f 75 6e 64 3c 2f c 65 3e 3c 2f e 0a 3c 62 6f f 6c 6f 72 3d e 0a 3c e e 3c e e 6f f 75 6e 64 3c 2f e 3c 2f e e 0a 3c e 3c e e 6e e 7 2f 31 2e e 31 3c 2f e e 0a 3c 2f 62 6f e 0a 3c 2f d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a3<html><head> <title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found< /h1></center><hr><center>nginx/1.12.1</center></body></html>0 Copyright Joe Security LLC 201 Page 12 of 14

13 Timestamp kbytes transferred Direction Data May 2, :59: CEST 2 IN HTTP/ Not Found Server: nginx Date: Wed, 02 May :59:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/ Data Raw: d 0a 3c d 6c 3e 0a 3c e 20 3c c 65 3e e 6f f 75 6e 64 3c 2f c 65 3e 3c 2f e 0a 3c 62 6f f 6c 6f 72 3d e 0a 3c e e 3c e e 6f f 75 6e 64 3c 2f e 3c 2f e e 0a 3c e 3c e e 6e e 7 2f 31 2e e 31 3c 2f e e 0a 3c 2f 62 6f e 0a 3c 2f d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a3<html><head> <title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found< /h1></center><hr><center>nginx/1.12.1</center></body></html>0 Code Manipulations Statistics Behavior cmd.exe wget.exe Click to jump to process System Behavior Analysis Process: cmd.exe PID: 3620 Parent PID: 244 General Start time: 19:59:26 Start date: 02/05/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wget -v -T 60 -P 'C:\Users\user\Desktop\download' --nocheck-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' S0QAGXECTmzYTAGQYCQi' > cmdline.out 2>&1 0x4ac bytes AD7B9C1403B52BC532FBA594342B9 Copyright Joe Security LLC 201 Page 13 of 14

14 Has administrator privileges: Programmed in: Reputation: true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Program Files\AutoIt3\cmdline.out read attributes and synchroniz e and generic write normal synchronous io non alert and n on directory file Source Address Symbol success or wait 1 4AC33A79 CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 364 Parent PID: 3620 General Start time: 19:59:27 Start date: 02/05/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wget.exe wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'http: //youngsvill/?32z2a=rztugs0qagxectmzytagqycqi' 0x bytes 3DADB6E2ECE9C4B3E1E322E61765B60 true C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14