Automated Malware Analysis Report For
Total Page：16
File Type：pdf, Size：1020Kb
ID: 193539 Sample Name: VdhCoAppSetup-1.3.0.exe Cookbook: default.jbs Time: 01:37:16 Date: 04/12/2019 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report VdhCoAppSetup-1.3.0.exe 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 Cryptography: 6 Spreading: 6 Networking: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 7 System Summary: 7 Data Obfuscation: 7 Persistence and Installation Behavior: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 8 Anti Debugging: 8 HIPS / PFW / Operating System Protection Evasion: 8 Language, Device and Operating System Detection: 8 Behavior Graph 8 Simulations 9 Behavior and APIs 9 Antivirus, Machine Learning and Genetic Malware Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 10 URLs 10 Yara Overview 10 Initial Sample 10 PCAP (Network Traffic) 10 Dropped Files 10 Memory Dumps 10 Unpacked PEs 10 Sigma Overview 10 Joe Sandbox View / Context 11 IPs 11 Domains 11 ASN 11 JA3 Fingerprints 11 Dropped Files 11 Screenshots 11 Thumbnails 11 Startup 12 Created / dropped Files 12 Domains and IPs 15 Contacted Domains 15 URLs from Memory and Binaries 15 Contacted IPs 17 Static File Info 17 General 17 File Icon 17 Static PE Info 18 General 18 Authenticode Signature 18 Entrypoint Preview 18 Copyright Joe Security LLC 2019 Page 2 of 53 Data Directories 19 Sections 19 Resources 20 Imports 20 Version Infos 20 Possible Origin 21 Network Behavior 21 Code Manipulations 21 Statistics 21 Behavior 21 System Behavior 21 Analysis Process: VdhCoAppSetup-1.3.0.exe PID: 4104 Parent PID: 352 21 General 21 File Activities 22 File Created 22 File Deleted 22 File Written 22 File Read 22 Analysis Process: VdhCoAppSetup-1.3.0.tmp PID: 740 Parent PID: 4104 23 General 23 File Activities 23 File Created 23 File Deleted 26 File Moved 26 File Written 27 File Read 51 Registry Activities 51 Key Created 51 Key Value Created 51 Key Value Modified 52 Disassembly 53 Code Analysis 53 Copyright Joe Security LLC 2019 Page 3 of 53 Analysis Report VdhCoAppSetup-1.3.0.exe Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 193539 Start date: 04.12.2019 Start time: 01:37:16 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 56s Hypervisor based Inspection enabled: false Report type: light Sample file name: VdhCoAppSetup-1.3.0.exe Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean5.winEXE@3/6@0/0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 37.7% (good quality ratio 35.4%) Quality average: 77.4% Quality standard deviation: 27.8% HCA Information: Failed Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe Report size exceeded maximum capacity and may have missing disassembly code. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 5 0 - 100 false Confidence Copyright Joe Security LLC 2019 Page 4 of 53 Strategy Score Range Further Analysis Required? Confidence Threshold 1 0 - 5 true Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 2019 Page 5 of 53 Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Mitre Att&ck Matrix Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Impact Valid Command- Modify Exploitation for Masquerading 3 Input System Time Application Screen Data Standard System Accounts Line Existing Privilege Capture 2 1 Discovery 1 Deployment Capture 1 Encrypted 1 1 Cryptographic Shutdown/Reboot Interface 2 Service 1 Escalation 1 Software Protocol 1 Replication Execution Port Access Token Access Token Network Process Remote Input Exfiltration Over Fallback Data Encrypted for Through through Monitors Manipulation 1 Manipulation 1 Sniffing Discovery 1 Services Capture 2 1 Other Network Channels Impact Removable API 1 Medium Media External Graphical Accessibility Process Process Injection 2 Input Capture Application Windows Data from Automated Custom Disk Structure Wipe Remote User Features Injection 2 Window Remote Network Exfiltration Cryptographic Services Interface 2 Discovery 1 1 Management Shared Drive Protocol Drive-by Scheduled System DLL Search Deobfuscate/Decode Credentials in Account Logon Input Capture Data Encrypted Multiband Disk Content Wipe Compromise Task Firmware Order Hijacking Files or Files Discovery 1 Scripts Communication Information 1 Exploit Public- Command- Shortcut File System Obfuscated Files or Account System Shared Data Staged Scheduled Standard Service Stop Facing Line Modification Permissions Information 2 Manipulation Owner/User Webroot Transfer Cryptographic Application Interface Weakness Discovery 3 Protocol Spearphishing Graphical Modify New Service DLL Search Order Brute Force Security Third-party Screen Data Transfer Commonly Inhibit System Link User Existing Hijacking Software Software Capture Size Limits Used Port Recovery Interface Service Discovery 1 1 Spearphishing Scripting Path Scheduled Software Packing Two-Factor File and Pass the Email Exfiltration Over Uncommonly Defacement Attachment Interception Task Authentication Directory Hash Collection Command and Used Port Interception Discovery 1 Control Channel Spearphishing Third-party Logon Process Indicator Blocking Bash History System Remote Clipboard Exfiltration Over Standard Stored Data via Service Software Scripts Injection Information Desktop Data Alternative Application Manipulation Discovery 2 5 Protocol Protocol Layer Protocol Signature Overview • Cryptography • Spreading • Networking • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Data Obfuscation • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section Cryptography: Public key (encryption) found Spreading: Contains functionality to enumerate / list files inside a directory Networking: Copyright Joe Security LLC 2019 Page 6 of 53 Urls found in memory or binary data Key, Mouse, Clipboard, Microphone and Screen Capturing: Contains functionality to record screenshots Contains functionality to retrieve information about pressed keystrokes Installs a raw input device (often for capturing keystrokes) System Summary: Contains functionality to communicate with device drivers Contains functionality to shutdown / reboot the system Detected potential crypto function Found potential string decryption / allocating functions PE file contains executable resources (Code or Archives) PE file contains strange resources Sample file is different than original file name gathered from version info Classification label Contains functionality for error logging Contains functionality to adjust token privileges (e.g. debug / backup) Contains functionality to check free disk space Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the program directory Creates files inside the user directory Creates temporary files Parts of this applications are using Borland Delphi (Probably coded in Delphi) Reads software policies Reads the Windows registered organization settings Sample might require command line arguments Sample reads its own file content Spawns processes Uses an in-process (OLE) Automation server Reads the Windows registered owner settings Executable creates window controls seldom found in malware Found GUI installer (many successful clicks) Uses Rich Edit Controls Found graphical window changes (likely an installer) Creates a directory in C:\Program Files Creates a software uninstall entry PE / OLE file has a valid certificate Submission file is bigger than most known malware samples Data Obfuscation: Contains functionality to dynamically determine API calls PE file contains an invalid checksum Uses code obfuscation techniques (call, push, ret) Persistence and Installation Behavior: Drops