Automated Malware Analysis Report for Charles-Proxy-4.6.1-Win64.Msi
Total Page：16
File Type：pdf, Size：1020Kb
ID: 325595 Sample Name: charles-proxy- 4.6.1-win64.msi Cookbook: default.jbs Time: 22:22:30 Date: 01/12/2020 Version: 31.0.0 Red Diamond Table of Contents Table of Contents 2 Analysis Report charles-proxy-4.6.1-win64.msi 3 Overview 3 General Information 3 Detection 3 Signatures 3 Classification 3 Analysis Advice 3 Startup 3 Malware Configuration 3 Yara Overview 3 Sigma Overview 3 Signature Overview 4 Mitre Att&ck Matrix 4 Behavior Graph 4 Screenshots 5 Thumbnails 5 Antivirus, Machine Learning and Genetic Malware Detection 6 Initial Sample 6 Dropped Files 6 Unpacked PE Files 6 Domains 6 URLs 6 Domains and IPs 7 Contacted Domains 7 URLs from Memory and Binaries 7 Contacted IPs 8 General Information 8 Simulations 9 Behavior and APIs 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 9 Dropped Files 9 Created / dropped Files 9 Static File Info 10 General 10 File Icon 10 Network Behavior 10 Code Manipulations 10 Statistics 10 Behavior 11 System Behavior 11 Analysis Process: msiexec.exe PID: 3512 Parent PID: 5616 11 General 11 File Activities 11 Registry Activities 11 Analysis Process: msiexec.exe PID: 5820 Parent PID: 3888 11 General 12 Disassembly 12 Code Analysis 12 Copyright null 2020 Page 2 of 12 Analysis Report charles-proxy-4.6.1-win64.msi Overview General Information Detection Signatures Classification Sample charles-proxy-4.6.1- Name: win64.msi CChheecckkss fffoorrr aavvaaiiilllaabblllee ssyyssttteem ddrrriiivveess … Analysis ID: 325595 DCDrrhrooeppcssk sPP EfEo rfffi iillaleevssailable system drives MD5: a6b395dbe57830… MDrooonnpiiittstoo rPrrssE cc efeilrrretttasaiiinn rrreeggiiisstttrrryy kkeeyyss /// vvaallluu… SHA1: 99fad0df0325d27… Ransomware QMuouenerriritiieoesrss tt thchee r vtvaooillnluu mreeeg iiisnntfffrooyrrr mkeaaytttisiioo n/n v (((annlauam… Miner Spreading SHA256: 60f0bb358eff3a7… SQSaaumerppiellees fftiihlleee i isvs o ddliuifffmfeereree ninttf otthhramanna otoiorriingg iin(nnaaall m SSaampplllee fffiiilllee iiiss ddiiiffffffeerrreennttt ttthhaann oorrriiiggiiinnaalll … mmaallliiiccciiioouusss Most interesting Screenshot: malicious Evader Phishing sssuusssppiiiccciiioouusss TSTrrariiiemessp tttloeo llflooilaead di s m diiisisfsfseiiinrneggn DDt LtLhLLassn original suspicious cccllleeaann clean Tries to load missing DLLs Exploiter Banker Spyware Trojan / Bot Adware Score: 2 Range: 0 - 100 Whitelisted: false Confidence: 60% Analysis Advice Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Startup System is w10x64 msiexec.exe (PID: 3512 cmdline: 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\charles-proxy-4.6.1-win64.msi' MD5: 4767B71A318E201188A0D0A420C8B608) msiexec.exe (PID: 5820 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding B88283CC1B72E244558E976259B40600 C MD5: 12C17B5A5C2A7B97342C362CA467E9A2) cleanup Malware Configuration No configs have been found Yara Overview No yara matches Sigma Overview No Sigma rule has matched Copyright null 2020 Page 3 of 12 Signature Overview • Spreading • Networking • System Summary • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Language, Device and Operating System Detection Click to jump to signature section There are no malicious signatures, click here to show all signatures . Mitre Att&ck Matrix Remote Initial Privilege Defense Credential Lateral Command Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration and Control Effects Effects Impact Replication Windows DLL Side- Process Process OS Query Replication Data from Exfiltration Data Eavesdrop on Remotely Modify Through Management Loading 1 Injection 1 Injection 1 Credential Registry 1 Through Local Over Other Obfuscation Insecure Track Device System Removable Instrumentation Dumping Removable System Network Network Without Partition Media 1 Media 1 Medium Communication Authorization Default Scheduled Boot or DLL Side- DLL Side- LSASS Peripheral Remote Data from Exfiltration Junk Data Exploit SS7 to Remotely Device Accounts Task/Job Logon Loading 1 Loading 1 Memory Device Desktop Removable Over Redirect Phone Wipe Data Lockout Initialization Discovery 1 1 Protocol Media Bluetooth Calls/SMS Without Scripts Authorization Domain At (Linux) Logon Script Logon Obfuscated Security File and SMB/Windows Data from Automated Steganography Exploit SS7 to Obtain Delete Accounts (Windows) Script Files or Account Directory Admin Shares Network Exfiltration Track Device Device Device (Windows) Information Manager Discovery 1 Shared Location Cloud Data Drive Backups Local At (Windows) Logon Script Logon Binary NTDS System Distributed Input Scheduled Protocol SIM Card Carrier Accounts (Mac) Script Padding Information Component Capture Transfer Impersonation Swap Billing (Mac) Discovery 1 3 Object Model Fraud Behavior Graph Copyright null 2020 Page 4 of 12 Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Behavior Graph Is Windows Process ID: 325595 Number of created Registry Values Sample: charles-proxy-4.6.1-win64.msi Startdate: 01/12/2020 Number of created Files Architecture: WINDOWS Visual Basic Score: 2 Delphi Java started started .Net C# or VB.NET C, C++ or other language msiexec.exe msiexec.exe Is malicious Internet 4 dropped C:\Users\user\AppData\Local\...