Tuesday, May 14, 2019

Dive deeper with the Joe Sandbox Splunk Add-On

Joe Sandbox is known to provide very deep analysis reports on malware. As a result, the size of the output data is enormous. In a recent blog post, we have outlined how you can master the large volume of the generated data. In this blog post, we will present the new Splunk Add-on, which also helps to handle the behavior data Joe Sandbox captures.

Splunk captures, indexes, and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards, and visualizations. Splunk is often used as a SIEM within SOCs, CERTs and CIRTs. Various data streams from firewalls, endpoints and sandboxes are sent to Splunk, which then correlates the data.

The Joe Sandbox Splunk Add-on is a connector between Joe Sandbox and Splunk. It fully automates the import of behavior data from Joe Sandbox to Splunk:

Installing the Joe Sandbox Splunk Add-on

Installing the Add-on is easy. Download the Add-on from our Github repository. In Splunk, go to Manage Apps and then choose installation from file. Once Splunk has restarted go to apps - Joe Sandbox Add-on and create an input:

You have to provide a name and add your Joe Sandbox API Key. The API Key can be found in the user settings of the Joe Sandbox web interface. If you like to perform deep searches, untick the use small report checkbox and once done, hit Add. The Add-on will then start importing all your behavior reports. Please note the Add-on will continuously import new behavior reports generated by Joe Sandbox.

Rich Reports allow deep Searches

In order to run queries, you have to use the sourcetype jbx. Here are a couple of simple searches:

  • List all samples with the name id and detection verdict
sourcetype=jbx | table fileinfo.filename, generalinfo.target.url, generalinfo.id, fileinfo.md5, signaturedetections.strategy{}.detection
  • Search for dropped PE files
sourcetype=jbx | rename "droppedinfo.hash{}.@type" as dropped_type, "droppedinfo.hash{}.@file" as dropped_file, "generalinfo.id" as id | eval temp=mvzip(dropped_type,dropped_file, "|") | mvexpand temp | eval dropped_type=mvindex(split(temp,"|"),0) | eval dropped_file=mvindex(split(temp,"|"),1) | search dropped_type="PE*" | table id, dropped_type, dropped_file
  • Search for all samples which connected to a specific IP address
sourcetype=jbx | search "ipinfo.ip{}.@ip"="" | table fileinfo.filename, generalinfo.target.url, generalinfo.id
  • Search for all samples which connected to a malicious IP address
sourcetype=jbx | rename "ipinfo.ip{}.@malicious" as ip_malicious, "ipinfo.ip{}.@ip" as ip_value, "generalinfo.id" as id | eval temp=mvzip(ip_malicious,ip_value, "|") | mvexpand temp | eval ip_malicious=mvindex(split(temp,"|"),0) | eval ip_value=mvindex(split(temp,"|"),1) | search ip_malicious="true" | table id, ip_value
  • Search for all samples which connected to a malicious URL
sourcetype=jbx | rename "urlinfo.url{}.@malicious" as url_malicious, "urlinfo.url{}.@name" as url_value, "generalinfo.id" as id | eval temp=mvzip(url_malicious,url_value, "|") | mvexpand temp | eval url_malicious=mvindex(split(temp,"|"),0) | eval url_value=mvindex(split(temp,"|"),1) | search url_malicious="true" | table id, url_value
  • Search for all samples which connected to a malicious domain
sourcetype=jbx | rename "domaininfo.domain{}.@malicious" as domain_malicious, "domaininfo.domain{}.@name" as domain_value, "generalinfo.id" as id | eval temp=mvzip(domain_malicious,domain_value, "|") | mvexpand temp | eval domain_malicious=mvindex(split(temp,"|"),0) | eval domain_value=mvindex(split(temp,"|"),1) | search domain_malicious="true" | table id, domain_value

As you can see, the behavior data is nicely structured in JSON. Here is a quick overview of what data is available:

Fileinfo contains static information on the file. E.g. if the submitted file is an Office document you will find the OLE streams as well as the VBA code inside this object. Behavior contains detailed system-level behavior, such as all files created, opened, written, deleted, etc. It also contains network traffic such as all TCP, UDP, HTTP, HTTPS streams. Domaininfo, ipinfo, urlinfo and droppedinfo are classic IOC objects. They contain the created files with MD5 and SHA hashes, IP, domain and URL information. Signaturedetections, signatureclassficiation, mitreattack and signatureinfo include all the matching behavior rules, the detection verdict (clean, suspicious or malicious), detection score and classification (ransomware, banker, worm etc). Eventlog includes all the Windows event log data including PowerShell logs. Finally yara and avhit list Yara and Antivirus matches.

