ID: Cookbook: urldownload.jbs Time: 15:58:06 Date: 04/06/2018 Version:

Transcription

1 ID: Cookbook: urldownload.jbs Time: 15:58:06 Date: 04/06/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Cryptography: Spam, unwanted Advertisements and Ransom Demands: Key, Mouse, Clipboard, Microphone and Screen Capturing: E-Banking Fraud: Networking: Remote Access Functionality: Stealing of Sensitive Information: Persistence and Installation Behavior: Data Obfuscation: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Lowering of HIPS / PFW / Operating System Security Settings: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Static File Info No static file info Network Behavior Snort IDS Alerts Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: cmd.exe PID: 3688 Parent PID: 1876 General File Activities File Created Analysis Process: wget.exe PID: 3716 Parent PID: 3688 General File Activities File Created File Written Analysis Process: logo.bin.exe PID: 4016 Parent PID: 3308 General Analysis Process: logo.bin.exe PID: 4028 Parent PID: 4016 General File Activities File Created File Written Analysis Process: logo.bin.exe PID: 4040 Parent PID: 4028 General Analysis Process: logo.bin.exe PID: 4048 Parent PID: 4040 General Registry Activities Key Created Key Value Created Analysis Process: taskeng.exe PID: 4076 Parent PID: 872 General File Activities File Read Registry Activities Key Value Created Analysis Process: logo.bin.exe PID: 2100 Parent PID: 4076 General Analysis Process: logo.bin.exe PID: 2096 Parent PID: 2100 General File Activities File Created File Written File Read Registry Activities Analysis Process: svchost.exe PID: 2468 Parent PID: 2096 General File Activities Analysis Process: svchost.exe PID: 2388 Parent PID: 2096 General File Activities File Written File Read Registry Activities Key Value Created Disassembly Copyright Joe Security LLC 2018 Page 3 of 53

4 Code Analysis 53 Copyright Joe Security LLC 2018 Page 4 of 53

5 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:58:06 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 5m 41s light urldownload.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 16 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal100.evad.phis.spyw.troj.win@19/13@4/4 HCA Information: Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 88.3% (good quality ratio 83.1%) Quality average: 77.9% Quality standard deviation: 28.8% Cookbook Comments: Warnings: Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, conhost.exe, dllhost.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtWriteVirtualMemory calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2018 Page 5 of 53

6 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 2018 Page 6 of 53

7 Analysis Advice Contains functionality to modify the execution of threads in other processes Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview AV Detection Cryptography Spam, unwanted Advertisements and Ransom Demands Key, Mouse, Clipboard, Microphone and Screen Capturing E-Banking Fraud Networking Remote Access Functionality Stealing of Sensitive Information Persistence and Installation Behavior Data Obfuscation Spreading System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Lowering of HIPS / PFW / Operating System Security Settings Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for dropped file Antivirus detection for unpacked file Cryptography: Uses Microsoft's Enhanced Cryptographic Provider Spam, unwanted Advertisements and Ransom Demands: Contains functionality to import cryptographic keys (often used in ransomware) Key, Mouse, Clipboard, Microphone and Screen Capturing: Contains functionality for read data from the clipboard E-Banking Fraud: Detected Trickbot e-banking trojan config Networking: Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) May check the online IP address of the machine Downloads files from webservers via HTTP Found strings which match to known social media urls Copyright Joe Security LLC 2018 Page 7 of 53

8 Performs DNS lookups Urls found in memory or binary data Uses HTTPS Remote Access Functionality: Detected Trickbot Trojan Stealing of Sensitive Information: Tries to harvest and steal browser information (history, passwords, etc) Persistence and Installation Behavior: Installs new ROOT certificates Drops PE files May use bcdedit to modify the Windows boot settings Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) Spreading: Creates COM task schedule object (often to register a task for autostart) Contains functionality to enumerate / list files inside a directory System Summary: Contains functionality to call native functions Contains functionality to launch a process as a different user Creates mutexes Detected potential crypto function Found potential string decryption / allocating functions Reads the hosts file Tries to load missing DLLs Classification label Contains functionality to adjust token privileges (e.g. debug / backup) Contains functionality to enum processes or threads Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the program directory Creates files inside the user directory Might use command line arguments Queries process information (via WMI, Win32_Process) Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Creates a directory in C:\Program Files Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: Copyright Joe Security LLC 2018 Page 8 of 53

