Automated Malware Analysis Report For
Total Page:16
File Type:pdf, Size:1020Kb
ID: 256920 Cookbook: browseurl.jbs Time: 15:47:13 Date: 04/08/2020 Version: 29.0.0 Ocean Jasper Table of Contents Table of Contents 2 Analysis Report http://micromedia.us/videos/Pichincha/Items/RemoteTeller.mp4 4 Overview 4 General Information 4 Detection 4 Signatures 4 Classification 4 Startup 4 Malware Configuration 4 Yara Overview 4 Sigma Overview 4 Signature Overview 4 Networking: 5 Mitre Att&ck Matrix 5 Behavior Graph 5 Screenshots 6 Thumbnails 6 Antivirus, Machine Learning and Genetic Malware Detection 7 Initial Sample 7 Dropped Files 7 Unpacked PE Files 7 Domains 7 URLs 7 Domains and IPs 8 Contacted Domains 8 Contacted URLs 8 URLs from Memory and Binaries 8 Contacted IPs 10 Public 10 General Information 10 Simulations 12 Behavior and APIs 12 Created / dropped Files 12 Static File Info 18 No static file info 18 Network Behavior 18 TCP Packets 18 DNS Queries 20 DNS Answers 20 HTTP Request Dependency Graph 20 Code Manipulations 20 Statistics 20 Behavior 21 System Behavior 21 Analysis Process: iexplore.exe PID: 6692 Parent PID: 800 21 General 21 File Activities 21 Registry Activities 21 Analysis Process: iexplore.exe PID: 6736 Parent PID: 6692 21 General 22 File Activities 22 Registry Activities 22 Analysis Process: ssvagent.exe PID: 6800 Parent PID: 6736 22 General 22 Copyright null 2020 Page 2 of 23 Registry Activities 22 Analysis Process: Video.UI.exe PID: 5616 Parent PID: 800 22 General 22 File Activities 23 File Read 23 Registry Activities 23 Disassembly 23 Code Analysis 23 Copyright null 2020 Page 3 of 23 Analysis Report http://micromedia.us/videos/Pichincha/…Items/RemoteTeller.mp4 Overview General Information Detection Signatures Classification Sample URL: micromedia.us/video s/Pichincha/Items/Remote SSnnoorrrttt IIIDDSS aallleerrrttt fffoorrr nneetttwwoorrrkk tttrrraaffffffiiicc (((ee...… Teller.mp4 ASAbnbnonorotrr rmIDaaSlll hahiiligeghrht CCfoPPr UUn e UUtwssaoagrgkee traffic (e. Analysis ID: 256920 CACobonntottaariiminnsas lff fuhuningcchtttii iooCnnPaaUllliiittt yyU ttstooa cgcaeallllll nnaatttiiivvee fff… Ransomware Most interesting Screenshot: Miner Spreading DCDrroroonpptsas i cnceser rrftttuiiifffiniicccaatttiteoe n fffiaiillleleistsy ( ((tDDoE EcRRa)l))l native f mmaallliiiccciiioouusss malicious Evader Phishing QDuruoeeprrisiee scs e ddritisisfkikc iainntfefoo rfrmileaastt ii(ooDnnE ((Roof)ftteenn uusseedd sssuusssppiiiccciiioouusss Quueerrriiieess ddiiisskk iiinnfffoorrrmaatttiiioonn (((oofffttteenn uusseedd… suspicious cccllleeaann Quueerrriiieess ttdthhiesek vv ioonlllfuuomrmee a iiintnifoffoonrrr m(oaaftttieiioonnn u (((nsneaadm… clean Exploiter Banker UQUsuseessr i eccoso ddtheee oo vbbofffuulussmccaaettt iiioionnnfo tttreemcchahntniioiiqqnuu e(enssa (((m… Uses code obfuscation techniques ( Spyware Trojan / Bot Adware Score: 48 Range: 0 - 100 Whitelisted: false Confidence: 100% Startup System is w10x64 iexplore.exe (PID: 6692 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.exe (PID: 6736 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6692 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A) ssvagent.exe (PID: 6800 cmdline: 'C:\PROGRA~2\Java\JRE18~1.0_2\bin\ssvagent.exe' -new MD5: A3DBA514D38464A5C5A9DEA19E6159F9) Video.UI.exe (PID: 5616 cmdline: 'C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17112.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe' -ServerName:Microsoft.ZuneVide o.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca MD5: BEA19F0655789B224CEF4C5AFCE49AD1) cleanup Malware Configuration No configs have been found Yara Overview No yara matches Sigma Overview No Sigma rule has matched Signature Overview Copyright null 2020 Page 4 of 23 • Networking • E-Banking Fraud • System Summary • Data Obfuscation • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section Networking: Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) Mitre Att&ck Matrix Initial Privilege Credential Lateral Command Network Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Effects Valid Windows Path Process Masquerading 1 OS Security Software Remote Data from Exfiltration Encrypted Eavesdrop on Accounts Management Interception Injection 2 Credential Discovery 1 1 Services Local Over Other Channel 2 Insecure Instrumentation Dumping System Network Network Medium Communication Default Scheduled Boot or Boot or Virtualization/Sandbox LSASS Virtualization/Sandbox Remote Data from Exfiltration Non- Exploit SS7 to Accounts Task/Job Logon Logon Evasion 1 Memory Evasion 1 Desktop Removable Over Application Redirect Phone Initialization Initialization Protocol Media Bluetooth Layer Calls/SMS Scripts Scripts Protocol 2 Domain At (Linux) Logon Script Logon Process Injection 2 Security Process Discovery 1 SMB/Windows Data from Automated Application Exploit SS7 to Accounts (Windows) Script Account Admin Shares Network Exfiltration Layer Track Device (Windows) Manager Shared Protocol 3 Location Drive Local At (Windows) Logon Script Logon Obfuscated Files or NTDS File and Directory Distributed Input Scheduled Ingress Tool SIM Card Accounts (Mac) Script Information 1 Discovery 1 Component Capture Transfer Transfer 1 Swap (Mac) Object Model Cloud Cron Network Network Software Packing LSA System Information SSH Keylogging Data Fallback Manipulate Accounts Logon Script Logon Secrets Discovery 2 1 Transfer Channels Device Script Size Limits Communication Replication Launchd Rc.common Rc.common Steganography Cached Remote System VNC GUI Input Exfiltration Multiband Jamming or Through Domain Discovery 1 Capture Over C2 Communication Denial of Removable Credentials Channel Service Media Behavior Graph Copyright null 2020 Page 5 of 23 Hide Legend Behavior Graph Legend: ID: 256920 URL: http://micromedia.us/videos... Process Startdate: 04/08/2020 Signature Architecture: WINDOWS Score: 48 Created File DNS/IP Info Snort IDS alert for Is Dropped network traffic (e.g. started started based on Emerging Threat rules) Is Windows Process Number of created Registry Values Number of created Files iexplore.exe Video.UI.exe Visual Basic 19 69 56 49 Delphi Java .Net C# or VB.NET activation2.eastus2.cloudapp.azure.com started 40.79.86.63 settings-ssl.xboxlive.com C, C++ or other language MICROSOFT-CORP-MSN-AS-BLOCKUS United States Is malicious Internet iexplore.exe 28 micromedia.us 69.222.152.74, 49726, 49727, 80 started ATT-INTERNET4US United States ssvagent.exe 501 Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version No bigger version Copyright null 2020 Page 6 of 23 Antivirus, Machine Learning and Genetic Malware Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Source Detection Scanner Label Link www.founder.com.cn/cn/bThe 0% URL Reputation safe www.founder.com.cn/cn/bThe 0% URL Reputation safe www.tiro.com 0% URL Reputation safe www.tiro.com 0% URL Reputation safe www.goodfont.co.kr 0% URL Reputation safe Copyright null 2020 Page 7 of 23 Source Detection Scanner Label Link www.goodfont.co.kr 0% URL Reputation safe www.carterandcone.coml 0% URL Reputation safe www.carterandcone.coml 0% URL Reputation safe www.sajatypeworks.com 0% URL Reputation safe www.sajatypeworks.com 0% URL Reputation safe www.typography.netD 0% URL Reputation safe www.typography.netD 0% URL Reputation safe www.founder.com.cn/cn/cThe 0% URL Reputation safe www.founder.com.cn/cn/cThe 0% URL Reputation safe www.galapagosdesign.com/staff/dennis.htm 0% URL Reputation safe www.galapagosdesign.com/staff/dennis.htm 0% URL Reputation safe fontfabrik.com 0% URL Reputation safe fontfabrik.com 0% URL Reputation safe www.founder.com.cn/cn 0% URL Reputation safe www.founder.com.cn/cn 0% URL Reputation safe www.jiyu-kobo.co.jp/ 0% URL Reputation safe www.jiyu-kobo.co.jp/ 0% URL Reputation safe www.galapagosdesign.com/DPlease 0% URL Reputation safe www.galapagosdesign.com/DPlease 0% URL Reputation safe www.sandoll.co.kr 0% URL Reputation safe www.sandoll.co.kr 0% URL Reputation safe www.urwpp.deDPlease 0% URL Reputation safe www.urwpp.deDPlease 0% URL Reputation safe www.zhongyicts.com.cn 0% URL Reputation safe www.zhongyicts.com.cn 0% URL Reputation safe www.sakkal.com 0% URL Reputation safe www.sakkal.com 0% URL Reputation safe Domains and IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation asf-ris-prod- 168.63.67.155 true false high neurope.northeurope.cloudapp.azure.com micromedia.us 69.222.152.74 true false unknown activation2.eastus2.cloudapp.azure.com 40.79.86.63 true false high settings-ssl.xboxlive.com unknown unknown false high Contacted URLs Name Malicious Antivirus Detection Reputation micromedia.us/videos/Pichincha/Items/RemoteTeller.mp4 false unknown URLs from Memory and Binaries Name Source Malicious Antivirus Detection Reputation https://xbox.com Video.UI.exe, 0000000B.0000000 false high 2.645823287.000001BDC3780000.0 0000002.00000001.sdmp www.apache.org/licenses/LICENSE-2.0 Video.UI.exe, 0000000B.0000000 false high 2.635302107.000001BDBD4B6000.0