Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)

Transcrição

1 UNIVERSIDADE CATÓLICA DE BRASÍLIA Pós-graduação Lato Sensu em Perícia Digital Laboratório de Perícia Digital Análise de Malware Volatility 1. Qual o sistema operacional pertence a imagem da memória? volatility-2.4.standalone.exe -f "Windows XP Professional.vmem" imageinfo Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86) profile=winxpsp2x86 kdbgscan ************************************************** Instantiating KDBG using: Kernel AS WinXPSP2x86 ( bit) Offset (V) : 0x80545b60 Offset (P) : 0x545b60 KDBG owner tag check : True Profile suggestion (KDBGHeader): WinXPSP3x86 Version64 : 0x80545b38 (Major: 15, Minor: 2600) Service Pack (CmNtCSDVersion) : 3 Build string (NtBuildLab) : 2600.xpsp_sp3_gdr Quais processos estavam em execução no momento da captura? profile=winxpsp3x86 psxview Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ExitTime x01994d08 services.exe 680 True True True True True True True 0x015a0458 MsMpEng.exe 1040 True True True True True True True 0x014c1718 TPAutoConnSvc.e 2068 True True True True True True True 0x svchost.exe 868 True True True True True True True 0x01b2d7f0 VMwareTray.exe 1876 True True True True True True True 0x016db608 cmd.exe 3756 True True True True True True True 0x015a5b28 svchost.exe 2000 True True True True True True True 0x017c2630 vmacthlp.exe 852 True True True True True True True 0x019f7548 svchost.exe 1200 True True True True True True True 0x017c9638 svchost.exe 1812 True True True True True True True 0x014d6020 wscntfy.exe 2028 True True True True True True True 0x vmtoolsd.exe 200 True True True True True True True 0x016c9b40 winlogon.exe 636 True True True True True True True 0x018b7020 svchost.exe 1076 True True True True True True True 0x0184a020 msseces.exe 1900 True True True True True True True 0x01ab5248 svchost.exe 944 True True True True True True True 0x01af5cd0 explorer.exe 1752 True True True True True True True 0x016e7b38 msiexec.exe 2396 True True True True True True True 0x01af6458 VMwareUser.exe 1888 True True True True True True True 0x015685e0 spoolsv.exe 1516 True True True True True True True 0x016a2cd0 lsass.exe 692 True True True True True True True 0x014b03e0 alg.exe 2272 True True True True True True True 0x TPAutoConnect.e 3372 True True True True True True True 0x ctfmon.exe 1912 True True True True True True True 0x01529b28 VMUpgradeHelper 424 True True True True True True True 0x0189a1d0 svchost.exe 1336 True True True True True True True

2 0x014f59a8 cmd.exe 3128 True True False True False False False :26:30 UTC x01aefda0 smss.exe 384 True True True True False False False 0x01bcc830 System 4 True True True True False False False 0x01816ab8 csrss.exe 612 True True True True False True True profile=winxpsp3x86 pstree Name Pid PPid Thds Hnds Time x819cc830:System :00:00 UTC x818efda0:smss.exe :33:32 UTC x81616ab8:csrss.exe :33:35 UTC x814c9b40:winlogon.exe :33:35 UTC x81794d08:services.exe :33:35 UTC x813685e0:spoolsv.exe :33:39 UTC x813a0458:MsMpEng.exe :33:36 UTC x815c9638:svchost.exe :33:46 UTC x812c1718:TPAutoConnSvc.e :33:55 UTC x :TPAutoConnect.e :33:59 UTC x818b5248:svchost.exe :33:36 UTC x817f7548:svchost.exe :33:37 UTC x8169a1d0:svchost.exe :33:37 UTC x816b7020:svchost.exe :33:36 UTC x812d6020:wscntfy.exe :33:55 UTC x812b03e0:alg.exe :33:55 UTC x :vmtoolsd.exe :33:47 UTC x812f59a8:cmd.exe :26:30 UTC x813a5b28:svchost.exe :33:47 UTC x815c2630:vmacthlp.exe :33:35 UTC x :svchost.exe :33:35 UTC x814e7b38:msiexec.exe :34:45 UTC x81329b28:VMUpgradeHelper :33:48 UTC x814a2cd0:lsass.exe :33:35 UTC x818f5cd0:explorer.exe :33:45 UTC x814db608:cmd.exe :20:44 UTC x818f6458:VMwareUser.exe :33:47 UTC x8164a020:msseces.exe :33:47 UTC x :ctfmon.exe :33:47 UTC x8192d7f0:VMwareTray.exe :33:46 UTC Qual processo parecem suspeitos? Porque? PIDs 868, 944, 1076, 1200, 1336, 1812, 2000 todos svchost.exe. Esses processos são suspeitos pois são processos normalmente válidos e comuns em sistemas windows e, portanto, comumente usados para disfarçar ou injetar malwares. Além disso temos 2 processos cmd.exe, nos PID 3128 e O PID 3756 é originário do PID 1752, explorer.exe 4. Qual processo pertence ao malware analisado? Muito suspeita a abertura de portas em quase em sequência pelo processo 1752: Portas 1065, 1067, 1068, 1072 e 1073 profile=winxpsp3x86 connscan Offset(P) Local Address Remote Address Pid x014f6ab : : x : : x016c2b : : x017028a : : x01858cb : :

3 5. Qual resultado da análise do processo no VirusTotal.com? profile=winxpsp3x86 malfind -D shylock 6. Aonde ele foi armazenado? Código foi injetado no processo Explorer.exe Existem conexões de rede? profile=winxpsp3x86 connscan Offset(P) Local Address Remote Address Pid x014f6ab : : x : : x016c2b : : x017028a : : x01858cb : : Quais informações podem ser úteis via strings (ASCII)? profile=winxpsp3x86 vaddump -p D vaddump

4 strings vaddump\explorer.exe.1af5cd0.0x x0007ffff.dmp Strings v2.51 Copyright (C) Mark Russinovich Sysinternals - G] q- x- 2f yf Shylock4FDA... ~>w ~>w %Fw >w8 #Cw >Cwh U>w uawh 3Cw /Cw 4Cw P/ Shylock4FDA5E7E8E682870E993F97AD26BA6B2 P/ A~X A~N D~0 A~{ Cw Awh txaw B~E #Cwh B~ Z*~ A~H A~8 Bwt Bwh D~0 9. Existem informações sobre persistência? Se feito pelo registro, em qual chave? profile=winxpsp3x86 printkey -K "Software\Microsoft\Windows\CurrentVersion\Run" Legend: (S) = Stable (V) = Volatile Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT Key name: Run (S) Last updated: :25:35 UTC+0000 Subkeys: Values: REG_SZ ctfmon.exe : (S) C:\WINDOWS\system32\ctfmon.exe REG_SZ {919863BF-D426-AA00-979B-DF55477F92A7} : (S) C:\Documents and Settings\Administrator\Application Data\Intuit\Quicken\Log\rdshost.exe

5 10. Procure ou escreva uma regra para o plugin yarascan que otimize algum dos passos de identificação do malware. profile=winxpsp3x86 yarascan -y shylock.yar 0x0349fa3c c pipe\919863bfd42 0x0349fa4c AA00979BDF x0349fa5c F92A7... 0x0349fa6c b a 2f 2f 63 6f 6d 6d... 0x0349fa7c 6f 6e 77 6f 72 6c 64 6d 65 2e f c onworldme.cc/fil 0x0349fa8c f 48 4a 2d 55 4b 2d 37 5f 63 2e es/hj-uk-7_c.gif 0x0349fa9c xVP. 0x0349faac f 6e d f 73 6f 66 rsion%3dmicrosof 0x0349fabc 74 2b e 64 6f b b t+windows+xp+sp3 0x0349facc 2b %28x32%29%7c%7c 0x0349fadc f 6d %7c%7c%7cCompute 0x0349faec 72 2b 6e 61 6d d r+name%3dch-d5fc 0x0349fafc B47B%7c%7c%7 0x0349fb0c d 69 6e c%7c%7cadmin%3dy 0x0349fb1c es%7c%7c%7c%7c%7 0x0349fb2c f ccodepage%3d1252 0x0349ff40 4d f MASTER_919863BFD 0x0349ff AA00979BDF554 0x0349ff f 00 77F92A7...(... 0x0349ff fe17c2cddffd731e 0x0349ff e6a c6b20 0x0349ff f 56 4e a 00.VT_VNC x0349ffa a a 00 8vJ.T.P x0349ffb0 a0 ff e a 00..I.t x0349ffc0 b0 ff c 01 0a 00..I.T.P...<... 0x0349ffd0 e e 11 0c 00.SP.T.T...>... 0x0349ffe f8 9f b t 0x0349fff0 54 ec 11 4f a 32 f T..OC x034a x034a x034a x034a x034a74ff d id=919863bfd426a 0x034a750f A00979BDF55477F9 0x034a751f e c 2A7.%22...`.. 0x034a752f a a 03 6c f..wJ..wJ.l... 0x034a753f 47 0e d 01 0b f f G...m...h?P.ocu 0x034a754f 6d 65 6e e e ments.and.settin 0x034a755f c d 69 6e f 72 gs\administrator 0x034a756f 5c c f 6e \Application.Dat 0x034a757f 61 5c 4d f 73 6f c a\microsoft\cryp 0x034a758f 74 6e c c 43 6f 6e tneturlcache\con 0x034a759f e 74 5c e tent\ipv6.exe.%. 0x034a75af 00 0b 00 0e c0 79 4a s...yJ.rsi 0x034a75bf 6f 6e d f 73 6f b 57 on%3dmicrosoft+w 0x034a75cf 69 6e 64 6f b b b indows+xp+sp3+%2 0x034a75df x32%29%7c%7c%7c 0x034a75ef f 6d b 6e %7c%7cComputer+n