9 Allocates memory in foreign processes Contains functionality to inject code into remote processes Injects a PE file into a foreign processes Modifies the context of a thread in another process (thread injection) Writes to foreign memory regions Very long cmdline option found, this is very uncommon (may be encrypted or packed) Contains functionality to create a new security descriptor Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Contains functionality for execution timing, often used to detect debuggers Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Contains functionality to read the PEB Contains functionality which may be used to detect a debugger (GetProcessHeap) Enables debug privileges Contains functionality to register its own exception handler Malware Analysis System Evasion: Delayed program exit found Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines) Contains functionality for execution timing, often used to detect debuggers Contains functionality to query network adapater information Found a high number of Window / User specific system calls (may be a loop to detect user behavior) May sleep (evasive loops) to hinder dynamic analysis Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines) Sample execution stops while process was sleeping (likely an evasion) Contains functionality to enumerate / list files inside a directory Contains functionality to query system information Hooking and other Techniques for Hiding and Protection: Extensive use of GetProcAddress (often used to hide API calls) Disables application error messsages (SetErrorMode) Lowering of HIPS / PFW / Operating System Security Settings: Overwrites Mozilla Firefox settings Language, Device and Operating System Detection: Contains functionality locales information (e.g. system language) Contains functionality to query CPU information (cpuid) Queries the volume information (name, serial number etc) of a device Contains functionality to query local / system time Contains functionality to query the account / user name Contains functionality to query windows version Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 2018 Page 9 of 53

10 Behavior Graph Hide Legend ID: Legend: URL: Startdate: 04/06/2018 Architecture: WINDOWS Score: 100 Process Signature Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) Multi AV Scanner detection for dropped file Detected Trickbot e-banking trojan config 2 other signatures started started started Created File DNS/IP Info taskeng.exe logo.bin.exe cmd.exe Is Dropped 1 1 Is Windows Process started Contains functionality to inject code into remote processes Modifies the context of a thread in another process (thread injection) Injects a PE file into a foreign processes Delayed program exit found started started Number of created Registry Values Number of created Files logo.bin.exe logo.bin.exe wget.exe 3 Visual Basic 1 Delphi dropped dropped ipecho.net Java , 443, 49171, AS GO-DADDY-COM-LLC-GoDaddycomLLCUS United States jugnitv.com dropped.net C# or VB.NET started C:\Users\user\AppData\...\logo.bin.exe, PE32 C:\Users\...\logo.bin.exe:Zone.Identifier, ASCII started C:\Users\user\Desktop\download\logo.bin, PE32 C, C++ or other language Modifies the context of a thread in another process (thread injection) Injects a PE file into a foreign processes Is malicious logo.bin.exe logo.bin.exe 5 ipecho.net , 449, 49174, , 447, TIME-NETIQ ITOS-ASRU , 49173, 80 dropped Iraq Russian Federation AS GO-DADDY-COM-LLC-GoDaddycomLLCUS Netherlands C:\Users\user\AppData\...\systeminfo32, data started started started Detected Trickbot Trojan Installs new ROOT certificates Writes to foreign memory regions Allocates memory in foreign processes Multi AV Scanner detection for dropped file Modifies the context of a thread in another process (thread injection) Injects a PE file into a foreign processes svchost.exe svchost.exe logo.bin.exe dropped C:\Users\user\AppData\Roaming\...\prefs.js, ASCII Overwrites Mozilla Firefox settings Tries to harvest and steal browser information (history, passwords, etc) Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines) Simulations Behavior and APIs Time Type Description 15:58:23 API Interceptor 3066x Sleep call for process: cmd.exe modified 15:58:29 API Interceptor 7x Sleep call for process: logo.bin.exe modified 15:58:43 Task Scheduler Run new task: MsSysToken path: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe 15:59:01 API Interceptor 4x Sleep call for process: taskeng.exe modified 15:59:40 API Interceptor 24x Sleep call for process: svchost.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files Detection Scanner Label Link C:\Users\user\AppData\Roaming\freenet\logo.bin.exe 15% virustotal Browse C:\Users\user\Desktop\download\logo.bin 15% virustotal Browse Unpacked PE Files Detection Scanner Label Link 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 Copyright Joe Security LLC 2018 Page 10 of 53

