ID: Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/08/2018 Version:

Transcription

1 ID: 153 Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/0/201 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Table of Contents Copyright Joe Security LLC 201 Page 2 of

3 Behavior System Behavior Analysis Process: cmd.exe PID: 4036 Parent PID: 2336 General File Activities File Created Analysis Process: wget.exe PID: 4064 Parent PID: 4036 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 13

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 153 Start date: Start time: 20:31:22 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: CloudBasic 0h 1m 16s light urldownload.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: EGA Information: HDC Information: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.win@3/2@1/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Unable to download file Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 13

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Copyright Joe Security LLC 201 Page 5 of 13

6 Signature Overview Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data System Summary: Classification label Creates files inside the user directory Reads software policies Spawns processes Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 13

7 Hide Legend Behavior Graph ID: 153 URL: Startdate: 09/0/201 Architecture: WINDOWS Score: 0 started cmd.exe Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java 1.Net C# or VB.NET C, C++ or other language started Is malicious wget.exe wdc.sl.g2mks.com , 4910, 0 SOFTLAYER-SoftLayerTechnologiesIncUS United States usersync.athelk.com Simulations Behavior and APIs Time Type Description 20:31:2 API Interceptor 14x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link wdc.sl.g2mks.com 0% virustotal Browse usersync.athelk.com 0% virustotal Browse Copyright Joe Security LLC 201 Page of 13

8 URLs Source Detection Scanner Label Link 0% virustotal Browse 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Startup System is w cmd.exe (PID: 4036 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-ag ent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 MD5: ADB9C1403B52BC532FBA594342B9) wget.exe (PID: 4064 cmdline: wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' MD5: 3DADB6E2ECE9C4B3E1E322E6165B60) cleanup Copyright Joe Security LLC 201 Page of 13

9 Created / dropped Files C:\Users\user\Desktop\cmdline.out Process: File Type: Size (bytes): 34 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: E650A935CDBCD1A26606FA463AE6 3564D63D6B143BF26925C6EEE99CAE5F63 DCC09ED16C1D6B54EE4B1B2610A1D631B3C2F4BF42031E50C 2CCEE9CD3BB2CCD4DD922FF35B6AA295690ECCEA5696B299CC3350E9C43DA343009FAC1A4A25 26F FE6AA0A3963A A1AB0 low \Endpoint Process: File Type: Size (bytes): 195 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-5: Malicious: Reputation: 55034B60EAD9459B46DA029CDECA9 D1D630BA0920C2F0F9C25C1D5B4E42C601E 3FD5C2E ADEDB9CC9E1B24BED61E1AE6B94C30A934DA F29064E05340FED2C5991A142B19D1ADC35AB4BF EE5A03AC5292C2E949C6BE36303FCA BBB9DC9D46C DEF406BBC9F low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation wdc.sl.g2mks.com true 0%, virustotal, Browse unknown usersync.athelk.com unknown unknown 0%, virustotal, Browse unknown Contacted URLs Name Process C:\Windows\System32\wget.exe Contacted IPs Copyright Joe Security LLC 201 Page 9 of 13

10 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 5% 5% < No. of IPs Public IP Country Flag ASN ASN Name Malicious United States SOFTLAYER- SoftLayerTechnologiesIncUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: 0 (HTTP) 53 (DNS) TCP Packets Copyright Joe Security LLC 201 Page 10 of 13

11 Timestamp Source Port Dest Port Source IP Dest IP Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST Aug 9, :32: CEST UDP Packets Timestamp Source Port Dest Port Source IP Dest IP Aug 9, :32: CEST Aug 9, :32: CEST DNS Queries Timestamp Source IP Dest IP Trans ID OP Code Name Type Class Aug 9, :32: CEST x5460 Standard query (0) usersync.a thelk.com A (IP address) IN (0x0001) DNS Answers Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class Aug 9, x5460 No error (0) usersync.a 20:32: thelk.com CEST Aug 9, x5460 No error (0) wdc.sl.g2m 20:32: ks.com CEST Aug 9, x5460 No error (0) wdc.sl.g2m 20:32: ks.com CEST Aug 9, x5460 No error (0) wdc.sl.g2m 20:32: ks.com CEST wdc.sl.g2mks.com CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph usersync.athelk.com HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Process C:\Windows\System32\wget.exe Timestamp kbytes transferred Direction Data Aug 9, :32: CEST 0 OUT GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko Accept: */* Accept-Encoding: identity Host: usersync.athelk.com Connection: Keep-Alive Aug 9, :32: CEST 0 IN HTTP/ Not Found Server: nginx/ Date: Thu, 09 Aug 201 1:32:02 GMT Content-Type: text/plain; charset=utf- Content-Length: 19 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: e 6f f 5 6e 64 0a Data Ascii: 404 page not found Copyright Joe Security LLC 201 Page 11 of 13

12 Timestamp kbytes transferred Direction Data Aug 9, :32: CEST 1 IN HTTP/ Not Found Server: nginx/ Date: Thu, 09 Aug 201 1:32:02 GMT Content-Type: text/plain; charset=utf- Content-Length: 19 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: e 6f f 5 6e 64 0a Data Ascii: 404 page not found Code Manipulations Statistics Behavior cmd.exe wget.exe Click to jump to process System Behavior Analysis Process: cmd.exe PID: 4036 Parent PID: 2336 General Start time: 20:31:25 Start date: 09/0/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no -check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 0x4a bytes ADB9C1403B52BC532FBA594342B9 true C, C++ or other language low File Activities Copyright Joe Security LLC 201 Page of 13

13 File Created File Path Access Attributes Options Completion Count C:\Users\user\Desktop\cmdline.out read attributes synchronize generic write normal synchronous io non alert non directory file Source Address Symbol success or wait 1 4A933A9 CreateFileW File Path Offset Length Completion Count Source Address Symbol Analysis Process: wget.exe PID: 4064 Parent PID: 4036 General Start time: 20:31:26 Start date: 09/0/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-d isposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/.0; AS; rv:11.0) like Gecko' ' 0x bytes 3DADB6E2ECE9C4B3E1E322E6165B60 true C, C++ or other language low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 13 of 13