Automated Malware Analysis Report for Http:/\Tr.Subscribermail.Com/Cc
Total Page:16
File Type:pdf, Size:1020Kb
ID: 276764 Cookbook: browseurl.jbs Time: 13:55:32 Date: 25/08/2020 Version: 29.0.0 Ocean Jasper Table of Contents Table of Contents 2 Analysis Report http:/\tr.subscribermail.com/cc.cfm?sendto=http:/\recp.mkt91.net/ctt? m=804040&r=Njg0NjYxMDU1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https:/\t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiNDgxODMzMSIsImRlbGl2ZXJ5X2lkIjoibTllYTV3NTFkdWFsbWJpaTdhcmgiLCJ1cmwiOiJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vc2hha2RqaHBvczEuYXBwc3BvdC5jb20vaW5kZXguaHRtbCJ9#c3VuaWwubWVub25AYWVyaWVzdGVjaG5vbG9neS5jb20= Overview 33 General Information 3 Detection 3 Signatures 3 Classification 3 Startup 3 Malware Configuration 3 Yara Overview 4 Sigma Overview 4 Signature Overview 4 Mitre Att&ck Matrix 4 Behavior Graph 4 Screenshots 5 Thumbnails 5 Antivirus, Machine Learning and Genetic Malware Detection 6 Initial Sample 6 Dropped Files 6 Unpacked PE Files 6 Domains 6 URLs 6 Domains and IPs 7 Contacted Domains 7 Contacted IPs 7 General Information 7 Simulations 8 Behavior and APIs 8 Joe Sandbox View / Context 8 IPs 8 Domains 8 ASN 9 JA3 Fingerprints 9 Dropped Files 9 Created / dropped Files 9 Static File Info 10 No static file info 10 Network Behavior 10 UDP Packets 10 DNS Queries 11 DNS Answers 11 Code Manipulations 11 Statistics 12 Behavior 12 System Behavior 12 Analysis Process: iexplore.exe PID: 7136 Parent PID: 800 12 General 12 File Activities 12 Registry Activities 12 Analysis Process: iexplore.exe PID: 5816 Parent PID: 7136 13 General 13 File Activities 13 Registry Activities 13 Analysis Process: ssvagent.exe PID: 1276 Parent PID: 5816 13 General 13 Registry Activities 13 Disassembly 13 Copyright null 2020 Page 2 of 13 Analysis Report http:/\tr.subscribermail.com/cc.cfm?se…ndto=http:/\recp.mkt91.net/ctt?m=804040&r=Njg0NjYxMDU1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https:/\t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiNDgxODMzMSIsImRlbGl2ZXJ5X2lkIjoibTllYTV3NTFkdWFsbWJpaTdhcmgiLCJ1cmwiOiJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vc2hha2RqaHBvczEuYXBwc3BvdC5jb20vaW5kZXguaHRtbCJ9#c3VuaWwubWVub25AYWVyaWVzdGVjaG5vbG9neS5jb20= Overview General Information Detection Signatures Classification Sample URL: http:/\tr.subscribermail.com No high impact signatures. /cc.cfm?sendto=http:/\recp. mkt91.net/ctt? m=804040&r=Njg0NjYxMD U1NQS2&b=0&j=NjAwMD czOTg3S0&k=NCLogo&kx =1&kt=12&kd=https:/\t.drip email2.com/c/eyJhY2Nvd W50X2lkIjoiNDgxODMzM SIsImRlbGl2ZXJ5X2lkIjoib TllYTV3NTFkdWFsbWJpa TdhcmgiLCJ1cmwiOiJodH RwczovL3N0b3JhZ2UuZ2 9vZ2xlYXBpcy5jb20vc2hh a2RqaHBvczEuYXBwc3Bv dC5jb20vaW5kZXguaHRtb CJ9#c3VuaWwubWVub25 AYWVyaWVzdGVjaG5vb Score: 0 G9neS5jb20= Range: 0 - 100 Analysis ID: 276764 Whitelisted: false Most interesting Screenshot: Confidence: 100% Startup System is w10x64 iexplore.exe (PID: 7136 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.exe (PID: 5816 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7136 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A) ssvagent.exe (PID: 1276 cmdline: 'C:\PROGRA~2\Java\JRE18~1.0_2\bin\ssvagent.exe' -new MD5: A3DBA514D38464A5C5A9DEA19E6159F9) cleanup Malware Configuration No configs have been found Copyright null 2020 Page 3 of 13 Yara Overview No yara matches Sigma Overview No Sigma rule has matched Signature Overview • Networking • System Summary • Hooking and other Techniques for Hiding and Protection Click to jump to signature section There are no malicious signatures, click here to show all signatures . Mitre Att&ck Matrix Command Remote Initial Privilege Defense Credential Lateral and Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Effects Effects Impact Valid Windows Path Process Masquerading 1 OS File and Remote Data from Exfiltration Non- Eavesdrop on Remotely Modify Accounts Management Interception Injection 1 Credential Directory Services Local Over Other Application Insecure Track Device System Instrumentation Dumping Discovery 1 System Network Layer Network Without Partition Medium Protocol 1 Communication Authorization Default Scheduled Boot or Boot or Process LSASS Application Remote Data from Exfiltration Application Exploit SS7 to Remotely Device Accounts Task/Job Logon Logon Injection 1 Memory Window Desktop Removable Over