ID: 206746 Sample Name: osquery- 4.1.2.msi Cookbook: default.jbs Time: 14:35:27 Date: 07/02/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report osquery-4.1.2.msi 5 Overview 5 General Information 5 Detection 5 Confidence 6 Classification 6 Analysis Advice 6 Mitre Att&ck Matrix 7 Signature Overview 7 Spreading: 7 Networking: 7 System Summary: 7 Hooking and other Techniques for Hiding and Protection: 8 Malware Analysis System Evasion: 8 Language, Device and Operating System Detection: 8 Malware Configuration 8 Behavior Graph 8 Simulations 8 Behavior and APIs 9 Antivirus, Machine Learning and Genetic Malware Detection 9 Initial Sample 9 Dropped Files 9 Unpacked PE Files 9 Domains 9 URLs 9 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 10 Memory Dumps 10 Unpacked PEs 10 Sigma Overview 10 Joe Sandbox View / Context 10 IPs 10 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 10 Screenshots 10 Thumbnails 10 Startup 11 Created / dropped Files 11 Domains and IPs 11 Contacted Domains 11 URLs from Memory and Binaries 11 Contacted IPs 14 Static File Info 14 General 14 File Icon 14 Static OLE Info 14 General 14 Authenticode Signature 14 OLE File "osquery-4.1.2.msi" 15 Indicators 15 Summary 15 Streams 15 Stream Path: \x5DigitalSignature, File Type: data, Stream Size: 7178 15 General 15 Copyright Joe Security LLC 2020 Page 2 of 27 Stream Path: \x5MsiDigitalSignatureEx, File Type: data, Stream Size: 32 15 General 15 Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 520 15 General 16 Stream Path: \x16786\x17522\x15998\x17589\x17959\x17894\x16786\x17522\x17214\x17574, File Type: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel, Stream Size: 1150 16 General 16 Stream Path: \x16944\x17191\x14436\x16830\x16740, File Type: Microsoft Cabinet archive data, 4595297 bytes, 18 files, Stream Size: 4595297 16 General 16 Stream Path: \x17163\x16689\x18229\x16446\x18156\x14988, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, Stream Size: 207360 16 General 16 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15103\x17508\x16945\x18485, File Type: PC bitmap, Windows 3.x format, 493 x 58 x 8, Stream Size: 2746 16 General 17 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15231\x16684\x17583\x18474, File Type: PC bitmap, Windows 3.x format, 493 x 312 x 8, Stream Size: 68468 17 General 17 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15871\x18088, File Type: MS Windows icon resource - 1 icon, 16x16, 16 colors, Stream Size: 318 General 1717 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x16319\x18483, File Type: MS Windows icon resource - 1 icon, 16x16, 16 colors, Stream Size: 318 General 1717 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15295\x16827\x16687\x18480, File Type: MS Windows icon resource - 1 icon, 32x32, 16 colors, Stream Size: 766 18 General 18 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15551\x17009\x18482, File Type: MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors, Stream Size: 1078 18 General 18 Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x17184\x16827\x18468, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, Stream Size: 107008 General 1818 Stream Path: \x18496\x15167\x17394\x17464\x17841, File Type: data, Stream Size: 1472 18 General 18 Stream Path: \x18496\x15518\x16925\x17915, File Type: data, Stream Size: 204 19 General 19 Stream Path: \x18496\x16191\x17783\x17516\x15210\x17892\x18468, File Type: ASCII text, with very long lines, with CRLF, LF line terminators, Stream Size: 30123 19 General 19 Stream Path: \x18496\x16191\x17783\x17516\x15978\x17586\x18479, File Type: data, Stream Size: 3464 19 General 19 Stream Path: \x18496\x16255\x16740\x16943\x18486, File Type: data, Stream Size: 72 19 General 19 Stream Path: \x18496\x16383\x17380\x16876\x17892\x17580\x18481, File Type: data, Stream Size: 4464 20 General 20 Stream Path: \x18496\x16661\x17528\x17126\x17548\x16881\x17900\x17580\x18481, File Type: data, Stream Size: 4 20 General 20 Stream Path: \x18496\x16667\x17191\x15090\x17912\x17591\x18481, File Type: data, Stream Size: 36 20 General 20 Stream Path: \x18496\x16786\x17522, File Type: data, Stream