Automated Malware Analysis Report for Mintty.Exe
Total Page:16
File Type:pdf, Size:1020Kb
ID: 82150 Sample Name: mintty.exe Cookbook: default.jbs Time: 12:06:06 Date: 04/10/2018 Version: 24.0.0 Fire Opal Table of Contents Table of Contents 2 Analysis Report mintty.exe 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification 5 Analysis Advice 5 Signature Overview 6 Spreading: 6 Software Vulnerabilities: 6 Networking: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 System Summary: 6 Data Obfuscation: 6 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Anti Debugging: 7 Language, Device and Operating System Detection: 7 Behavior Graph 7 Simulations 7 Behavior and APIs 8 Antivirus Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 8 Domains 8 URLs 8 Yara Overview 8 Initial Sample 8 PCAP (Network Traffic) 8 Dropped Files 8 Memory Dumps 8 Unpacked PEs 8 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 Dropped Files 9 Screenshots 9 Thumbnails 9 Startup 10 Created / dropped Files 10 Domains and IPs 10 Contacted Domains 10 URLs from Memory and Binaries 10 Contacted IPs 11 Static File Info 11 General 11 File Icon 11 Static PE Info 11 General 11 Entrypoint Preview 12 Data Directories 12 Sections 13 Resources 14 Imports 14 Version Infos 15 Possible Origin 15 Copyright Joe Security LLC 2018 Page 2 of 16 Network Behavior 16 Code Manipulations 16 Statistics 16 System Behavior 16 Analysis Process: mintty.exe PID: 3268 Parent PID: 3056 16 General 16 Disassembly 16 Code Analysis 16 Copyright Joe Security LLC 2018 Page 3 of 16 Analysis Report mintty.exe Overview General Information Joe Sandbox Version: 24.0.0 Fire Opal Analysis ID: 82150 Start date: 04.10.2018 Start time: 12:06:06 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 2m 37s Hypervisor based Inspection enabled: false Report type: light Sample file name: mintty.exe Cookbook file name: default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies HCA enabled EGA enabled HDC enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean7.winEXE@1/0@0/0 EGA Information: Failed HDC Information: Successful, ratio: 16% (good quality ratio 10.4%) Quality average: 40.1% Quality standard deviation: 34.7% HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Found application associated with file extension: .exe Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target mintty.exe, PID 3268 because there are no executed function Detection Strategy Score Range Reporting Detection Threshold 7 0 - 100 Report FP / FN Confidence Copyright Joe Security LLC 2018 Page 4 of 16 Strategy Score Range Further Analysis Required? Confidence Threshold 3 0 - 5 true Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Copyright Joe Security LLC 2018 Page 5 of 16 Signature Overview • Spreading • Software Vulnerabilities • Networking • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Data Obfuscation • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • Language, Device and Operating System Detection Click to jump to signature section Spreading: Contains functionality to enumerate / list files inside a directory Software Vulnerabilities: Found inlined nop instructions (likely shell or obfuscated code) Networking: Found strings which match to known social media urls Urls found in memory or binary data Key, Mouse, Clipboard, Microphone and Screen Capturing: Contains functionality for read data from the clipboard Contains functionality to read the clipboard data Contains functionality to retrieve information about pressed keystrokes System Summary: Detected potential crypto function Found potential string decryption / allocating functions PE file contains strange resources Tries to load missing DLLs Classification label Contains functionality for error logging Contains functionality to instantiate COM classes PE file has an executable .text section and no other executable section Reads software policies PE file contains a debug data directory Data Obfuscation: Contains functionality to dynamically determine API calls Copyright Joe Security LLC 2018 Page 6 of 16 PE file contains sections with non-standard names Hooking and other Techniques for Hiding and Protection: Contains functionality to check if a window is minimized (may be used to check if an application is visible) Extensive use of GetProcAddress (often used to hide API calls) Malware Analysis System Evasion: Program does not show much activity (idle) Contains functionality to enumerate / list files inside a directory Anti Debugging: Contains functionality to dynamically determine API calls Program does not show much activity (idle) Language, Device and Operating System Detection: Contains functionality locales information (e.g. system language) Contains functionality to query windows version Behavior Graph Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Behavior Graph Number of created Registry Values Number of created Files ID: 82150 Visual Basic Sample: mintty.exe Startdate: 04/10/2018 Delphi Architecture: WINDOWS Java Score: 7 .Net C# or VB.NET C, C++ or other language started Is malicious mintty.exe Simulations Copyright Joe Security LLC 2018 Page 7 of 16 Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Scanner Label Link mintty.exe 1% virustotal Browse mintty.exe 0% metadefender Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Source Detection Scanner Label Link ciembor.github.io/4bit/StoreTransparencyGla&ss&High&Med.&Low&OffOpa&que 0% Avira URL Cloud safe https://raw.githubusercontent.com/mintty/mintty/master/VERSION 0% virustotal Browse https://raw.githubusercontent.com/mintty/mintty/master/VERSION 0% Avira URL Cloud safe mintty.github.io/ 0% virustotal Browse mintty.github.io/ 0% Avira URL Cloud safe mintty.github.io/minttyhttps://raw.githubusercontent.com/mintty/mintty/master/VERSIONnone/usr 0% Avira URL Cloud safe ciembor.github.io/4bit/ 0% virustotal Browse ciembor.github.io/4bit/ 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 8 of 16 Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2018 Page 9 of 16 Startup System is w7 mintty.exe (PID: 3268 cmdline: 'C:\Users\user\Desktop\mintty.exe' MD5: C51C1148E3671AD3DE3BB109B3F6741D) cleanup Created / dropped Files No created / dropped files found Domains and IPs Contacted Domains No contacted domains info URLs from Memory and Binaries Copyright Joe Security LLC 2018 Page 10 of 16 Name Source Malicious Antivirus Detection Reputation mintty.exe false Avira URL Cloud: safe low ciembor.github.io/4bit/StoreTransparencyGla&ss&High&Med. &Low&OffOpa&que mintty.exe false 0%, virustotal, Browse unknown https://raw.githubusercontent.com/mintty/mintty/master/VERSI Avira URL Cloud: safe ON mintty.github.io/ mintty.exe false 0%, virustotal, Browse low Avira URL Cloud: safe mintty.exe false Avira URL Cloud: safe low mintty.github.io/minttyhttps://raw.githubusercontent.com/mintty /mintty/master/VERSIONnone/usr ciembor.github.io/4bit/ mintty.exe false 0%, virustotal, Browse low Avira URL Cloud: safe Contacted IPs No contacted IP infos Static File Info General File type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows Entropy (8bit): 6.116338881361039 TrID: Win32 Executable (generic) a (10002005/4) 99.94% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Java Script embedded in Visual Basic Script (1500/0) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: mintty.exe File size: 514048 MD5: c51c1148e3671ad3de3bb109b3f6741d SHA1: 1f488915a6c9cd8414178ba3463c621aa2f0a5e4 SHA256: c065027144db0c357d035d0b0987e92769fc0813b8d516 ebc102bd9e8ea4965a SHA512: 3179dea67eea049186b54d3452d2d21b1a8aac63c5f2f52 ad869a6425781d9e835e17dff0ebb1ed1e4fe162f177673 7ebe239e4b3d5681338d87486118748424 File Content Preview: MZ......................@...............................................!..L.!Th is program cannot be run in DOS mode....$.......PE..L..... ............/..............p................@..................................T.... .... ............................ File Icon Static PE Info General Entrypoint: