Automated Malware Analysis Report For
Total Page:16
File Type:pdf, Size:1020Kb
ID: 219320 Cookbook: browseurl.jbs Time: 00:06:44 Date: 01/04/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report http://ib.adnxs.com 4 Overview 4 General Information 4 Detection 5 Confidence 5 Classification Spiderchart 6 Analysis Advice 6 Mitre Att&ck Matrix 7 Signature Overview 7 Networking: 7 System Summary: 7 Malware Analysis System Evasion: 8 Malware Configuration 8 Behavior Graph 8 Simulations 8 Behavior and APIs 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 9 Yara Overview 10 Initial Sample 10 PCAP (Network Traffic) 10 Dropped Files 10 Memory Dumps 10 Unpacked PEs 10 Sigma Overview 10 Joe Sandbox View / Context 10 IPs 10 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 11 Screenshots 11 Thumbnails 11 Startup 12 Created / dropped Files 12 Domains and IPs 41 Contacted Domains 41 Contacted URLs 41 URLs from Memory and Binaries 42 Contacted IPs 44 Public 44 Static File Info 45 No static file info 45 Network Behavior 45 Network Port Distribution 45 TCP Packets 45 UDP Packets 47 DNS Queries 49 DNS Answers 49 HTTP Request Dependency Graph 53 HTTP Packets 53 HTTPS Packets 54 Copyright Joe Security LLC 2020 Page 2 of 64 Code Manipulations 63 Statistics 63 Behavior 63 System Behavior 63 Analysis Process: iexplore.exe PID: 4776 Parent PID: 696 63 General 63 File Activities 63 Registry Activities 64 Analysis Process: iexplore.exe PID: 2872 Parent PID: 4776 64 General 64 File Activities 64 Registry Activities 64 Disassembly 64 Copyright Joe Security LLC 2020 Page 3 of 64 Analysis Report http://ib.adnxs.com Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 219320 Start date: 01.04.2020 Start time: 00:06:44 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 6m 35s Hypervisor based Inspection enabled: false Report type: light Cookbook file name: browseurl.jbs Sample URL: ib.adnxs.com Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 8 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 1 Technologies: EGA enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean0.win@3/169@26/18 Cookbook Comments: Adjust boot time Enable AMSI Browsing link: https://www.app nexus.com/en/error#main-content Browsing link: https://www.appnexus.com/ Browsing link: https://www.appnexus.com/careers Browsing link: https://www.app nexus.com/careers/life-at-appnexus Browsing link: https://www.app nexus.com/careers/teams Browsing link: https://www.app nexus.com/careers/getting-hired Browsing link: https://www.app nexus.com/careers/students Browsing link: https://xandr.att.jobs/search-jobs Browsing link: https://console.appnexus.com/login Browsing link: https://openadstream- eu1.247realmedia.com/oas/ Browsing link: https://openads tream17.247realmedia.com/oas/ Copyright Joe Security LLC 2020 Page 4 of 64 Warnings: Show All Exclude process from analysis (whitelisted): taskhostw.exe, dllhost.exe, consent.exe, ielowutil.exe, WMIADAP.exe, svchost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.66.21.99, 216.58.208.46, 172.217.18.10, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 104.22.78.135, 104.22.79.135, 2.20.218.118, 204.79.197.200, 13.107.21.200, 2.18.68.82, 92.122.215.65, 92.122.215.54, 23.10.249.67, 23.10.249.90, 2.20.142.2, 216.58.208.40, 152.199.19.161, 8.253.207.121, 8.253.207.120, 8.248.131.254, 67.27.157.254, 8.241.121.254, 205.185.216.10, 205.185.216.42, 67.27.158.126, 8.241.121.126, 67.27.159.254, 8.241.122.126, 67.27.158.254, 67.27.157.126, 8.253.95.120, 8.241.122.254 Excluded domains from analysis (whitelisted): e11697.x.akamaiedge.net, www.xandr.jobs.edgekey.net, www.googleadservices.com, e11697.dscx.akamaiedge.net, fs- wildcard.microsoft.com.edgekey.net, fs- wildcard.microsoft.com.edgekey.net.globalredir.aka dns.net, adservice.google.com, tbcdn.talentbrew.com-v1.edgekey.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, prod- www.zr-att.com.akadns.net, e25441.f.akamaiedge.net, www.googletagmanager.com, e24999.f.