All those objects can be easily searched. Here are some more advanced search queries:

  • Search for all samples with a valid PE certificate
sourcetype=jbx | search "fileinfo.pe.signature.sigvalid"="true"
  • Search for all samples which created a file in C:\Windows
source=jbx | rename "behavior.system.processes.process{}.fileactivities.fileCreated.call{}.path" as fileCreated_path, "generalinfo.id" as id | mvexpand fileCreated_path | search fileCreated_path="C:\\Windows\\*" | table id, fileCreated_path
  • Search for all samples which injected into explorer.exe
sourcetype=jbx | search behavior.system.processes.process{}.general.name="explorer.exe" | search behavior.system.processes.process{}.general.reason="extstingprocessinject" | table "generalinfo.id", "fileinfo.filename"
  • Search PowerShell event log (transcript)
sourcetype=jbx | search "behavior.system.processes.process{}.powershellactivities.eventlog.call{}.name"="ScriptBlockText" | table "generalinfo.id", "behavior.system.processes.process{}.powershellactivities.eventlog.call{}.execution"
  • Search for all samples which use a specific MITRE ATT&CK technique
sourcetype=jbx | search mitreattack.tactic{}.technique{}.id="t1022" | table "generalinfo.id", "mitreattack.tactic{}.technique{}.id"

If you are looking for more example searches and visualizations please check out the Joe Sandbox Add-on Github page.

For each search, you can define custom alerts. E.g. if you would like to get informed whenever you analyze a malware sample with a valid PE file:

Joe Sandbox and Splunk - a powerful combination

Thanks to the free Joe Sandbox Splunk Add-on, cybersecurity analysts can automatically import rich Joe Sandbox behavior data into Splunk.

The behavior data is extensive and nicely structured. As a result, analysts can easily perform deep searches to reveal e.g. related malware samples. They can also easily build visualizations, statistics and much more.

Want to try Joe Sandbox and use the Joe Sandbox Splunk Add-on? Register for Free at Joe Sandbox Cloud Basic or contact us for an in-depth technical demo!

Thursday, May 2, 2019

Introducing Joe Sandbox ML

Today we bring you amazing news. Joe Sandbox now features its own Machine Learning and Artificial Intelligence based static detection engine: Joe Sandbox ML.

Joe Sandbox ML is a plug-in which integrates seamlessly into Joe Sandbox Desktop, Joe Sandbox Complete, Joe Sandbox Ultimate, and Joe Sandbox Cloud. With Joe Sandbox ML, Joe Sandbox Desktop, Complete and Ultimate benefit from enhanced detection capabilities:

Dynamic plus static is the best

Combining dynamic and static analysis is extremely powerful. Dynamic analysis detects threats based on the behavior and is resilient against packing and code obfuscation. However, malware can evade dynamic analysis by delaying or hindering execution. Malware may also not execute because the C&C server has been taken down or downloads are no longer reachable from the Internet. Finally, it might also not work due to the wrong operating system or framework versions. Those samples are ideal targets for static detection.

Sample 56KHL48745.exe which was recently uploaded to Cloud Basic is a perfect example. The file crashed due to a .NET interoperability issue:

As a result, no malicious behavior is detected. However, Joe Sandbox ML detects the initial sample as well as the unpacked PE files:

In consequence, Joe Sandbox successfully identifies the sample as malware:

In addition to the original sample, Joe Sandbox ML also scans the unpacked PE files as well as any dropped, modified or created files. 

While other ML engines only support PE files, Joe Sandbox ML has wide support for different file formats including PDFs, Office Documents and ELF files. 

Are you worried about the performance impact? Joe Sandbox ML is extremely fast and makes its decision within milliseconds. 

Joe Sandbox more powerful than ever

Joe Sandbox ML substantially increases the malware detection efficiency of Joe Sandbox. If a sample does not show any malicious behavior there is still a good chance that Joe Sandbox detects it thanks to the help of Joe Sandbox ML.

Joe Sandbox ML is applied to all captured file artifacts and features a wide range of file formats (not just PE files). 

Interested in trying out Joe Sandbox Cloud Pro? Register for a free trial today!

Wednesday, April 17, 2019

Deep Behavior Reports - how to find the needle in the haystack

Joe Sandbox is known to provide the industry's deepest and richest behavior reports. While it is beneficial to have a massive amount of information on the malware execution, this also has its downsides. For instance, it is difficult to get an overview, find interesting data or share findings with colleagues or with other teams. Joe Security has taken the challenge and implemented various tools and features to make behavior reports easier to understand and navigate despite their huge size. In this blog post, we are going to walk you through some of them.

Report Search

On average, a Joe Sandbox HTML report is between ten and 32 Megabyte big. This is a considerable amount of data that includes dynamic behavior, static information, network behavior, execution graphs, disassembly, decompiled C code and much more. Having the possibility to search easily through this ocean of data is mandatory. For this purpose we added a search tool at the bottom right of the analysis page:

If you click on the magnifier a search bar will open. You can search the report for any string longer than 4 chars:

You can even search for strings inside graphs and diagrams:

If you click on a search result, the browser will jump to the report section containing those strings. In addition, the search result is highlighted with a yellow border:

The report search is very fast and you usually get the results back in under one second.

