Automated Malware Analysis Report For
Total Page:16
File Type:pdf, Size:1020Kb
ID: 434295 Cookbook: browseurl.jbs Time: 17:40:30 Date: 14/06/2021 Version: 32.0.0 Black Diamond Table of Contents Table of Contents 2 Windows Analysis Report https://azure.microsoft.com/email/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen- us%2Fazure%2F&p=bT04MGE5OWVjMC1jMWQ4LTRhNjEtOWNhNy01Y2Y2MTk4YmFiZTYmcz0zM2VlZmIzNy1hZmU2LTQ5NmUtOWQwYi1hZGQxYWM1NjE5MmQmdT1hZW8mbD1henVyZQ%3D%3D Overview 33 General Information 3 Detection 3 Signatures 3 Classification 3 Process Tree 3 Malware Configuration 3 Yara Overview 3 Sigma Overview 3 Signature Overview 3 Mitre Att&ck Matrix 4 Behavior Graph 4 Screenshots 4 Thumbnails 4 Antivirus, Machine Learning and Genetic Malware Detection 5 Initial Sample 5 Dropped Files 5 Unpacked PE Files 6 Domains 6 URLs 6 Domains and IPs 7 Contacted Domains 7 URLs from Memory and Binaries 7 Contacted IPs 7 Public 7 General Information 7 Simulations 8 Behavior and APIs 8 Joe Sandbox View / Context 8 IPs 8 Domains 8 ASN 8 JA3 Fingerprints 8 Dropped Files 9 Created / dropped Files 9 Static File Info 42 No static file info 42 Network Behavior 42 Network Port Distribution 42 TCP Packets 42 UDP Packets 42 DNS Queries 42 DNS Answers 43 HTTPS Packets 45 Code Manipulations 47 Statistics 47 Behavior 47 System Behavior 47 Analysis Process: iexplore.exe PID: 6712 Parent PID: 800 47 General 47 File Activities 48 Registry Activities 48 Analysis Process: iexplore.exe PID: 6776 Parent PID: 6712 48 General 48 File Activities 48 Registry Activities 48 Disassembly 48 Copyright Joe Security LLC 2021 Page 2 of 48 Windows Analysis Report https://azure.microsoft.com/e…mail/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2F&p=bT04MGE5OWVjMC1jMWQ4LTRhNjEtOWNhNy01Y2Y2MTk4YmFiZTYmcz0zM2VlZmIzNy1hZmU2LTQ5NmUtOWQwYi1hZGQxYWM1NjE5MmQmdT1hZW8mbD1henVyZQ%3D%3D Overview General Information Detection Signatures Classification Sample URL: https://azure.microsoft.com No high impact signatures. /email/?destination=https% 3A%2F%2Fdocs.microsoft ...z0zM2VlZmIzNy1hZmU2 LTQ5NmUtOWQwYi1hZG QxYWM1NjE5MmQmdT1h Ransomware ZW8mbD1henVyZQ%3D% Miner Spreading 3D mmaallliiiccciiioouusss Analysis ID: 434295 malicious Evader Phishing sssuusssppiiiccciiioouusss Infos: suspicious cccllleeaann clean Most interesting Screenshot: Exploiter Banker Spyware Trojan / Bot Adware Score: 0 Range: 0 - 100 Whitelisted: false Confidence: 80% Process Tree System is w10x64 iexplore.exe (PID: 6712 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.exe (PID: 6776 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6712 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A) cleanup Malware Configuration No configs have been found Yara Overview No yara matches Sigma Overview No Sigma rule has matched Signature Overview Click to jump to signature section Copyright Joe Security LLC 2021 Page 3 of 48 There are no malicious signatures, click here to show all signatures . Mitre Att&ck Matrix Command Remote Initial Privilege Defense Credential Lateral and Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Effects Effects Impact Valid Windows Path Process Masquerading 1 OS Security Remote Data from Exfiltration Encrypted Eavesdrop on Remotely Modify Accounts Management Interception Injection 1 Credential Software Services Local Over Other Channel 2 Insecure Track Device System Instrumentation Dumping Discovery 1 System Network Network Without Partition Medium Communication Authorization Default Scheduled Boot or Boot or Process LSASS File and Remote Data from Exfiltration Non- Exploit SS7 to Remotely Device Accounts Task/Job Logon Logon Injection 1 Memory Directory Desktop Removable Over Application Redirect Phone Wipe Data Lockout Initialization Initialization Discovery 1 Protocol Media Bluetooth Layer Calls/SMS Without Scripts Scripts Protocol 1 Authorization Domain At (Linux) Logon Script Logon Obfuscated Files Security Query SMB/Windows Data from Automated Application Exploit SS7 to Obtain Delete Accounts (Windows) Script or Information Account Registry Admin Shares Network Exfiltration Layer Track Device Device Device (Windows) Manager Shared Protocol 2 Location Cloud Data Drive Backups Behavior Graph Hide Legend Behavior Graph Legend: ID: 434295 Process URL: https://azure.microsoft.com... Signature Startdate: 14/06/2021 Created File Architecture: WINDOWS DNS/IP Info Score: 0 Is Dropped Is Windows Process started Number of created Registry Values iexplore.exe Number of created Files Visual Basic