Size: 4 20 General 20 Stream Path: \x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 48 20 General 20 Stream Path: \x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 42 20 General 21 Stream Path: \x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 42 21 General 21 Stream Path: \x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486, File Type: data, Stream Size: 76 21 General 21 Stream Path: \x18496\x16911\x17892\x17784\x18472, File Type: data, Stream Size: 16 21 General 21 Stream Path: \x18496\x16918\x17191\x18468, File Type: MIPSEB Ucode, Stream Size: 14 21 General 21 Stream Path: \x18496\x16923\x15722\x16818\x17892\x17778, File Type: iAPX 286 executable small model (COFF), Stream Size: 10 21 General 21 Stream Path: \x18496\x16924\x18037\x16812\x15144\x17522\x17783\x17394, File Type: data, Stream Size: 12 22 General 22 Stream Path: \x18496\x16924\x18037\x16812\x15528\x17841\x16695\x17391, File Type: data, Stream Size: 32 22 General 22 Stream Path: \x18496\x16925\x17915\x17884\x17404\x18472, File Type: data, Stream Size: 36 22 General 22 Stream Path: \x18496\x17100\x16808\x15086\x18162, File Type: data, Stream Size: 8 22 General 22 Stream Path: \x18496\x17163\x16689\x18229, File Type: data, Stream Size: 32 22 General 22 Stream Path: \x18496\x17165\x16949\x17894\x17778\x18492, File Type: x86 executable (TV) not stripped, Stream Size: 42 22 General 22 Stream Path: \x18496\x17165\x17380\x17074, File Type: basic-16 executable (TV) not stripped, Stream Size: 484 23 General 23 Stream Path: \x18496\x17167\x16943, File Type: data, Stream Size: 360 23 General 23 Stream Path: \x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 168 23 General 23 Stream Path: \x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 114 23 General 23 Stream Path: \x18496\x17548\x17648\x17522\x17512\x18487, File Type: data, Stream Size: 228 24 General 24 Stream Path: \x18496\x17548\x17905\x17589\x15151\x17522\x17191\x17207\x17522, File Type: data, Stream Size: 504 24 General 24 Stream Path: \x18496\x17548\x17905\x17589\x15279\x16953\x17905, File Type: basic-16 executable (TV) not stripped, Stream Size: 1536 24 General 24 Stream Path: \x18496\x17548\x17905\x17589\x18479, File Type: basic-16 executable (TV) not stripped, Stream Size: 5590 24 General 24 Stream Path: \x18496\x17557\x17318\x16921\x17461\x17836\x17206\x17522\x18486, File Type: data, Stream Size: 36 25 General 25 Stream Path: \x18496\x17610\x16179\x16680\x16821\x18475, File Type: x86 executable (TV), Stream Size: 4 25 General 25 Copyright Joe Security LLC 2020 Page 3 of 27 Stream Path: \x18496\x17630\x17770\x16868\x18472, File Type: data, Stream Size: 32 25 General 25 Stream Path: \x18496\x17740\x16680\x16951\x17551\x16879\x17768, File Type: data, Stream Size: 8 25 General 25 Stream Path: \x18496\x17753\x17650\x17768\x18231, File Type: data, Stream Size: 60 25 General 25 Stream Path: \x18496\x17814\x15340\x17388\x15464\x17828\x18475, File Type: data, Stream Size: 360 25 General 25 Stream Path: \x18496\x17932\x17910\x17458\x16778\x17207\x17522, File Type: data, Stream Size: 48 26 General 26 Stream Path: \x18496\x17998\x17512\x15799\x17636\x17203\x17073, File Type: data, Stream Size: 40 26 General 26 Network Behavior 26 Code Manipulations 26 Statistics 26 System Behavior 26 Analysis Process: msiexec.exe PID: 5952 Parent PID: 4388 26 General 26 File Activities 27 Disassembly 27 Code Analysis 27 Copyright Joe Security LLC 2020 Page 4 of 27 Analysis Report osquery-4.1.2.msi Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 206746 Start date: 07.02.2020 Start time: 14:35:27 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 2m 58s Hypervisor based Inspection enabled: false Report type: light Sample file name: osquery-4.1.2.msi Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean1.winMSI@1/0@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .msi Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 1 0 - 100 false Copyright Joe Security LLC 2020 Page 5 of 27 Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 2 0 - 5 true Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 2020 Page 6 of 27 Sample is looking for USB drives.