Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
Practical Malware
Analysis
Ch 2: Malware Analysis in Virtual
Machines
Updated 1-16-17
Dynamic Analysis
• Running malware deliberately, while
monitoring the results
• Requires a safe environment
• Must prevent...
Real Machines
• Disadvantages
– No Internet connection, so parts of the
malware may not work
– Can be difficult to remove ...
Virtual Machines
• The most common method
• We'll do it that way
• This protects the host machine from the
malware
– Excep...
VMware Player
• Free but limited
• Cannot take snapshots
• VMware Workstation or Fusion is a better
choice, but they cost ...
Windows XP
• The malware we are analyzing targets
Windows XP, as most malware does
• Win XP has passed its end-of-life, so...
Configuring VMware
• You can disable networking by
disconnecting the virtual network adapter
• Host-only networking allows...
Connecting Malware to the Internet
• NAT mode lets VMs see each other and the
Internet, but puts a virtual router
between ...
Snapshots
Risks of Using VMware for Malware
Analysis
• Malware may detect that it is in a VM and
run differently
• VMware has bugs: ...
Practical Malware Analysis
Ch 3: Basic Dynamic Analysis
Why Perform Dynamic Analysis?
• Static analysis can reach a dead-end, due
to
– Obfuscation
– Packing
– Examiner has exhaus...
Sandboxes: The Quick-and-
Dirty Approach
Sandbox
• All-in-one software for basic dynamic
analysis
• Virtualized environment that simulates
network services
• Examp...
Running Malware
Launching DLLs
• EXE files can be run directly, but DLLs
can't
• Use Rundll32.exe (included in Windows)
rundll32.exe DLLna...
Launching DLLs
• Example
– rip.dll has these exports: Install and Uninstall
rundll32.exe rip.dll, Install
• Some functions...
Monitoring with Process
Monitor
Process Monitor
• Monitors registry, file system, network,
process, and thread activity
• All recorded events are kept, bu...
Launching Calc.exe
• Many, many events recorded
Process Monitor Toolbar
Start/Stop
Capture
Default Filters
Registry, File system, Network,
Processes
Erase Filter
Filtering with Exclude
• One technique: hide normal activity
before launching malware
• Right-click each Process Name and ...
Filtering with Include
• Most useful filters: Process Name,
Operation, and Detail
Viewing Processes with 

Process Explorer
Coloring
• Services are pink
• Processes are blue
• New processes are green briefly
• Terminated processes are red
DLL Mode
Properties
• Shows DEP (Data
Execution Prevention)
and ASLR (Address
Space Layout
Randomization) status
• Verify button ch...
Strings
• Compare Image to
Memory strings, if
they are very
different, it can
indicate process
replacement
Detecting Malicious Documents
• Open the document (e.g. PDF) on a
system with a vulnerable application
• Watch Process Exp...
Comparing Registry Snapshots
with Regshot
• Take 1st shot
• Run malware
• Take 2nd shot
• Compare them to
see what registry
keys were changed
Regshot
Faking a Network
Using ApateDNS to Redirect DNS
Resolutions
ApateDNS Does Not Work
• I couldn't get it to redirect any traffic in
Win XP or 7
• nslookup works, but you don't see
anyt...
Ncat Listener
• Using Ncat.exe, you can listen on a single
TCP port in Windows
• In Linux, use nc (netcat)
• This will all...
Monitoring with Ncat

(included with Nmap)
Packet Sniffing with Wireshark
Follow TCP Stream
• Can save
files
from
streams
here too
Using INetSim
inetsim
INetSim Fools a Browser
INetSim

Fools

Nmap
Basic Dynamic Tools in
Practice
Using the Tools
• Procmon
– Filter on the malware executable name and
clear all events just before running it
• Process Ex...
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
Prochain SlideShare
Chargement dans…5
×

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

1 335 vues

Publié le

Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.