Collider Navigation

Getting an overview of what is inside a Joe Sandbox report is difficult. To address this problem we have created the so-called collider navigation. You access the navigation on the top right:

If you click on it you will see the following snail shell-like chart:

The report has a hierarchical structure, which is represented by this collider. The inner circle segments contain the top sections. Each section has inner sections which then again have inner sections. If you move your mouse over a specific segment of the report, it will show you the data inside of that structure. For instance, the section System Behavior contains Analysis Processes:

Or the Static File Info contains Static PE Info which contains the Data Directories:

As you can see, the collider navigation makes it very easy to get an overview of the structure of a report and allows you to navigate it quickly. If you click on a section the browser will jump to the corresponding data:

Interactive Tour

Let us assume that you read a Joe Sandbox report and you made some interesting findings that you would like to share with another team or colleague. Of course, you could take some screenshots, but a screenshot is static and you cannot copy text or include context. In order to address this limitation, we created the Interactive Tour. Think of the Interactive Tour as a way to directly add comments to the report. Once done, you can share the report and everybody can see and navigate your comments. 

You can find the Interactive Tour on the top right corner of each report:

If you click on it the Tour menu opens:

With the Select Element button you  can select interesting data and right afterwards add a title and description:

By clicking the Add Step, you can add a second comment:

By using the two small error buttons you can change the order of the comments. Once finished click Export:

Add a title for the Interactive Tour and then click Export Report Tour. This will download a new report HTML which includes your comments. If you open the new report file, the tour directly starts:

The menu on the bottom can be used to navigate through the comments:

As this small tutorial shows, it is very simple to add Interactive Tours. This enables you to easily mark or comment on interesting findings and then share that knowledge.

Here are three examples of reports with an Interactive Tour:


Joe Sandbox behavior reports provide a wealth of interesting data. This can be sometimes intimidating. Luckily, we have developed the three features described above to remove the friction. Thanks to the report search tool, analysts can now quickly search for any data in the report. The collider navigation enables them to get a fast overview of all the data inside of the report and navigate through quickly. Interactive Tours enable analysts to annotate interesting data inside reports and share these annotations with their colleagues and teams.

Wednesday, March 20, 2019

Ransomware is not dead - a light analysis of LockerGoga

Despite many reports saying that the number of Ransomware samples is on the decrease, we see again and again big multinational companies suffering from these attacks.

Just two days ago, Norway based Norsk Hydro - one of the World's largest Aluminium producers - was hit by a severe Ransomware attack:

The attack is so massive that Hydro had to switch its productions to manual mode:

According to various press releases, the entire worldwide Norsk Hydro network is down, affecting all production as well as office operations.

If you search this incident on Twitter, you will instantly come across the Ransomware LockerGoga:

While it is still unconfirmed that Norsk Hydro was hit by LockerGoga, we saw a high amount of LockerGoga samples being submitted to VirusTotal as well as Joe Sandbox Cloud Basic.

One of the most recent samples (version 1510) has been uploaded to VirusTotal on March 19th (MD5: e11502659f6b5c5bd9f78f534bc38fea):

On Joe Sandbox Cloud Basic just some minutes later:

Joe Sandbox 25.0.0 Analysis Report

LockerGoga is not a standard Ransomware but rather has some specialties. The binary is signed by Sectigo. The certificate has been revoked recently, but it likely was valid at the time of the attack.

LockerGoga first encrypts the following file types:

Encrypted files are renamed to originalfilename.locked:

For encryption, LockerGoga does not use the Windows Crypto API CryptEncrypt, but rather its own implementation (likely CryptoPP + Boost):

The encryption of files is performed in multiple processes. A master process gathers all files and distributes encryption tasks to its slave processes:

The benefit of this architecture is that encryption is much faster since it will use all the CPU cores of the machine.
Normally, for a workstation with many documents, encryption can take hours. If the ransomware is detected fast enough some documents could be rescued.
In contrast, with LockerGoga this won't help since encryption is very performant. So far, we have not seen any other Ransomware using a distributed encryption architecture.

Goga drops the following ransomware notice:

While files are being encrypted the user is logged out:

Users are then no longer able to log in since before it overwrites the user's and administrator's password with HuHuHUHoHo283283@dJD:

This is another interesting and new behavior. While LockerGoga is not as brutal as wiper malware such as OlympicDestroyer it still completely blocks the computer. 

Update 1 (21.03.2019):

The RSA key length is not 4096 bits as claimed but rather only 1024. The key is:


Besides the account locking LockerGoga also has the capability to disable the network interface:

However, this feature is no activated in version 1510.

