Loading ...

Analysis Report

Overview

General Information

Joe Sandbox Version:23.0.0
Analysis ID:67748
Start time:12:37:15
Joe Sandbox Product:CloudBasic
Start date:12.07.2018
Overall analysis duration:0h 1m 35s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:browseurl.jbs
Sample URL:http://www.rexelenergy.com/files/main_style.css
Analysis system description:Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • EGA enabled
Analysis stop reason:Timeout
Detection:SUS
Classification:sus21.expl.win@7/10@1/1
Cookbook Comments:
  • Adjust boot time
  • Correcting counters for adjusted boot time
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.

Detection

StrategyScoreRangeReportingDetection
Threshold210 - 100Report FP / FNsuspicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold40 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior



Signature Overview

Click to jump to signature section


Software Vulnerabilities:

barindex
Potential browser exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Windows\System32\notepad.exeJump to behavior

Networking:

barindex
Downloads filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PSJump to behavior
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /files/main_style.css HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.rexelenergy.comDNT: 1Connection: Keep-Alive
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: www.rexelenergy.com
Posts data to webserverShow sources
Source: unknownHTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 12 Jul 2018 10:37:54 GMTContent-Type: text/cssTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingAccess-Control-Allow-Headers: Origin, Authorization, Content-TypeAccess-Control-Allow-Methods: GET, POST, DELETE, OPTIONSAccess-Control-Allow-Origin: *Expires: Fri, 13 Jul 2018 10:37:54 GMTCache-Control: max-age=86400X-Host: pages8.sf2p.intern.weebly.netContent-Encoding: gzipData Raw: 31 35 30 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 8f e3 b8 91 df f7 57 e8 d2 58 f4 34 62 79 65 b9 ed 7e 0c ae ef 36 bb 41 b2 9f 2e d8 2c b0 01 72 87 80 96 68 5b 37 b2 a5 48 72 3f 76 90 c3 fd 87 fb 87 f9 25 e1 53 62 91 45 4a ee 9e cd 65 0e 17 a7 77 da 12 59 2c d6 8b 55 c5 22 fb 54 ce a2 8a fd 94 c5 2c da 2f d8 4f ca 7e 96 ec e7 9a fd ac d8 cf 7a 16 d5 0d 9d 45 db aa 39 cc a2 4d 95 bf b0 87 dd 81 75 c9 8b c7 79 4d 1a b2 6b 48 bd 67 af ca 2a fb f0 e7 53 d5 f1 c6 05 2d f3 96 76 b3 a8 38 d6 a7 2e fa 18 1d 48 b3 2b 8e f7 51 f2 3e aa 49 9e 17 c7 9d f8

System Summary:

barindex
Searches the installation path of Mozilla FirefoxShow sources
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeRegistry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\54.0.1 (x86 en-US)\Main Install DirectoryJump to behavior
Classification labelShow sources
Source: classification engineClassification label: sus21.expl.win@7/10@1/1
Creates files inside the user directoryShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\HighJump to behavior
Creates temporary filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\HERBBL~1\AppData\Local\Temp\~DFF1B9B711F03148D5.TMPJump to behavior
Reads ini filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
Reads software policiesShow sources
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3328 CREDAT:275457 /prefetch:2
Source: unknownProcess created: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new
Source: unknownProcess created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\main_style.css
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3328 CREDAT:275457 /prefetch:2Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\main_style.cssJump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -newJump to behavior
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0144-ABCDEFFEDCBA}\InprocServer32Jump to behavior
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Uses new MSVCR DllsShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dllJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\main_style.css VolumeInformationJump to behavior

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
behaviorgraph top1 process2 2 Behavior Graph ID: 67748 URL: http://www.rexelenergy.com/files/main_style.css Startdate: 12/07/2018 Architecture: WINDOWS Score: 21 6 iexplore.exe 27 48 2->6         started        signatures3 18 Potential browser exploit detected (process start blacklist hit) 6->18 9 iexplore.exe 12 6->9         started        12 notepad.exe 6->12         started        process4 dnsIp5 16 www.rexelenergy.com 199.34.228.79, 49163, 49164, 80 WEEBLY-WeeblyIncUS United States 9->16 14 ssvagent.exe 6 9->14         started        process6

Simulations

Behavior and APIs

TimeTypeDescription
12:37:45API Interceptor518x Sleep call for process: iexplore.exe modified
12:37:46API Interceptor1x Sleep call for process: ssvagent.exe modified

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

SourceDetectionScannerLabelLink
www.rexelenergy.com0%virustotalBrowse

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

Dropped Files

No context

Screenshots