Automated Malware Analysis Report for KIX32.EXE
Total Page:16
File Type:pdf, Size:1020Kb
ID: 111362 Sample Name: KIX32.EXE Cookbook: default.jbs Time: 10:11:50 Date: 19/02/2019 Version: 25.0.0 Tiger's Eye Table of Contents Table of Contents 2 Analysis Report KIX32.EXE 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 Spreading: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 Spam, unwanted Advertisements and Ransom Demands: 6 System Summary: 6 Data Obfuscation: 7 Persistence and Installation Behavior: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Anti Debugging: 7 HIPS / PFW / Operating System Protection Evasion: 7 Language, Device and Operating System Detection: 7 Remote Access Functionality: 7 Behavior Graph 7 Simulations 8 Behavior and APIs 8 Antivirus Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 8 Domains 8 URLs 8 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 9 Dropped Files 9 Screenshots 9 Thumbnails 9 Startup 10 Created / dropped Files 10 Domains and IPs 11 Contacted Domains 11 Contacted IPs 11 Static File Info 11 General 11 File Icon 11 Static PE Info 11 General 11 Entrypoint Preview 12 Rich Headers 12 Data Directories 12 Sections 13 Copyright Joe Security LLC 2019 Page 2 of 16 Resources 13 Imports 13 Version Infos 14 Possible Origin 14 Network Behavior 14 Code Manipulations 14 Statistics 14 Behavior 14 System Behavior 15 Analysis Process: KIX32.EXE PID: 4620 Parent PID: 1896 15 General 15 File Activities 15 File Written 15 Analysis Process: conhost.exe PID: 1832 Parent PID: 4620 16 General 16 Disassembly 16 Code Analysis 16 Copyright Joe Security LLC 2019 Page 3 of 16 Analysis Report KIX32.EXE Overview General Information Joe Sandbox Version: 25.0.0 Tiger's Eye Analysis ID: 111362 Start date: 19.02.2019 Start time: 10:11:50 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 4m 49s Hypervisor based Inspection enabled: false Report type: light Sample file name: KIX32.EXE Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 7 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies HCA enabled EGA enabled HDC enabled Analysis stop reason: Timeout Detection: SUS Classification: sus27.rans.winEXE@2/1@0/0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 50% (good quality ratio 44.7%) Quality average: 66.3% Quality standard deviation: 31.5% HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Found application associated with file extension: .EXE Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, wermgr.exe, conhost.exe, CompatTelRunner.exe, svchost.exe Detection Strategy Score Range Reporting Whitelisted Detection Threshold 27 0 - 100 Report FP / FN false Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2019 Page 4 of 16 Strategy Score Range Further Analysis Required? Confidence Threshold 4 0 - 5 false Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Copyright Joe Security LLC 2019 Page 5 of 16 Mitre Att&ck Matrix Privilege Defense Credential Lateral Command and Initial Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Valid Accounts Graphical User Winlogon Process Process Input System Application Input Capture 1 Data Standard Interface 1 Helper DLL Injection 1 Injection 1 Capture 1 Information Deployment Compressed Cryptographic Discovery 2 3 Software Protocol 1 Replication Service Port Monitors Accessibility Indicator Network Application Remote Services Data from Exfiltration Over Fallback Through Execution Features Removal on Sniffing Window Removable Other Network Channels Removable Host 1 Discovery Media Medium Media Drive-by Windows Accessibility Path Obfuscated Files Input Query Registry Windows Data from Automated Custom Compromise Management Features Interception or Capture Remote Network Shared Exfiltration Cryptographic Instrumentation Information 2 Management Drive Protocol Signature Overview • Spreading • Key, Mouse, Clipboard, Microphone and Screen Capturing • Spam, unwanted Advertisements and Ransom Demands • System Summary • Data Obfuscation • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection • Remote Access Functionality Click to jump to signature section Spreading: Contains functionality to enumerate / list files inside a directory Key, Mouse, Clipboard, Microphone and Screen Capturing: Creates a DirectInput object (often for capturing keystrokes) Spam, unwanted Advertisements and Ransom Demands: Contains functionalty to change the wallpaper System Summary: Contains functionality to shutdown / reboot the system Creates mutexes Detected potential crypto function Found potential string decryption / allocating functions Tries to load missing DLLs Classification label Contains functionality for error logging Contains functionality to adjust token privileges (e.g. debug / backup) Contains functionality to check free disk space Copyright Joe Security LLC 2019 Page 6 of 16 Contains functionality to instantiate COM classes PE file has an executable .text section and no other executable section Reads software policies Spawns processes Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) Persistence and Installation Behavior: Contains functionality to read ini properties file for application configuration Hooking and other Techniques for Hiding and Protection: Contains functionality to clear windows event logs (to hide its activities) Malware Analysis System Evasion: Found evasive API chain checking for process token information Found large amount of non-executed APIs Contains functionality to enumerate / list files inside a directory Contains functionality to query system information Anti Debugging: Contains functionality to dynamically determine API calls HIPS / PFW / Operating System Protection Evasion: Contains functionality to simulate keystroke presses Contains functionality to create a new security descriptor May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Contains functionality locales information (e.g. system language) Contains functionality to query CPU information (cpuid) Contains functionality to query local / system time Contains functionality to query windows version Remote Access Functionality: Contains functionality to open a port and listen for incoming connection (possibly a backdoor) Behavior Graph Copyright Joe Security LLC 2019 Page 7 of 16 Hide Legend Legend: Process Behavior Graph Signature Created File ID: 111362 DNS/IP Info Sample: KIX32.EXE Is Dropped Startdate: 19/02/2019 Architecture: WINDOWS Is Windows Process Score: 27 Number of created Registry Values Number of created Files started Visual Basic Delphi KIX32.EXE Java .Net C# or VB.NET C, C++ or other language 1 Is malicious Contains functionalty started to change the wallpaper conhost.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Scanner Label Link KIX32.EXE 0% virustotal Browse KIX32.EXE 0% metadefender Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 2019 Page 8 of 16 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context JA3 Fingerprints No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2019 Page 9 of 16 Startup System is w10x64 KIX32.EXE (PID: 4620 cmdline: 'C:\Users\user\Desktop\KIX32.EXE' MD5: B04F07D4737AB5CC459DA8C0AB2F5F6D) conhost.exe (PID: 1832 cmdline: C:\Windows\system32\conhost.exe 0x4 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) cleanup Created / dropped Files \Device\ConDrv Process: C:\Users\user\Desktop\KIX32.EXE File Type: ASCII text, with CRLF line terminators Size (bytes): 443 Entropy (8bit): 4.9752427323550545 Encrypted: false MD5: A06D12FD4950BDCF3EF2B1FB965376D7 SHA1: D2B3C2CC0F47DBB87CC040179EB9C6C5A8CDAC86 SHA-256: CA9C6AAAF5B8A3790315B40FB20F023B4B008885ECCE9FC297CEC1BC21E9DD73 SHA-512: B9291EC0CDE04EF89F93E6F844584D64600F797ED04456F702A42601C6903C7A6C56D3E20A31E14466BA92F21B8 B2749F3861C739D117046303839826BA20038 Malicious: false Reputation: