Analysis Report

Overview

General Information

Joe Sandbox Version:	22.0.0
Analysis ID:	51088
Start time:	23:17:16
Joe Sandbox Product:	CloudBasic
Start date:	20.03.2018
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ocsp_server.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.evad.winEXE@1/1@0/0
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
EGA Information:	Failed
HDC Information:	Failed
Cookbook Comments:	Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	22	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	2	0 - 5	true

Classification

Analysis Advice

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample launched by virtual dos engine, sample likely has a wrong file extension

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Signature Overview

Click to jump to signature section

Networking:

Urls found in memory or binary data

Show sources

Source: ntvdm.exe	String found in binary or memory: http://ipxe.org
Source: ntvdm.exe	String found in binary or memory: http://ipxe.org)
Source: ntvdm.exe	String found in binary or memory: http://ipxe.orgiPXE

Spreading:

Checks for available system drives (often done to infect USB drives)

Show sources

Source: C:\Windows\System32\ntvdm.exe	File opened: u:
Source: C:\Windows\System32\ntvdm.exe	File opened: m:
Source: C:\Windows\System32\ntvdm.exe	File opened: p:
Source: C:\Windows\System32\ntvdm.exe	File opened: v:
Source: C:\Windows\System32\ntvdm.exe	File opened: j:
Source: C:\Windows\System32\ntvdm.exe	File opened: f:
Source: C:\Windows\System32\ntvdm.exe	File opened: s:
Source: C:\Windows\System32\ntvdm.exe	File opened: e:
Source: C:\Windows\System32\ntvdm.exe	File opened: b:
Source: C:\Windows\System32\ntvdm.exe	File opened: w:
Source: C:\Windows\System32\ntvdm.exe	File opened: o:
Source: C:\Windows\System32\ntvdm.exe	File opened: y:
Source: C:\Windows\System32\ntvdm.exe	File opened: t:
Source: C:\Windows\System32\ntvdm.exe	File opened: n:
Source: C:\Windows\System32\ntvdm.exe	File opened: a:
Source: C:\Windows\System32\ntvdm.exe	File opened: r:
Source: C:\Windows\System32\ntvdm.exe	File opened: l:
Source: C:\Windows\System32\ntvdm.exe	File opened: z:
Source: C:\Windows\System32\ntvdm.exe	File opened: h:
Source: C:\Windows\System32\ntvdm.exe	File opened: x:
Source: C:\Windows\System32\ntvdm.exe	File opened: c:
Source: C:\Windows\System32\ntvdm.exe	File opened: i:
Source: C:\Windows\System32\ntvdm.exe	File opened: q:
Source: C:\Windows\System32\ntvdm.exe	File opened: k:
Source: C:\Windows\System32\ntvdm.exe	File opened: g:
Source: C:\Windows\System32\ntvdm.exe	File opened: d:

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: sus22.evad.winEXE@1/1@0/0

Creates temporary files

Show sources

Source: C:\Windows\System32\ntvdm.exe

File created: C:\Users\HERBBL~1\AppData\Local\Temp\scsD1F3.tmp

Reads software policies

Show sources

Source: C:\Windows\System32\ntvdm.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: ocsp_server.exe

Metascan Online: hash found

Creates driver files

Show sources

Source: C:\Windows\System32\ntvdm.exe

File created: C:\MSDOS.SYS

Tries to load missing DLLs

Show sources

Source: C:\Windows\System32\ntvdm.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: ntvdmd.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: vdmredir.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\ntvdm.exe	Section loaded: wkscli.dll

HIPS / PFW / Operating System Protection Evasion:

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\System32\ntvdm.exe

Thread register set: target process: unknown

Anti Debugging:

Checks if the current process is being debugged

Show sources

Source: C:\Windows\System32\ntvdm.exe	Process queried: DebugPort
Source: C:\Windows\System32\ntvdm.exe	Process queried: DebugPort

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\ntvdm.exe	Process information set: NOOPENFILEERRORBOX

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

No simulations

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ocsp_server.exe	0%	virustotal		Browse
ocsp_server.exe	0%	metadefender		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

Dropped Files

No context

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Networking:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Hooking and other Techniques for Hiding and Protection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot