Download the PDF analysis report and the Investigation Package.

Click on the entry to view the details.

Click Advanced, and filter the entries using the SHA-1 hash value noted earlier.

Narrow the Date Range using the Analyzed timestamp noted earlier.

Go to Virtual Analyzer > Submissions > Completed tab.

Log on to the web console of the source Deep Discovery product.

Take note of the Analyzed timestamp and the Deep Discovery product which is the source of the Suspicious Object.

Click View on the Handling Process column.

Take note of the SHA-1 hash value and file name.

Click the drop-down button to view the details regarding the Suspicious Object.

Locate the Callback Address using the Search field.

Go to Administration > Suspicious Object > Virtual Analyzer Objects.

For this scenario, it is critical to identify why the URL/Domain/IP became a Suspicious Object. The Virtual Analyzer C&C List contains callback addresses in Control Manager’s Virtual Analyzer Suspicious Object List.

Scenario 3: C&C List Source is Virtual Analyzer C&C ListĪ process attempted to communicate with a URL/Domain/IP in Virtual Analyzer C&C List.

Refer to KB 1057359 for generating and exporting logs in OfficeScan. The host is possibly infected.Įxport the following logs and submit them to Trend Micro Technical Support for analysis: Relevance Rule is a pattern containing the “network fingerprints” of highly prevalent malware.

Scenario 2: C&C List Source is Relevance Rule.

Submit the result to Trend Micro Technical Support for analysis.

Collect suspicious files and system information using ATTK.

Right-click the process and select Suspend.

Run procexp.exe / procexp64.exe and find the associated process.

Suspending a process using Process Explorer:

Go to the CPU tab and find the associated process.

Suspending a process using Resource Monitor: This prevents the process from running, but at the same time, prevents its persistence from spawning the same process. It is still present in the memory and can be resumed at a later time. Suspending the process is like pausing it. If the process spawns again, it most likely has a persistence - scheduled task, registry, WMI, etc.

End the associated process using Task Manager.

Refer to KB 1106069 on how to block/log C&C IP connection in OfficeScan.

Ensure that the connection is being blocked.

Global C&C IP List is a pattern containing known C&C servers.

Scenario 1: C&C List Source is Global C&C List.

Process – The process which attempted to communicate with the Callback AddressĪfter identifying the C&C callback details, consider the following scenarios:

Go to the System Tray and double-click the OfficeScan Agent icon.Ĭallback Address – The C&C server detectedĬ&C List Source – The name of the list that contains the Callback Address.

Identify the Callback Address, C&C List Source, and Process.

C & c power