Automated Malware Analysis Report For
Total Page：16
File Type：pdf, Size：1020Kb
ID: 212459 Cookbook: urldownload.jbs Time: 12:22:45 Date: 03/03/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report https://eu.wildfire.paloaltonetworks.com/panos/sample/cloud/Wi9NUHhlYkdOOWR2YTEyQkh4UlhlUzRCQjhUUDVQWXNHYnBGRElSR2pRSjJLK3ZpQ3BHOE1yQnBUbnJSNVMxQlM0WmEveVhtTGpDR29FV0E1dU9DV0w1VTZzWTZZL01sRm1FUGtwUWJjMWwrTUsyZjFDMHpWbUtHM0h5eCtKekMvSExWVWpRZnNHbkQ1WndDREpWV0FVRjVaZnNicFdzSzh0dFlsZW5SamxNb0kybUVDYkRsTnF3dC9HWXl5L3l6 Overview 33 General Information 3 Detection 4 Confidence 4 Classification 4 Analysis Advice 5 Mitre Att&ck Matrix 5 Signature Overview 6 AV Detection: 6 Networking: 6 System Summary: 6 Data Obfuscation: 7 Persistence and Installation Behavior: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Anti Debugging: 7 HIPS / PFW / Operating System Protection Evasion: 7 Language, Device and Operating System Detection: 7 Stealing of Sensitive Information: 8 Remote Access Functionality: 8 Malware Configuration 8 Threatname: Agenttesla 8 Behavior Graph 8 Simulations 9 Behavior and APIs 9 Antivirus, Machine Learning and Genetic Malware Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 9 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 10 Sigma Overview 10 System Summary: 10 Joe Sandbox View / Context 10 IPs 10 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 10 Screenshots 10 Thumbnails 10 Startup 11 Created / dropped Files 11 Domains and IPs 12 Contacted Domains 12 URLs from Memory and Binaries 12 Contacted IPs 13 Public 13 Static File Info 14 No static file info 14 Network Behavior 14 Network Port Distribution 14 TCP Packets 14 UDP Packets 16 DNS Queries 16 DNS Answers 16 HTTPS Packets 16 SMTP Packets 17 Code Manipulations 17 Statistics 17 Behavior 18 System Behavior 18 Analysis Process: cmd.exe PID: 2756 Parent PID: 5096 18 General 18 File Activities 18 File Created 18 Analysis Process: conhost.exe PID: 656 Parent PID: 2756 18 General 18 Analysis Process: wget.exe PID: 4788 Parent PID: 2756 19 General 19 File Activities 19 File Created 19 File Written 19 Analysis Process: 01e5c1a0eb769df3ea7b19c985e41df5c1f153be8af228a12254379c17ff46dc.exe.000.exe PID: 4300 Parent PID: 1684 20 General 20 Analysis Process: RegAsm.exe PID: 3980 Parent PID: 4300 20 General 20 File Activities 21 File Created 21 File Read 21 Disassembly 22 Code Analysis 22 Copyright Joe Security LLC 2020 Page 2 of 22 Analysis Report https://eu.wildfire.paloaltonetworks.com/panos/s ample/cloud/Wi9NUHhlYkdOOWR2YTEyQkh4UlhlUzRCQjhU UDVQWXNHYnBGRElSR2pRSjJLK3ZpQ3BHOE1yQnBUbnJSNVMx QlM0WmEveVhtTGpDR29FV0E1dU9DV0w1VTZzWTZZL01sRm1F UGtwUWJjMWwrTUsyZjFDMHpWbUtHM0h5eCtKekMvSExWVWpR ZnNHbkQ1WndDREpWV0FVRjVaZnNicFdzSzh0dFlsZW5SamxN b0kybUVDYkRsTnF3dC9HWXl5L3l6 Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 212459 Start date: 03.03.2020 Start time: 12:22:45 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 6m 43s Hypervisor based Inspection enabled: false Report type: light Cookbook file name: urldownload.jbs Sample URL: https://eu.wildfire.paloaltonetworks.com/panos/sample/c loud/Wi9NUHhlYkdOOWR2YTEyQkh4UlhlUzRCQjhUU DVQWXNHYnBGRElSR2pRSjJLK3ZpQ3BHOE1yQnB UbnJSNVMxQlM0WmEveVhtTGpDR29FV0E1dU9DV0 w1VTZzWTZZL01sRm1FUGtwUWJjMWwrTUsyZjFDM HpWbUtHM0h5eCtKekMvSExWVWpRZnNHbkQ1Wnd DREpWV0FVRjVaZnNicFdzSzh0dFlsZW5SamxNb0kyb UVDYkRsTnF3dC9HWXl5L3l6 Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 9 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: MAL Classification: mal100.troj.spyw.evad.win@7/2@2/2 EGA Information: Failed HDC Information: Failed HCA Information: Failed Cookbook Comments: Adjust boot time Enable AMSI Copyright Joe Security LLC 2020 Page 3 of 22 Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe, WmiPrvSE.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 52.109.88.40, 52.109.12.24, 8.253.204.249, 8.241.78.126, 8.241.90.126, 8.253.95.120, 8.241.9.126, 13.107.4.50 Excluded domains from analysis (whitelisted): prod- w.nexus.live.com.akadns.net, au.au-msedge.net, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, ctldl.windowsupdate.com, c-0001.c-msedge.net, Edge-Prod-FRA.env.au.au-msedge.net, au.c- 0001.c-msedge.net, auto.au.download.windowsupdate.com.c.footprint.n et, elasticShed.au.au-msedge.net, afdap.au.au- msedge.net Execution Graph export aborted for target RegAsm.exe, PID 3980 because it is empty Execution Graph export aborted for target wget.exe, PID 4788 because there are no executed function Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Whitelisted Threat Detection AgentTesla Threshold 100 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 5 0 - 5 false Classification Copyright Joe Security LLC 2020 Page 4 of 22 Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Initial sample is implementing a service and should be registered / started as service Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Mitre Att&ck Matrix Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Valid Windows Management Winlogon Process Masquerading 1 1 Credential Virtualization/Sandbox Application Email Data Standard Accounts Instrumentation 1 1 1 Helper DLL Injection 1 1 2 Dumping 2 Evasion 3 Deployment Collection 1 Encrypted 1 Cryptographic Software Protocol 1 Copyright Joe Security LLC 2020 Page 5 of 22 Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Replication Command-Line Port Accessibility Software Packing 1 Credentials in Process Discovery 2 Remote Data from Exfiltration Standard Non- Through Interface 1 Monitors Features Registry 1 Services Local Over Other Application Removable System 2 Network Layer Media Medium Protocol 1 External Windows Management Accessibility Path Interception Disabling Security Input Capture Security Software Windows Data from Automated Standard Remote Instrumentation Features Tools 1 Discovery 1 1 1 Remote Network Exfiltration Application Services Management Shared Layer Drive Protocol 1 Drive-by Scheduled Task System DLL Search Virtualization/Sandbox Credentials in Remote System Logon Input Data Multiband Compromise Firmware Order Hijacking Evasion 3 Files Discovery 1 Scripts Capture Encrypted Communication Exploit Public- Command-Line Interface Shortcut File System Process Account System Information Shared Data Staged Scheduled Standard Facing Modification Permissions Injection 1 1 2 Manipulation Discovery 1 1 4 Webroot Transfer Cryptographic Application Weakness Protocol Spearphishing Graphical User Interface Modify New Service Obfuscated Files or Brute Force System Owner/User Third-party Screen Data Commonly Link Existing Information 1 Discovery Software Capture Transfer Used Port Service Size Limits Spearphishing Scripting Path Scheduled Task DLL Side-Loading 1 Two-Factor Network Sniffing Pass the Email Exfiltration Uncommonly Attachment Interception Authentication Hash Collection Over Used Port Interception Command and Control Channel Signature Overview • AV Detection • Networking • System Summary • Data Obfuscation • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection • Stealing of Sensitive Information • Remote Access Functionality Click to jump to signature section AV Detection: Found malware configuration Multi AV Scanner detection for dropped file Antivirus or Machine Learning detection for unpacked file Networking: Uses SMTP (mail sending) Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Binary is likely a compiled AutoIt script file Detected potential crypto function PE file contains strange resources Copyright Joe Security LLC 2020 Page 6 of 22 Tries to load missing DLLs Classification label Creates files inside the user directory Creates mutexes Parts of this applications are using the .NET runtime (Probably coded in C#) Queries process information (via WMI, Win32_Process) Reads software policies Reads the hosts file Spawns processes Uses an in-process (OLE)