11 Detection Scanner Label Link 15.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 5.0.logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 15.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 5.2.logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 7.0.logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 7.2.logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 Copyright Joe Security LLC 2018 Page 11 of 53

12 Detection Scanner Label Link 15.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen2 7.1.logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 12.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen 15.0.svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen svchost.exe unpack 100% Avira TR/Crypt.XPACK.Gen logo.bin.exe unpack 100% Avira TR/Crypt.XPACK.Gen Domains Detection Scanner Label Link ipecho.net 0% virustotal Browse jugnitv.com 1% virustotal Browse 1% virustotal Browse URLs Detection Scanner Label Link 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Copyright Joe Security LLC 2018 Page 12 of 53

13 Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 13 of 53

14 Startup System is w7 cmd.exe (PID: 3688 cmdline: C:\Windows\system32\cmd.exe /c wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent=' Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' ' > cmdline.out 2>&1 MD5: AD7B9C14083B52BC532FBA B98) wget.exe (PID: 3716 cmdline: wget -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WO W64; Trident/7.0; AS; rv:11.0) like Gecko' ' MD5: 3DADB6E2ECE9C4B3E1E322E617658B60) logo.bin.exe (PID: 4016 cmdline: 'C:\Users\user\Desktop\download\logo.bin.exe' MD5: C8289BD00C65AA98EE73507FD18B5B95) logo.bin.exe (PID: 4028 cmdline: C:\Users\user\Desktop\download\logo.bin.exe MD5: C8289BD00C65AA98EE73507FD18B5B95) logo.bin.exe (PID: 4040 cmdline: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe MD5: C8289BD00C65AA98EE73507FD18B5B95) logo.bin.exe (PID: 4048 cmdline: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe MD5: C8289BD00C65AA98EE73507FD18B5B95) taskeng.exe (PID: 4076 cmdline: taskeng.exe {7EC249AA B8-8E20-AF0514E47403} S :NT AUTHORITY\System:Service: MD5: 4F AFCCA F69407) logo.bin.exe (PID: 2100 cmdline: 'C:\Users\user\AppData\Roaming\freenet\logo.bin.exe' MD5: C8289BD00C65AA98EE73507FD18B5B95) cleanup logo.bin.exe (PID: 2096 cmdline: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe MD5: C8289BD00C65AA98EE73507FD18B5B95) svchost.exe (PID: 2468 cmdline: svchost.exe MD5: 54A47F6B5E09A77E C6A08866) svchost.exe (PID: 2388 cmdline: svchost.exe MD5: 54A47F6B5E09A77E C6A08866) Created / dropped Files C:\Program Files\AutoIt3\cmdline.out Process: C:\Windows\System32\wget.exe File Type: ASCII text, with CRLF line terminators Size (bytes): 1575 Entropy (8bit): Copyright Joe Security LLC 2018 Page 14 of 53