Instructor: Sam Bowne

Class website: https://samsclass.info/126/126_S17.shtml

Publié dans : Formation
  • Soyez le premier à commenter

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

  1. 1. Practical Malware Analysis Ch 2: Malware Analysis in Virtual Machines Updated 1-16-17
  2. 2. Dynamic Analysis • Running malware deliberately, while monitoring the results • Requires a safe environment • Must prevent malware from spreading to production machines • Real machines can be airgapped –no network connection to the Internet or to other machines
  3. 3. Real Machines • Disadvantages – No Internet connection, so parts of the malware may not work – Can be difficult to remove malware, so re- imaging the machine will be necessary • Advantage – Some malware detects virtual machines and won't run properly in one
  4. 4. Virtual Machines • The most common method • We'll do it that way • This protects the host machine from the malware – Except for a few very rare cases of malware that escape the virtual machine and infect the host
  5. 5. VMware Player • Free but limited • Cannot take snapshots • VMware Workstation or Fusion is a better choice, but they cost money • You could also use VirtualBox, Hyper-V, Parallels, or Xen.
  6. 6. Windows XP • The malware we are analyzing targets Windows XP, as most malware does • Win XP has passed its end-of-life, so we'll use Windows Server 2008
  7. 7. Configuring VMware • You can disable networking by disconnecting the virtual network adapter • Host-only networking allows network traffic to the host but not the Internet
  8. 8. Connecting Malware to the Internet • NAT mode lets VMs see each other and the Internet, but puts a virtual router between the VM and the LAN • Bridged networking connects the VM directly to the LAN • Can allow malware to do some harm or spread – controversial • You could send spam or participate in a DDoS attack
  9. 9. Snapshots
  10. 10. Risks of Using VMware for Malware Analysis • Malware may detect that it is in a VM and run differently • VMware has bugs: malware may crash or exploit it • Malware may spread or affect the host – don't use a sensitive host machine • All the textbook samples are harmless
  11. 11. Practical Malware Analysis Ch 3: Basic Dynamic Analysis
  12. 12. Why Perform Dynamic Analysis? • Static analysis can reach a dead-end, due to – Obfuscation – Packing – Examiner has exhausted the available static analysis techniques • Dynamic analysis is efficient and will show you exactly what the malware does
  13. 13. Sandboxes: The Quick-and- Dirty Approach
  14. 14. Sandbox • All-in-one software for basic dynamic analysis • Virtualized environment that simulates network services • Examples: Norman Sandbox, GFI Sandbox, Anubis, Joe Sandbox, ThreatExpert, BitBlaze, Comodo Instant Malware Analysis • They are expensive but easy to use • They produce a nice PDF report of results
  15. 15. Running Malware
  16. 16. Launching DLLs • EXE files can be run directly, but DLLs can't • Use Rundll32.exe (included in Windows) rundll32.exe DLLname, Export arguments • The Export value is one of the exported functions you found in Dependency Walker, PEview, or PE Explorer.
  17. 17. Launching DLLs • Example – rip.dll has these exports: Install and Uninstall rundll32.exe rip.dll, Install • Some functions use ordinal values instead of names, like rundll32.exe xyzzy.dll, #5 • It's also possible to modify the PE header and convert a DLL into an EXE
  18. 18. Monitoring with Process Monitor
  19. 19. Process Monitor • Monitors registry, file system, network, process, and thread activity • All recorded events are kept, but you can filter the display to make it easier to find items of interest • Don't run it too long or it will fill up all RAM and crash the machine
  20. 20. Launching Calc.exe • Many, many events recorded
  21. 21. Process Monitor Toolbar Start/Stop Capture Default Filters Registry, File system, Network, Processes Erase Filter
  22. 22. Filtering with Exclude • One technique: hide normal activity before launching malware • Right-click each Process Name and click Exclude • Doesn't seem to work well with these samples
  23. 23. Filtering with Include • Most useful filters: Process Name, Operation, and Detail
  24. 24. Viewing Processes with 
 Process Explorer
  25. 25. Coloring • Services are pink • Processes are blue • New processes are green briefly • Terminated processes are red
  26. 26. DLL Mode
  27. 27. Properties • Shows DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) status • Verify button checks the disk file's Windows signature – But not the RAM image, so it won't detect process replacement
  28. 28. Strings • Compare Image to Memory strings, if they are very different, it can indicate process replacement
  29. 29. Detecting Malicious Documents • Open the document (e.g. PDF) on a system with a vulnerable application • Watch Process Explorer to see if it launches a process • The Image tab of that process's Properties sheet will show where the malware is
  30. 30. Comparing Registry Snapshots with Regshot
  31. 31. • Take 1st shot • Run malware • Take 2nd shot • Compare them to see what registry keys were changed Regshot
  32. 32. Faking a Network
  33. 33. Using ApateDNS to Redirect DNS Resolutions
  34. 34. ApateDNS Does Not Work • I couldn't get it to redirect any traffic in Win XP or 7 • nslookup works, but you don't see anything in a browser or with ping • I decided to ignore it and use INetSim instead
  35. 35. Ncat Listener • Using Ncat.exe, you can listen on a single TCP port in Windows • In Linux, use nc (netcat) • This will allow malware to complete a TCP handshake, so you get some rudimentary information about its requests • But it's not a real server, so it won't reply to requests after the handshake
  36. 36. Monitoring with Ncat
 (included with Nmap)
  37. 37. Packet Sniffing with Wireshark
  38. 38. Follow TCP Stream • Can save files from streams here too
  39. 39. Using INetSim
  40. 40. inetsim
  41. 41. INetSim Fools a Browser
  42. 42. INetSim
 Fools
 Nmap
  43. 43. Basic Dynamic Tools in Practice
  44. 44. Using the Tools • Procmon – Filter on the malware executable name and clear all events just before running it • Process Explorer • Regshot • Virtual Network with INetSim • Wireshark

×