Trying (still) to understand Wildfire

mikand — Mon, 15 Jul 2013 20:06:17 GMT

I got two files sent to me for analysis and I ran them through Wildfire to get a verdict...

Unfortunately im still not comfortable with what Wildfire thinks is a malware and what me (and obviously the rest of the world) belives is a malware...

Could perhaps somebody from PaloAlto themselfs (or somebody else) explain to me why both files have the verdict "Benign" when they obviously is anything BUT benign?

File1:

Overview

Filename: b14620ee8cd512565ce5e0ecd6ab55ca.exe

SHA256: 0f57e8e9334daf3769be5a1ddd19337f7ef8d11a9b2297e71a1c8b2cc2ee7ec3

User:

Received: 7/15/2013 9:40:01 PM

Attacker:

Victim:

Hostname/Mgmt. IP:

Application:

Verdict:

Benign

Analysis Summary

Behavior

Changed security settings of Internet Explorer

Created or modified files

Modified Windows registries

Detailed Events

Registry Action

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e86064ca-57e4-11e0-bef8-806d6172696f}\BaseClass Set

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop Set

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache Set

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Local AppData Set

HKCU\Software\Micorosoft\Server\SmartAssemblyReportUsage Set

HKCU\Control Panel\Keyboard\InitialKeyboardIndicators Set

Process Parent Process Action

C:\sample.exe explorer.exe Create

File Process Action

C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage\2uvfwpzx.c5m\ayzczy0y.0ay\Url.xvrp4itmvjamqpvqmgo5332dmzim1pjr\identity.dat C:\sample.exe Write

C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage\2uvfwpzx.c5m\ayzczy0y.0ay\Url.xvrp4itmvjamqpvqmgo5332dmzim1pjr\info.dat C:\sample.exe Write

C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage\2uvfwpzx.c5m\ayzczy0y.0ay\Url.xvrp4itmvjamqpvqmgo5332dmzim1pjr\AssemFiles\BB41470D\Usages.bin C:\sample.exe Delete

C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage\2uvfwpzx.c5m\ayzczy0y.0ay\Url.xvrp4itmvjamqpvqmgo5332dmzim1pjr\AssemFiles\BB41470D\D C:\sample.exe Delete

And here is what Virustotal thinks of the above file: Antivirus scan for 5fa713436f4820532eb6ea70a9e1ff21 at2013-07-15 19:58:59 UTC - VirusTotal

File2:

Overview

Filename: e762428b721a1de0e50cb93c91ca629c.exe

SHA256: df97bc506772110d83e081bcc80226483176be6de1da85239ac81440eba89ec0

User:

Received: 7/15/2013 9:40:18 PM

Attacker: Victim:

Hostname/Mgmt. IP:

Application:

Verdict:

Benign

Analysis Summary

Behavior

Created or modified files

Spawned new processes

Modified Windows registries

Changed security settings of Internet Explorer

Changed the proxy settings for Internet Explorer

Modified the network connections setting for Internet Explorer

Attempted to sleep for a long period