ID: 211887 Cookbook: browseurl.jbs Time: 18:53:14 Date: 28/02/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report http://www.wikigain.com/wp- content/uploads/2016/04/Universal-USB-Installer-1.9.6.3.zip 4 Overview 4 General Information 4 Detection 4 Confidence 5 Classification 5 Analysis Advice 6 Mitre Att&ck Matrix 6 Signature Overview 7 Software Vulnerabilities: 7 Networking: 7 Key, Mouse, Clipboard, Microphone and Screen Capturing: 7 System Summary: 7 Persistence and Installation Behavior: 8 Hooking and other Techniques for Hiding and Protection: 8 Malware Analysis System Evasion: 8 Anti Debugging: 8 HIPS / PFW / Operating System Protection Evasion: 8 Language, Device and Operating System Detection: 8 Malware Configuration 8 Behavior Graph 8 Simulations 9 Behavior and APIs 9 Antivirus, Machine Learning and Genetic Malware Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 10 Yara Overview 10 Initial Sample 10 PCAP (Network Traffic) 11 Dropped Files 11 Memory Dumps 11 Unpacked PEs 11 Sigma Overview 11 Joe Sandbox View / Context 11 IPs 11 Domains 11 ASN 11 JA3 Fingerprints 11 Dropped Files 11 Screenshots 11 Thumbnails 11 Startup 12 Created / dropped Files 12 Domains and IPs 16 Contacted Domains 16 URLs from Memory and Binaries 16 Contacted IPs 18 Public 19 Static File Info 19 No static file info 19 Network Behavior 19 Network Port Distribution 19 Copyright Joe Security LLC 2020 Page 2 of 32 TCP Packets 20 UDP Packets 21 DNS Queries 22 DNS Answers 22 HTTP Request Dependency Graph 22 HTTP Packets 22 Code Manipulations 23 Statistics 23 Behavior 23 System Behavior 24 Analysis Process: iexplore.exe PID: 3180 Parent PID: 692 24 General 24 File Activities 24 Registry Activities 24 Analysis Process: iexplore.exe PID: 4808 Parent PID: 3180 24 General 24 File Activities 24 Analysis Process: unarchiver.exe PID: 1744 Parent PID: 3180 25 General 25 File Activities 25 File Created 25 File Written 25 File Read 26 Analysis Process: 7za.exe PID: 3608 Parent PID: 1744 26 General 26 File Activities 27 File Created 27 File Written 27 File Read 28 Analysis Process: conhost.exe PID: 3636 Parent PID: 3608 29 General 29 Analysis Process: cmd.exe PID: 2520 Parent PID: 1744 29 General 29 File Activities 29 Analysis Process: conhost.exe PID: 332 Parent PID: 2520 29 General 29 Analysis Process: Universal-USB-Installer-1.9.6.3.exe PID: 3984 Parent PID: 2520 30 General 30 File Activities 30 File Created 30 File Deleted 31 File Written 31 File Read 32 Disassembly 32 Copyright Joe Security LLC 2020 Page 3 of 32 Analysis Report http://www.wikigain.com/wp-content/uploads/2016/ 04/Universal-USB-Installer-1.9.6.3.zip Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 211887 Start date: 28.02.2020 Start time: 18:53:14 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 36s Hypervisor based Inspection enabled: false Report type: light Cookbook file name: browseurl.jbs Sample URL: www.wikigain.com/wp- content/uploads/2016/04/Universal-USB-Installer- 1.9.6.3.zip Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 11 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: EGA enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean4.win@13/13@1/2 Cookbook Comments: Adjust boot time Enable AMSI Warnings: Show All Exclude process from analysis (whitelisted): ielowutil.exe, conhost.exe, CompatTelRunner.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.61.218.119, 2.18.68.82, 152.199.19.161, 13.107.4.50, 93.184.221.240 Excluded domains from analysis (whitelisted): fs.microsoft.com, ie9comview.vo.msecnd.net, wu.ec.azureedge.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, Edge-Prod-FRA.env.au.au-msedge.net, fs- wildcard.microsoft.com.edgekey.net, fs- wildcard.microsoft.com.edgekey.net.globalredir.aka dns.net, wu.azureedge.net, afdap.au.au- msedge.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, au.au- msedge.net, go.microsoft.com.edgekey.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2- 0.edgecastdns.net, au.c-0001.c-msedge.net, elasticShed.au.au-msedge.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr- 52dd2.edgecastdns.net, cs9.wpc.v0cdn.net Detection Strategy Score Range Reporting Whitelisted Detection Copyright Joe Security LLC 2020 Page 4 of 32 Strategy Score Range Reporting Whitelisted Detection Threshold 4 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 3 0 - 5 true Classification Copyright Joe Security LLC 2020 Page 5 of 32 Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Initial sample is implementing a service and should be registered / started as service Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Mitre Att&ck Matrix Initial Privilege Credential Lateral Command Network Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Effects Valid Command- Winlogon Process Masquerading 1 Input Virtualization/Sandbox Remote File Input Data Remote File Eavesdrop on Accounts Line Helper DLL Injection 1 2 Capture 1 Evasion 1 Copy 2 Capture 1 Compressed Copy 2 Insecure Interface 2 Network Communication Replication Exploitation Port Accessibility Disabling Security Network Process Discovery 1 Remote Data from Exfiltration Standard Non- Exploit SS7 to Through for Client Monitors Features Tools 1 Sniffing Services Removable Over Other Application Redirect Phone Removable Execution 1 Media Network Layer Calls/SMS Media Medium Protocol 3 Copyright Joe Security LLC 2020 Page 6 of 32 Initial Privilege Credential Lateral Command Network Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Effects External Graphical Accessibility Path Virtualization/Sandbox Input File and Directory Windows Data from Automated Standard Exploit SS7 to Remote User Features Interception Evasion 1 Capture Discovery 1 Remote Network Exfiltration Application Track Device Services Interface 2 Management Shared Layer Location Drive Protocol 3 Drive-by Scheduled System DLL Search Process Credentials System Information Logon Input Data Multiband SIM Card Compromise Task Firmware Order Injection 1 2 in Files Discovery 1 2 Scripts Capture Encrypted Communication Swap Hijacking Signature Overview • Software Vulnerabilities • Networking • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section Software Vulnerabilities: Potential browser exploit detected (process start blacklist hit) Networking: Downloads compressed data via HTTP Downloads files from webservers via HTTP Performs DNS lookups Urls found in memory or binary data Key, Mouse, Clipboard, Microphone and Screen Capturing: Creates a DirectInput object (often for capturing keystrokes) System Summary: PE file contains strange resources Classification label Creates files inside the user directory Creates mutexes Creates temporary files Parts of this applications are using the .NET runtime (Probably coded in C#) Reads ini files Reads software policies Sample might require command line arguments Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Copyright Joe Security LLC 2020 Page 7 of 32 Found graphical window changes (likely an installer) Found installer window with terms and condition text Uses new MSVCR Dlls Persistence and Installation Behavior: Drops PE files Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Malware Analysis System Evasion: May sleep (evasive loops) to hinder dynamic analysis Sample execution stops while process was sleeping (likely an evasion) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging HIPS / PFW / Operating System Protection Evasion: Creates a process in suspended mode (likely to inject code) May try to detect the Windows Explorer process (often used for injection) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Queries the cryptographic machine GUID Malware Configuration No configs have been found Behavior Graph Copyright Joe Security LLC 2020 Page 8 of 32 Hide Legend Behavior Graph ID: 211887 Legend: URL: http://www.wikigain.com/wp-... Process Startdate: 28/02/2020 Architecture: WINDOWS Signature Score: 4 Created File started DNS/IP Info iexplore.exe Is Dropped Is Windows Process 10 57 Number of created Registry Values started started Number of created Files unarchiver.exe iexplore.exe Visual Basic Delphi 5 25 Java .Net C# or VB.NET