Automated Malware Analysis Report for Charles

ID: 231093 Sample Name: charles-proxy- 4.5.6-win64.msi Cookbook: default.jbs Time: 16:53:59 Date: 18/05/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report charles-proxy-4.5.6-win64.msi 4 Overview 4 General Information 4 Detection 4 Confidence 5 Classification Spiderchart 5 Analysis Advice 6 Mitre Att&ck Matrix 6 Signature Overview 6 Spreading: 6 Networking: 6 System Summary: 6 Persistence and Installation Behavior: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Language, Device and Operating System Detection: 7 Lowering of HIPS / PFW / Operating System Security Settings: 7 Malware Configuration 7 Behavior Graph 7 Simulations 8 Behavior and APIs 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 8 Domains 8 URLs 9 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Sigma Overview 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 9 Dropped Files 10 Screenshots 10 Thumbnails 10 Startup 10 Created / dropped Files 11 Domains and IPs 11 Contacted Domains 11 URLs from Memory and Binaries 11 Contacted IPs 11 Static File Info 12 General 12 File Icon 12 Network Behavior 12 Code Manipulations 12 Statistics 12 Behavior 12 Copyright Joe Security LLC 2020 Page 2 of 14 System Behavior 13 Analysis Process: msiexec.exe PID: 5052 Parent PID: 4316 13 General 13 File Activities 13 Registry Activities 13 Analysis Process: msiexec.exe PID: 4412 Parent PID: 3988 13 General 13 Disassembly 14 Code Analysis 14 Copyright Joe Security LLC 2020 Page 3 of 14 Analysis Report charles-proxy-4.5.6-win64.msi Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 231093 Start date: 18.05.2020 Start time: 16:53:59 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 4m 43s Hypervisor based Inspection enabled: false Report type: light Sample file name: charles-proxy-4.5.6-win64.msi Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis Mode: default Analysis stop reason: Timeout Detection: CLEAN Classification: clean2.winMSI@2/1@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .msi Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 2 0 - 100 false Copyright Joe Security LLC 2020 Page 4 of 14 Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 3 0 - 5 true Classification Spiderchart Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 2020 Page 5 of 14 Analysis Advice Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Mitre Att&ck Matrix Remote Initial Privilege Defense Credential Lateral Command Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration and Control Effects Effects Replication Graphical User Winlogon Process Disabling Credential Peripheral Replication Data from Data Data Eavesdrop on Remotely Through Interface 2 Helper DLL Injection 1 Security Dumping Device Through Local Compressed Obfuscation Insecure Track Device Removable Tools 1 Discovery 1 1 Removable System Network Without Media 1 Media 1 Communication Authorization Replication Service Port Accessibility Modify Network File and Remote Data from Exfiltration Fallback Exploit SS7 to Remotely Through Execution Monitors Features Registry 1 Sniffing Directory Services Removable Over Other Channels Redirect Phone Wipe Data Removable Discovery 1 Media Network Calls/SMS Without Media Medium Authorization External Windows Accessibility Path Process Input System Windows Data from Automated Custom Exploit SS7 to Obtain Remote Management Features Interception Injection 1 Capture Information Remote Network Exfiltration Cryptographic Track Device Device Services Instrumentation Discovery 1 3 Management Shared Protocol Location Cloud Drive Backups Drive-by Scheduled System DLL Search DLL Side- Credentials System Logon Input Data Multiband SIM Card Compromise Task Firmware Order Loading 1 in Files Network Scripts Capture Encrypted Communication Swap Hijacking Configuration Discovery Signature Overview • Spreading • Networking • System Summary • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Language, Device and Operating System Detection • Lowering of HIPS / PFW / Operating System Security Settings Click to jump to signature section Spreading: Checks for available system drives (often done to infect USB drives) Networking: Urls found in memory or binary data System Summary: Sample file is different than original file name gathered from version info Tries to load missing DLLs Classification label Creates temporary files Copyright Joe Security LLC 2020 Page 6 of 14 Reads ini files Reads software policies Sample is a Windows installer Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Submission file is bigger than most known malware samples Binary contains paths to debug symbols Persistence and Installation Behavior: Drops PE files Hooking and other Techniques for Hiding and Protection: Stores large binary data to the registry Disables application error messsages (SetErrorMode) Malware Analysis System Evasion: Checks the free space of harddrives Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Queries the cryptographic machine GUID Lowering of HIPS / PFW / Operating System Security Settings: Adds / modifies Windows certificates Malware Configuration No configs have been found Behavior Graph Copyright Joe Security LLC 2020 Page 7 of 14 Hide Legend Legend: Process Signature Created File DNS/IP Info Behavior Graph Is Dropped Is Windows Process ID: 231093 Number of created Registry Values Sample: charles-proxy-4.5.6-win64.msi Startdate: 18/05/2020 Number of created Files Architecture: WINDOWS Visual Basic Score: 2 Delphi Java started started .Net C# or VB.NET C, C++ or other language msiexec.exe msiexec.exe Is malicious Internet 4 dropped C:\Users\user\AppData\Local\Temp\MSIA9A.tmp, PE32 Simulations Behavior and APIs No simulations Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link charles-proxy-4.5.6-win64.msi 0% Virustotal Browse charles-proxy-4.5.6-win64.msi 0% Metadefender Browse Dropped Files Source Detection Scanner Label Link C:\Users\user\AppData\Local\Temp\MSIA9A.tmp 0% Virustotal Browse C:\Users\user\AppData\Local\Temp\MSIA9A.tmp 0% Metadefender Browse Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2020 Page 8 of 14 URLs Source Detection Scanner Label Link crl.sectigo.com/COMODOTimeStampingCA_2.crl0r 1% Virustotal Browse crl.sectigo.com/COMODOTimeStampingCA_2.crl0r 0% URL Reputation safe ocsp.sectigo.com0 0% URL Reputation safe https://sectigo.com/CPS0B 0% Virustotal Browse https://sectigo.com/CPS0B 0% URL Reputation safe crt.sectigo.com/COMODOTimeStampingCA_2.crt0# 0% Virustotal Browse crt.sectigo.com/COMODOTimeStampingCA_2.crt0# 0% URL Reputation safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Sigma Overview No Sigma rule has matched Joe Sandbox View / Context IPs No context Domains No context ASN No context JA3 Fingerprints No context Copyright Joe Security LLC 2020 Page 9 of 14 Dropped Files Match Associated Sample Name / URL SHA 256 Detection Link Context C:\Users\user\AppData\Local\Temp\MSI WordConnectSetup-User(1.7.0).msi Get hash malicious Browse A9A.tmp Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Startup Copyright Joe Security LLC 2020 Page 10 of 14 System is w10x64 msiexec.exe (PID: 5052 cmdline: 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\charles-proxy-4.5.6-win64.msi' MD5: 4767B71A318E201188A0D0A420C8B608) msiexec.exe (PID: 4412 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 8BE91C52776A6FD3B2990A275FF239DF C MD5: 12C17B5A5C2A7B97342C362CA467E9A2) cleanup Created

Load more