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, bat.bing.com, auto.au.download.windowsupdate.com.c.footprint.n et, www.xandr.com.cdn.cloudflare.net, prod.fs.microsoft.com.akadns.net, xandr.att.jobs.edgekey.net, e37551.b.akamaiedge.net, www.google- analytics.com, fonts.googleapis.com, fs.microsoft.com, www-google- analytics.l.google.com, dual-a-0001.a-msedge.net, ie9comview.vo.msecnd.net, www- googletagmanager.l.google.com, f4.shared.global.fastly.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, bat-bing-com.a-0001.a- msedge.net, www.att.com.edgekey.net, i.xandr.com.cdn.cloudflare.net, go.microsoft.com.edgekey.net, smetrics.att.com.edgekey.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 0 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2020 Page 5 of 64 Strategy Score Range Further Analysis Required? Confidence Threshold 4 0 - 5 false Classification Spiderchart Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Copyright Joe Security LLC 2020 Page 6 of 64 Mitre Att&ck Matrix Remote Initial Privilege Defense Credential Lateral Command Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration and Control Effects Effects Valid Graphical User Winlogon Process Masquerading 1 Credential Security Remote File Data from Data Standard Eavesdrop on Remotely Accounts Interface 2 Helper DLL Injection 1 Dumping Software Copy 1 Local Compressed Cryptographic Insecure Track Device Discovery 1 System Protocol 2 Network Without Communication Authorization Replication Service Port Accessibility Process Network File and Remote Data from Exfiltration Standard Exploit SS7 to Remotely Through Execution Monitors Features Injection 1 Sniffing Directory Services Removable Over Other Non- Redirect Phone Wipe Data Removable Discovery 1 Media Network Application Calls/SMS Without Media Medium Layer Authorization Protocol 2 External Windows Accessibility Path Rootkit Input Query Windows Data from Automated Standard Exploit SS7 to Obtain Remote Management Features Interception Capture Registry Remote Network Exfiltration Application Track Device Device Services Instrumentation Management Shared Layer Location Cloud Drive Protocol 3 Backups Drive-by Scheduled System DLL Search Obfuscated Files Credentials System Logon Input Data Remote File SIM Card Compromise Task Firmware Order or Information in Files Network Scripts Capture Encrypted Copy 1 Swap Hijacking Configuration Discovery Signature Overview • Networking • System Summary • Malware Analysis System Evasion Click to jump to signature section Networking: Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Binary contains paths to development resources Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Found GUI installer (many successful clicks) Copyright Joe Security LLC 2020 Page 7 of 64 Found graphical window changes (likely an installer) Uses new MSVCR Dlls Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Malware Configuration No configs have been found Behavior Graph Hide Legend Behavior Graph Legend: ID: 219320 Process URL: http://ib.adnxs.com Signature Startdate: 01/04/2020 Created File Architecture: WINDOWS DNS/IP Info Score: 0 Is Dropped Is Windows Process Number of created Registry Values www.appnexus.com live-appnexus.pantheonsite.io fe2.edge.pantheon.io started Number of created Files Visual Basic Delphi Java iexplore.exe .Net C# or VB.NET C, C++ or other language 4 88 Is malicious Internet started iexplore.exe 6 193 ab13.mktoedge.com cookie-cdn.cookiepro.com 104.16.95.80, 443, 49753, 49754 104.20.184.45, 443, 49766, 49767 44 other IPs or domains unknown unknown United States United States Simulations Behavior and APIs No simulations Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Copyright Joe Security LLC 2020 Page 8 of 64 No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link bam.nr-data.net 0% Virustotal Browse cookie-cdn.cookiepro.com 0% Virustotal Browse ab13.mktoedge.com 0% Virustotal Browse i.xandr.com 0% Virustotal Browse www.xandr.com 0% Virustotal Browse URLs Source Detection Scanner Label Link https://www.xandr.com/favicon-32x32.png