\MSI9F13.tmp, PE32 Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright null 2020 Page 5 of 12 Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link charles-proxy-4.6.1-win64.msi 0% Virustotal Browse charles-proxy-4.6.1-win64.msi 0% Metadefender Browse charles-proxy-4.6.1-win64.msi 0% ReversingLabs Dropped Files Source Detection Scanner Label Link C:\Users\user\AppData\Local\Temp\MSI9F13.tmp 0% Virustotal Browse C:\Users\user\AppData\Local\Temp\MSI9F13.tmp 0% Metadefender Browse C:\Users\user\AppData\Local\Temp\MSI9F13.tmp 0% ReversingLabs Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright null 2020 Page 6 of 12 Source Detection Scanner Label Link crl.sectigo.com/SectigoRSATimeStampingCA.crl0t 0% URL Reputation safe crl.sectigo.com/SectigoRSATimeStampingCA.crl0t 0% URL Reputation safe crl.sectigo.com/SectigoRSATimeStampingCA.crl0t 0% URL Reputation safe crl.sectigo.com/SectigoRSATimeStampingCA.crl0t 0% URL Reputation safe crl.sectigo.com/SectigoRSACodeSigningCA.crl0s 0% URL Reputation safe crl.sectigo.com/SectigoRSACodeSigningCA.crl0s 0% URL Reputation safe crl.sectigo.com/SectigoRSACodeSigningCA.crl0s 0% URL Reputation safe crl.sectigo.com/SectigoRSACodeSigningCA.crl0s 0% URL Reputation safe ocsp.sectigo.com0 0% URL Reputation safe ocsp.sectigo.com0 0% URL Reputation safe ocsp.sectigo.com0 0% URL Reputation safe ocsp.sectigo.com0 0% URL Reputation safe crt.sectigo.com/SectigoRSACodeSigningCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSACodeSigningCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSACodeSigningCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSACodeSigningCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSATimeStampingCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSATimeStampingCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSATimeStampingCA.crt0# 0% URL Reputation safe crt.sectigo.com/SectigoRSATimeStampingCA.crt0# 0% URL Reputation safe https://sectigo.com/CPS0C 0% URL Reputation safe https://sectigo.com/CPS0C 0% URL Reputation safe https://sectigo.com/CPS0C 0% URL Reputation safe https://sectigo.com/CPS0C 0% URL Reputation safe https://sectigo.com/CPS0D 0% URL Reputation safe https://sectigo.com/CPS0D 0% URL Reputation safe https://sectigo.com/CPS0D 0% URL Reputation safe https://sectigo.com/CPS0D 0% URL Reputation safe Domains and IPs Contacted Domains No contacted domains info URLs from Memory and Binaries Name Source Malicious Antivirus Detection Reputation https://www.charlesproxy.com/0 msiexec.exe, 00000000.00000002 false high .280623586.0000019ED1820000.00 000004.00000001.sdmp crl.sectigo.com/SectigoRSATimeStampingCA.crl0t msiexec.exe, 00000000.00000002 false URL Reputation: safe unknown .279804308.0000019ECF2CC000.00 URL Reputation: safe 000004.00000001.sdmp URL Reputation: safe URL Reputation: safe https://www.charlesproxy.com/ msiexec.exe, 00000000.00000003 false high .216255503.0000019ECF2C1000.00 000004.00000001.sdmp, msiexec.exe, 00000000.00000002.2806700 35.0000019ED1968000.00000004.0 0000001.sdmp, msiexec.exe, 000 00000.00000002.280623586.00000 19ED1820000.00000004.00000001. sdmp https://www.charlesproxy.com/b msiexec.exe, 00000000.00000003 false high .279118917.0000019ED19C6000.00 000004.00000001.sdmp crl.sectigo.com/SectigoRSACodeSigningCA.crl0s msiexec.exe, 00000000.00000002 false URL Reputation: safe unknown .279804308.0000019ECF2CC000.00 URL Reputation: safe 000004.00000001.sdmp URL Reputation: safe URL Reputation: safe ocsp.sectigo.com0 msiexec.exe, 00000000.00000002 false URL Reputation: safe unknown .279804308.0000019ECF2CC000.00 URL Reputation: safe 000004.00000001.sdmp URL Reputation: safe URL Reputation: safe Copyright null 2020 Page 7 of 12 Name Source Malicious Antivirus Detection Reputation crt.sectigo.com/SectigoRSACodeSigningCA.crt0# msiexec.exe, 00000000.00000002 false URL Reputation: safe unknown .279804308.0000019ECF2CC000.00 URL Reputation: safe