Layer Redirect Phone Wipe Data Lockout Initialization Initialization Discovery Protocol Media Bluetooth Protocol 1 Calls/SMS Without Scripts Scripts Authorization Behavior Graph Copyright null 2020 Page 4 of 13 Hide Legend Behavior Graph Legend: ID: 276764 Process URL: http:/\tr.subscribermail.co... Signature Startdate: 25/08/2020 Created File Architecture: WINDOWS DNS/IP Info Score: 0 Is Dropped Is Windows Process Number of created Registry Values cdn.onenote.net started Number of created Files Visual Basic Delphi iexplore.exe Java .Net C# or VB.NET C, C++ or other language 14 61 Is malicious started Internet iexplore.exe 14 started ssvagent.exe 501 Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright null 2020 Page 5 of 13 Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link http:/\tr.subscribermail.com/cc.cfm?sendto=http:/\recp.mkt91.net/ctt?m=804040&r=Njg0NjYxMD 0% Avira URL Cloud safe U1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https:/\t.dripemail2.com/c/ey JhY2NvdW50X2lkIjoiNDgxODMzMSIsImRlbGl2ZXJ5X2lkIjoibTllYTV3NTFkdWFsbWJpaTdhcmgiLC J1cmwiOiJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vc2hha2RqaHBvczEuYXBwc3BvdC5jb2 0vaW5kZXguaHRtbCJ9#c3VuaWwubWVub25AYWVyaWVzdGVjaG5vbG9neS5jb20= Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link cdn.onenote.net 1% Virustotal Browse URLs No Antivirus matches Copyright null 2020 Page 6 of 13 Domains and IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation cdn.onenote.net unknown unknown false 1%, Virustotal, Browse unknown Contacted IPs No contacted IP infos General Information Joe Sandbox Version: 29.0.0 Ocean Jasper Analysis ID: 276764 Start date: 25.08.2020 Start time: 13:55:32 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 13m 48s Hypervisor based Inspection enabled: false Report type: light Cookbook file name: browseurl.jbs Sample URL: http:/\tr.subscribermail.com/cc.cfm?sendto=http:/\recp. mkt91.net/ctt?m=804040&r=Njg0NjYxMDU1NQS2&b=0 &j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=ht tps:/\t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiNDgxO DMzMSIsImRlbGl2ZXJ5X2lkIjoibTllYTV3NTFkdWFsbW JpaTdhcmgiLCJ1cmwiOiJodHRwczovL3N0b3JhZ2UuZ 29vZ2xlYXBpcy5jb20vc2hha2RqaHBvczEuYXBwc3Bvd C5jb20vaW5kZXguaHRtbCJ9#c3VuaWwubWVub25AY WVyaWVzdGVjaG5vbG9neS5jb20= Analysis system description: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211 Number of analysed new started processes analysed: 38 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis Mode: default Analysis stop reason: Timeout Detection: CLEAN Classification: clean0.win@5/4@1/0 Cookbook Comments: Adjust boot time Enable AMSI Copyright null 2020 Page 7 of 13 Warnings: Show All Max analysis timeout: 720s exceeded, the analysis took too long Exclude process from analysis (whitelisted): MpCmdRun.exe, WinStore.App.exe, RuntimeBroker.exe, Microsoft.Photos.exe, backgroundTaskHost.exe, ApplicationFrameHost.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, HxTsr.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.104, 95.100.50.217, 51.104.146.109, 51.143.111.7, 52.184.221.185, 23.210.254.117, 152.199.19.161, 23.0.174.185, 23.0.174.184, 40.67.254.36, 52.164.221.179, 95.100.62.38, 52.155.217.156, 51.104.139.180, 23.54.113.45 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.glo balredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s- microsoft.com-c.edgekey.net, fs- wildcard.microsoft.com.edgekey.net, fs- wildcard.microsoft.com.edgekey.net.globalredir.aka dns.net, wns.notify.windows.com.akadns.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, cdn.onenote.net.edgekey.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadn s.net, e12564.dspb.akamaiedge.net, go.microsoft.com, db5p.wns.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg- shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, displaycatalog- europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, ie9comview.vo.msecnd.net, ris- prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, emea2.notify.windows.com.akadns.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net, store- images.s-microsoft.com, go.microsoft.com.edgekey.net, e1553.dspg.akamaiedge.net, e16646.dscg.akamaiedge.net, cs9.wpc.v0cdn.net Report size getting too big, too many NtCreateKey calls found. Report size getting too big, too many NtSetValueKey calls found. Simulations