Delphi 5 58 Java .Net C# or VB.NET C, C++ or other language microsoftwindows.112.2o7.net mem.gfx.ms assets.onestore.ms started Is malicious Internet iexplore.exe 9 421 adaptivecards.io liveperson.map.fastly.net 52.173.249.137, 443, 49826, 49827 151.101.1.192, 443, 49788, 49789 24 other IPs or domains MICROSOFT-CORP-MSN-AS-BLOCKUS FASTLYUS United States United States Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2021 Page 4 of 48 Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link https://azure.microsoft.com/email/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen- 0% Avira URL Cloud safe us%2Fazure%2F&p=bT04MGE5OWVjMC1jMWQ4LTRhNjEtOWNhNy01Y2Y2MTk4YmFiZTYmcz0zM2V lZmIzNy1hZmU2LTQ5NmUtOWQwYi1hZGQxYWM1NjE5MmQmdT1hZW8mbD1henVyZQ%3D%3D Dropped Files Copyright Joe Security LLC 2021 Page 5 of 48 No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Source Detection Scanner Label Link https://static.docs.com/ui/media/product/azure/lighthouse.svg 0% Avira URL Cloud safe https://docs.micrRoot 0% Avira URL Cloud safe https://assets.onestore.ms 0% URL Reputation safe https://assets.onestore.ms 0% URL Reputation safe https://assets.onestore.ms 0% URL Reputation safe https://assets.onestore.ms 0% URL Reputation safe https://www.youradchoices.ca/fr 0% URL Reputation safe https://www.youradchoices.ca/fr 0% URL Reputation safe https://www.youradchoices.ca/fr 0% URL Reputation safe https://www.youradchoices.ca/fr 0% URL Reputation safe https://static.docs.com/ui/media/product/azure/database-mysql-server.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/iot-hub.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/maps.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/database-mariadb-server.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/cognitive-services.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/spatial-anchor-accounts.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/databricks.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/devops.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/event-hubs.svg 0% Avira URL Cloud safe https://static2.sharepointonline.com/files/fabric/assets/icons/fabricmdl2icons.woff2?2.21 0% Avira URL Cloud safe docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html 0% Avira URL Cloud safe https://www.microsoftstore.com.cn/cart 0% URL Reputation safe https://www.microsoftstore.com.cn/cart 0% URL Reputation safe https://www.microsoftstore.com.cn/cart 0% URL Reputation safe https://docs.micr.com/en-us/azure/?product=featuredRoot 0% Avira URL Cloud safe fontello.comIcon 0% URL Reputation safe fontello.comIcon 0% URL Reputation safe fontello.comIcon 0% URL Reputation safe narwhaljs.org) 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/ad-domain-services.svg 0% Avira URL Cloud safe fontello.comiconsRegulariconsiconsVersion 0% URL Reputation safe fontello.comiconsRegulariconsiconsVersion 0% URL Reputation safe fontello.comiconsRegulariconsiconsVersion 0% URL Reputation safe https://static.docs.com/ui/media/product/azure/sql-database.svg 0% Avira URL Cloud safe https://docs.micrcumentation/ 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/logic-apps.svg 0% Avira URL Cloud safe https://www.microsoftstore.com.cn/microsoft-365/microsoft-365 0% URL Reputation safe https://www.microsoftstore.com.cn/microsoft-365/microsoft-365 0% URL Reputation safe https://www.microsoftstore.com.cn/microsoft-365/microsoft-365 0% URL Reputation safe https://docs.micr.com/en-us/documentation/#mainRoot 0% Avira URL Cloud safe https://docs.micr.com/en-us/s/privacystatementRoot 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/data-lake-analytics.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/managed-applications.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/fxt-edge-filer.svg 0% Avira URL Cloud safe https://docs.micr.com/en-us/adaptive-cards/Root 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/hpc-cache.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/advisor.svg 0% Avira URL Cloud safe https://www.youradchoices.ca 0% URL Reputation safe https://www.youradchoices.ca 0% URL Reputation safe https://www.youradchoices.ca 0% URL Reputation safe https://static.docs.com/ui/media/product/azure/security-center.svg 0% Avira URL Cloud safe https://static.docs.com/ui/media/product/azure/application-gateways.svg 0% Avira URL Cloud safe Copyright Joe Security LLC 2021 Page 6 of 48 Source Detection Scanner Label Link https://static.docs.com/ui/media/product/azure/storage-azure-files.svg