15 C:\Program Files\AutoIt3\cmdline.out Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: FBEF A13BC29A85 F7D9E CF9385B049D2904ACA6 26E DA93784AA42089E9D7B8D6F7EC4CC0F1FD54E963B6F323AF B55C9ECACB4A0F52D5663F19AAD317BA9A2345D04FF8B19FA23CB403D761DD479D ED1F52CDA C9FEB344375CFAF3E1B368BCC3D low C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\wazh7fcp.default\prefs.js Process: File Type: Size (bytes): 7807 C:\Windows\System32\svchost.exe Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: ASCII text, with very long lines, with CRLF line terminators 4DE1466E8502B5B6018CFA01D195D0A9 975F99C7194CD CC15D2C38E78B8CC C602C6F30DFDEE0A1F3FF479AF1A4535CB44DC713E3A22A13B2C1D D FD10C69A693122C6803CF4530CC46FCFC9BDE2BAD20DBF7E12F6E2C E8B7BA0A187C6BFE9EC2267D9 F981C77A297D360A63D603C2ED7A B true low C:\Users\user\AppData\Roaming\freenet\FAQ Process: File Type: Size (bytes): 96 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe data 2399ED861EDD6482E4252A9017F040E7 0C833E1F A6F2D766E98B1F3574FFD 81D5E1A05472E43C4AFC559C233EDF540CBB CA8FE62090BE9478B 2D98DAFC839ADF138731D1D72EB847244BD97FEC173177D5324B8E091C0CFC8524C3D379F313E131E981918BE4 E25C69CD8491F6FBF3EF9BBEF22E794C5CC110 low C:\Users\user\AppData\Roaming\freenet\Modules\injectDll32 Process: File Type: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: true E06E8B90812CDF93B953C2E330108B3B BBF21E464C B870D589399F7AD5D3F1FC2 62A56447DB997B5C30A866A15E3C81D2C5DECB24EA5D995202DECB96D36DACF4 3CB017D42D36E855E36A02DB018FD52C791A55F6E3FBF1890D0B15E523C090797FEB61BC646551EBEE1648AAED DCCC165F4DFC2DBFADC9D3C6E96986C84FE97A low C:\Users\user\AppData\Roaming\freenet\Modules\systeminfo32 Process: File Type: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: true B3A9D A2A0803FB0C6753EA9 D19EF63CCEF78C785CBDE5008FBFE D02F 70DCCAA8296D3101E33F952EB2A927A21F428786F1F8DB724EAF918408E348CF 51C13E5D6C91341A158A40D746E929433B78F39BE48B3705D3E0B172CDCFDE677B008F58FC938C06AE93D D28ED3C662811A720DC42E203FAB34A9D2DC true low Copyright Joe Security LLC 2018 Page 15 of 53

16 C:\Users\user\AppData\Roaming\freenet\README.md Process: File Type: Size (bytes): 16 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe data 1BB38F9CDCFF BEF71F5B48E2 6F75F0C8B48300F77975DD086D6A47D0CA C774158CD2C06C0011B3ACF5433F025B4D758512ED0D6847C6DCD B DCCC6B3EA F08BEBB9A64F586ED955BCA8C52C27990DAF072A9C DABF BE E65D0853F32D2A B1F52C7175DFC92 low C:\Users\user\AppData\Roaming\freenet\logo.bin.exe Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: Reputation: C:\Users\user\Desktop\download\logo.bin.exe PE32 executable (GUI) Intel 80386, for MS Windows C8289BD00C65AA98EE73507FD18B5B95 5F630A5B04D86E BCA0EEF8D8138BEEDA 45E7B385C4B129C3D0BA1FC1E730F32EB654B2B D2F34263F7013F2 B4FA3803B314B0893D24B5643F63DE54AF7BF45EE6B7B26D70B2415D84193CCFCD23F92D005295D22477B8BCED A01DE408F19293E1529D10ED7BBB4576B613F2 true low Antivirus: virustotal, Detection: 15%, Browse C:\Users\user\AppData\Roaming\freenet\logo.bin.exe:Zone.Identifier Process: File Type: Size (bytes): 26 C:\Users\user\Desktop\download\logo.bin.exe ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 187F488E27DB4AF347237FE461A079AD 6693BA299EC D A0D2CB21F8E64 255A65D30841AB4082BD9D0EEA79D49C5EE88F D8D6156AEF11C F237C0C051EBE784D A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53B C731530C92F7327BB7DC9CDE1B60FB21CD64E true low C:\Users\user\Desktop\download\logo.bin Process: File Type: Size (bytes): C:\Windows\System32\wget.exe Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: Reputation: PE32 executable (GUI) Intel 80386, for MS Windows C8289BD00C65AA98EE73507FD18B5B95 5F630A5B04D86E BCA0EEF8D8138BEEDA 45E7B385C4B129C3D0BA1FC1E730F32EB654B2B D2F34263F7013F2 B4FA3803B314B0893D24B5643F63DE54AF7BF45EE6B7B26D70B2415D84193CCFCD23F92D005295D22477B8BCED A01DE408F19293E1529D10ED7BBB4576B613F2 true low Antivirus: virustotal, Detection: 15%, Browse C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Process: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe File Type: Microsoft Cabinet archive data, bytes, 1 file Size (bytes): Entropy (8bit): Encrypted: true MD5: FBF75EBF1592EE C3CF63B9 SHA1: FF7EA302F9C1DEC6CD2CF79909DBB8F563BE1998 Copyright Joe Security LLC 2018 Page 16 of 53