LockerGoga seems to be not new, e.g. searching for PE files signed by Sectigo gives us several older versions, e.g. version 1320, MD5 16bcc3b7f32c41e7c7222bf37fe39fe6, March 8th:

Joe Sandbox 25.0.0 Analysis Report

As this blog post outlines LockerGoga is different from standard ransomware:

  • Signed with a valid certificate
  • Uses a multi-process architecture to encrypt files faster
  • Locks the user and administrator account in addition to file encryption 
  • Is continuously improved (multiple version of the same ransomware exist)

Joe Sandbox nicely detected and analyzed all those different aspects. We also have added generic signatures to detect LockerGoga:

Want to try Joe Sandbox? Register for Free at Joe Sandbox Cloud Basic or contact us for an in-depth technical demo!

Tuesday, March 5, 2019

Malicious Documents: The Evolution of country-aware VBA Macros

Today's malware is often delivered via e-mail attachments. Such documents usually contain a VBA macro or utilize the office equation editor exploit (CVE-2017-11882 or CVE-2018-0802). If it is a VBA macro, likely an encrypted PowerShell command is executed.

Lately, we have seen an increase of evasive VBA macros in Excel sheets. We have monitored new samples of the same group over a period of four months and analyzed how the macros changed over time.

This blog post will outline some of our findings.

Initial Sample

Let us have a look at an early version from December 2018, MD5: 2c2545df2bbcd506bd09641ec97ca5ae. The sheet obviously targets Japanese users:

The macro code is triggered once the workbook is opened:

The evasion check is directly performed in the Workbook_Open function:

Application.International(xlCountrySetting) returns the Country/Region version of Microsoft Excel. Here is an incomplete list of version numbers:

' Application.International(xlCountryCode) =
'Arabic                966       (Saudi Arabia)
'Czech                 42        (Czech Republic)
'Danish                45        (Denmark)
'Dutch                 31        (The Netherlands)
'English               1         (The United States of America)
'Farsi                 98        (Iran)
'Finnish               358       (Finland)
'French                33        (France)
'German                49        (Germany)
'Greek                 30        (Greece)
'Hebrew                972       (Israel)
'Hungarian             36        (Hungary)
'Indian                91        (India)
'Italian               39        (Italy)
'Japanese              81        (Japan)
'Korean                82        (Korea)
'Norwegian             47        (Norway)
'Polish                48        (Poland)
'Portuguese (Brazil)   55        (Brazil)
'Portuguese            351       (Portugal)
'Russian               7         (Russian Federation)
'Simplified Chinese    86        (People's Republic of China)
'Spanish               34        (Spain)
'Swedish               46        (Sweden)
'Thai                  66        (Thailand)
'Traditional Chinese   886       (Taiwan)
'Turkish               90        (Turkey)
'Urdu                  92        (Pakistan)
'Vietnamese            84        (Vietnam)

81 stands for Japan. This small code ensures that only Japanese computers are affected. In addition, the code prevents sandbox and dynamic malware analysis systems from analyzing the payload which usually runs on computers with US or Western European environments.

Version 2.0

A month later we detected a new variant MD5: d71eaf0ad33a749b8fe3fb8dff56a474. This time the check was split into functions:

The country code is being used by the functions kille and congamerat. Simply changing digitt would not do the job anymore:

Version 3.0

A couple of days later we found a new variant MD5: 894f2f2b7489052f9fe258f0ea70be6d. This time the Boolean check had been made more complicated:

The check includes arithmetic calculation. In addition, it uses built-in Excel constants such as xlTickLabelPositionHigh. The expression to query the country code is split into two statements:

While most of the sheets we found target Japanese users, we also found some which target Italian users (MD5 d0c862c57819f417b852cb1cd308ffa2 and d0c862c57819f417b852cb1cd308ffa2):

Version 4.0

Some days ago we found another variant, MD5: aacb83294ca96f6713da83363ffd9804. There are multiple changes. First of all, Workbook_Open is no longer used but rather Frame1_Layout:

Frame_Layout is triggered whenever Excel redraws the workbook. The country code check has not changed, it uses calculation and built-in constants:

What is more interesting is the second country check: Function tuff creates a currency format. E.g. for US dollar it creates $0.00. For Japan, it would create 0¥.

The size of the currency format is then later used to decrypt and deobfuscate the command line string passed to Shell:

Fighting country-aware Malware

As this blog demonstrates, attackers constantly improve their code base to make the detection more difficult.

Joe Sandbox has an array of different technologies to fight country aware samples. Generic VBA Instrumentation and Cookbooks are just two of them.  Below is the full analysis of the latest version:


Application.International(xlCountrySetting) and Format(0, "currency") are not the only ways to build country aware malware. Just recently we found a sample MD5 6a9eda3eb0bfc222ab46725829faaec7 which uses GetLocaleInfo: