Automated Malware Analysis Report for Microdicom-3.0.1
Total Page:16
File Type:pdf, Size:1020Kb
ID: 153765 Sample Name: MicroDicom- 3.0.1-x64.exe Cookbook: default.jbs Time: 13:55:16 Date: 18/07/2019 Version: 26.0.0 Aquamarine Table of Contents Table of Contents 2 Analysis Report MicroDicom-3.0.1-x64.exe 4 Overview 4 General Information 4 Detection 4 Confidence 5 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 AV Detection: 6 Spreading: 6 Networking: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 System Summary: 7 Data Obfuscation: 7 Persistence and Installation Behavior: 7 Boot Survival: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Anti Debugging: 8 HIPS / PFW / Operating System Protection Evasion: 8 Language, Device and Operating System Detection: 8 Behavior Graph 8 Simulations 8 Behavior and APIs 8 Antivirus and Machine Learning Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 9 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Joe Sandbox View / Context 10 IPs 10 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 10 Screenshots 10 Thumbnails 10 Startup 11 Created / dropped Files 11 Domains and IPs 17 Contacted Domains 17 URLs from Memory and Binaries 17 Contacted IPs 17 Static File Info 17 General 18 File Icon 18 Static PE Info 18 General 18 Entrypoint Preview 18 Rich Headers 19 Copyright Joe Security LLC 2019 Page 2 of 44 Data Directories 19 Sections 20 Resources 20 Imports 20 Possible Origin 21 Network Behavior 21 Code Manipulations 21 Statistics 21 Behavior 21 System Behavior 21 Analysis Process: MicroDicom-3.0.1-x64.exe PID: 2832 Parent PID: 1804 22 General 22 File Activities 22 File Created 22 File Deleted 25 File Written 25 File Read 35 Registry Activities 36 Key Created 36 Key Value Created 36 Key Value Modified 37 Analysis Process: mDicom.exe PID: 3296 Parent PID: 2832 38 General 38 File Activities 38 File Created 38 File Written 39 File Read 43 Registry Activities 44 Key Created 44 Key Value Created 44 Key Value Modified 44 Disassembly 44 Code Analysis 44 Copyright Joe Security LLC 2019 Page 3 of 44 Analysis Report MicroDicom-3.0.1-x64.exe Overview General Information Joe Sandbox Version: 26.0.0 Aquamarine Analysis ID: 153765 Start date: 18.07.2019 Start time: 13:55:16 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 37s Hypervisor based Inspection enabled: false Report type: light Sample file name: MicroDicom-3.0.1-x64.exe Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 11 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean4.winEXE@3/19@0/0 EGA Information: Successful, ratio: 50% HDC Information: Successful, ratio: 52.7% (good quality ratio 51.9%) Quality average: 86.9% Quality standard deviation: 21.4% HCA Information: Failed Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .exe Warnings: Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe, CompatTelRunner.exe, WmiPrvSE.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 4 0 - 100 false Copyright Joe Security LLC 2019 Page 4 of 44 Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 3 0 - 5 true Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 2019 Page 5 of 44 Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Mitre Att&ck Matrix Privilege Defense Credential Lateral Command and Initial Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Valid Accounts Execution Startup Access Token Masquerading 1 Credential Process Application Clipboard Data Standard through API 1 Items 1 Manipulation 1 Dumping Discovery 2 Deployment Data 1 Encrypted 1 Cryptographic Software Protocol 1 Replication Service Registry Run Startup Software Network Security Remote Data from Exfiltration Over Fallback Through Execution Keys / Startup Items 1 Packing 1 Sniffing Software Services Removable Other Network Channels Removable Folder 1 Discovery 1 Media Medium Media Drive-by Windows Accessibility Process Access Token Input File and Windows Data from Automated Custom Compromise Management Features Injection 1 Manipulation 1 Capture Directory Remote Network Shared Exfiltration Cryptographic Instrumentation Discovery 2 Management Drive Protocol Exploit Public- Scheduled Task System DLL Search Process Credentials System Logon Scripts Input Capture Data Encrypted Multiband Facing Firmware Order Hijacking Injection 1 in Files Information Communication Application Discovery 2 2 Spearphishing Command-Line Shortcut File System Obfuscated Files Account Remote System Shared Data Staged Scheduled Standard Link Interface Modification Permissions or Information 1 Manipulation Discovery Webroot Transfer Cryptographic Weakness Protocol Spearphishing Graphical User Modify Existing New Service DLL Side- Brute Force System Third-party Screen Capture Data Transfer Commonly Attachment Interface Service Loading 1 Owner/User Software Size Limits Used Port Discovery Signature Overview • AV Detection • Spreading • Networking • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Data Obfuscation • Persistence and Installation Behavior • Boot Survival • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus or Machine Learning detection for unpacked file Spreading: Contains functionality to enumerate / list files inside a directory Networking: Urls found in memory or binary data Key, Mouse, Clipboard, Microphone and Screen Capturing: Copyright Joe Security LLC 2019 Page 6 of 44 Contains functionality for read data from the clipboard System Summary: Contains functionality to call native functions Contains functionality to shutdown / reboot the system Creates mutexes Detected potential crypto function PE file contains strange resources Sample file is different than original file name gathered from version info Sample reads its own file content Tries to load missing DLLs Classification label Contains functionality to adjust token privileges (e.g. debug / backup) Contains functionality to check free disk space Contains functionality to instantiate COM classes Creates files inside the program directory Creates files inside the user directory Creates temporary files PE file has an executable .text section and no other executable section Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Found installer window with terms and condition text Found window with many clickable UI elements (buttons, textforms, scrollbars etc) Creates a directory in C:\Program Files Submission file is bigger than most known malware samples Contains modern PE file flags such as dynamic base (ASLR) or NX Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) Persistence and Installation Behavior: Drops PE files Creates license or readme file Boot Survival: Stores files to the Windows start menu directory Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Malware Analysis System Evasion: Checks the free space of harddrives Found dropped PE file which has not been started or loaded Contains functionality to enumerate / list files inside a directory Copyright Joe Security LLC 2019 Page 7 of 44 May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Program exit points Queries a list of all running processes Anti Debugging: Contains functionality to dynamically determine API calls HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Contains functionality to query windows version Behavior Graph Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Behavior Graph Is Windows Process ID: 153765 Sample: MicroDicom-3.0.1-x64.exe Number of created Registry Values Startdate: 18/07/2019 Architecture: WINDOWS Number of created Files Score: 4 Visual Basic started Delphi Java MicroDicom-3.0.1-x64.exe .Net C# or VB.NET 29 56 C, C++ or other language Is malicious dropped dropped dropped