17 C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F SHA-256: SHA-512: Malicious: Reputation: CF9C9F1C30AEBD6D D39370FF309359F82B4ED38F3E7C2553F5C930DF CD0BF65782DD6193B01ABFBFE4C4B08DEEAE4288AAF7CF29279A586F3A701BCCD5C2D43626C7133F37 F8D81DB58505C68ACA21DDAC4101BA9FB9F666 low C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F Process: File Type: C:\Users\user\AppData\Roaming\freenet\logo.bin.exe data Size (bytes): 656 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 58A1DC1E711A1B872BC823E906A FFD7C0197CC14E394A4B9BB8FFC94B1CF37D21C 405F52CFAA4A7287E88FE5BB3E E940F57FE4B19C953C F AFB214688E4ED8E6EC76CCAB552C28F0001A86095B106EBF8EA DA5FE457B5B263D0AD902D4B5B32A7 A2EE321CB6640B6BE98B622DBAC8C25DC54014 low \Endpoint Process: File Type: Size (bytes): 195 C:\Windows\System32\wget.exe ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: DE03894D624E69EFBE13E7972AA11DC3 3D8D797EB91A62F64143CFD B36222FC7 7F79D001B14ED2B5D0557CE5DFDF4D464D2ECB040E0D24BE4C F7E4F1B D99F E2E4023FE3BD59BEDAC0A107B AAE2FDDA4E1BEBE2AE E35F9E48ABA04C7C6450 AE92F44A8A054E27A FE8C7D447CC70BC low \samr Process: File Type: Size (bytes): 520 C:\Windows\System32\svchost.exe Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: Hitachi SH big-endian COFF object, not stripped DE96F53CF00D98BA72DD88BA7B7EDD9B B751F5A B0EF D8630DF875B5 E92CD3B2A86AE2F6CB66C372A3ECED58D4B809378B F184E4C B08FA7A2192E64A5D F45AAAF8E B4A26D9F3AF9D36AF1A9BE5E258FCF0C2021A6F783F25EF 8A56CC50B723BAA31CEC7A6ACE2B750CC790A9 low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation ipecho.net true true 0%, virustotal, Browse low jugnitv.com true 1%, virustotal, Browse unknown true 1%, virustotal, Browse unknown Contacted URLs Name Process C:\Users\user\AppData\Roaming\freenet\logo.bin.exe C:\Windows\System32\wget.exe Copyright Joe Security LLC 2018 Page 17 of 53

18 Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Public IP Country Flag ASN ASN Name Malicious Russian Federation ITOS-ASRU true Netherlands AS GO-DADDY-COM-LLC- GoDaddycomLLCUS United States AS GO-DADDY-COM-LLC- GoDaddycomLLCUS true Iraq TIME-NETIQ true Static File Info No static file info Network Behavior Snort IDS Alerts Timestamp Protocol SID Message 06/04/18-15:59: Port Dest Port IP Dest IP TCP ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC) Network Port Distribution Total Packets: 258 Copyright Joe Security LLC 2018 Page 18 of 53

19 447 undefined 443 (HTTPS) 80 (HTTP) 53 (DNS) TCP Packets Timestamp Port Dest Port IP Dest IP Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Copyright Joe Security LLC 2018 Page 19 of 53

20 Timestamp Port Dest Port IP Dest IP Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Copyright Joe Security LLC 2018 Page 20 of 53

21 Timestamp Port Dest Port IP Dest IP Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Copyright Joe Security LLC 2018 Page 21 of 53

22 Timestamp Port Dest Port IP Dest IP Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Copyright Joe Security LLC 2018 Page 22 of 53

23 Timestamp Port Dest Port IP Dest IP Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Jun 4, :58: CEST Copyright Joe Security LLC 2018 Page 23 of 53