Lab Proj 12 - Basic Dynamic Analysis

Lab-Project 12: Basic Dynamic Analysis
What You Need for This Project

● A virtual machine with Windows 10. Remember to turn off any antivirus
and isolate this machine from other necessary machines/networks.
Purpose
1. Practicing basic dynamic analysis techniques.
Downloading the sample
2. Download the sample from key.7z. (Pass: malware)

3. Extract the 7z file.
Using PEview
4. Open key.exe in PEview.

5. As shown below, if you expand SECTION .rdata and click IMPORT
Address Table, one of the three DLL's imported is advapi32.dll.
6. As you scroll you will see functions such as WriteConsoleW,
GetConsoleWindow, WideCharToMultiByte, and GetStringType which
assist us in identifying what the exe is doing.
7. The other two DLLs are kernel32.dll, and user32.dll.
Using BinText
8. Examine the strings in key.exe and find these items, as shown below:
log.txt - A txt file
key.exe - The program name
C:\windows\vmx32to64.exe - An interesting file
9. Scroll up and find the key definitions, including #SHIFT# and

#CAPS_LOCK#, as shown below. These look like strings used by a
keylogger.
Preparing for Dynamic Analysis
10. Dynamic analysis is simple: run monitoring tools, then run the malware,
and let it have its way with our virtual machine. This is a sloppy technique,
trusting a system that is being infected, but it usually works.
11. We will be needing the following tools for this project:
WireShark: https://www.wireshark.org/#download
Process Explorer:
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
Process Monitor:
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
Running Process Explorer
12. Process Explorer shows currently running processes, with far more detail
than Task Manager. It doesn't keep a log of them, so it's harmless to leave
running.
Running Wireshark
13. Start Wireshark and begin capturing packets from the interface that goes to
the Internet, which is normally Ethernet0.
14. If your virtual machine is in NAT networking mode, there shouldn't be a lot
of traffic.
Starting Process Monitor
15. Process Monitor logs all the events in Windows Event Viewer, which will
typically be hundreds of thousands of events. Don't leave it running for too
long or it will use up all the RAM and crash.
16. It's best to start Process Monitor last, so you can exclude all the harmless
processes the other tools are using.
17. Launch Process Monitor. If a Security Warning box pops up, allow the
software to run.
18. Agree to the license.
19. You see Process Monitor, with no visible events, as shown below.
20. The Process Monitor Filter box shows the events that are being excluded,
which is why the box is empty before the malware runs.
21. In Process Monitor, right-click the name of one of the visible processes,
such as explorer.exe, and click exclude 'explorer.exe'.
22. Repeat until there is no more process to see.
23. In the Process Monitor Filter box, click the OK button.
Running the Malware
24. In File Explorer, right-click key.exe and choose Run as Administrator.

Viewing the Running Malware in Process Explorer
25. In Process Explorer, find the flag covered in green.
Saving a screen image
26. Make sure the Process Explorer window showing the flag is visible.
27. Save the image with the filename Lab-Proj12a-YOURNAME.png. Use your
real name, not the literal text YOURNAME.
Viewing the Running Malware in Process Monitor
28. Go to ProcMon and scroll until you get to key.exe. You can view the steps
the malware is taking.
29. This malware creates an executable file in the Windows directory.
30. The malware also creates persistence by modifying the run registry key for
the current user HKCU = HKEY_CURRENT_USER. The programs
referenced in this key will be executed when the user logs in.
31. Find the path of that key and take note of it.
32. Use the following two filters to find:
Process Name is key.exe
Path contains vmx32to64
33.Find the flag covered in green.
34. Make sure the Process Monitor window showing the flag is visible.
35. Save the image with the filename Lab-Proj12b-YOURNAME.png. Use your
Testing out the keylogger
36. Open Notepad and type some text.

37. In File Explorer, go to the folder where key.exe is, find log.txt and open it.
You see some of the captured keystrokes, as shown below.
Persistence Mechanism
38. In Process Explorer, right click key.exe and choose Kill Process.
39. This stops the keylogger for the current session. However, the malware has
written itself into the registry, so it will start back up at the next reboot.
40. Restart the virtual machine.
41. Open Process Explorer, find and click the new keylogger file,
vmx32to64.exe.
42. From the Process Explorer menu bar, click View > Show Lower Pane
View > Lower Pane View > Handles.
43. The flag is covered by a green box in the image below.
44. Make sure the Process Explorer window showing the flag is visible.
45. Save the image with the filename Lab-Proj12c-YOURNAME.png. Use your
Removing persistence
46. Open Registry Editor.

47. Navigate to the following path: HKEY_CURRENT_USER\SOFTWARE\
Microsoft\Windows\CurrentVersion\Run
48. The flag is covered in green.

49. Right-click vm32to64, and select Delete.
50. Make sure the Registry Editor window showing the flag is visible.
51. Save the image with the filename Lab-Proj12d-YOURNAME.png. Use your
Examining another sample
52. Download this sample and unzip it with the password malware.
key12
53. Use the same dynamic analysis tools to monitor the behavior of this sample.
Find the Registry action shown below. The flag is covered in green.
54. Make sure the Process Monitor window showing the flag is visible.
55. Save the image with the filename Lab-Proj12e-YOURNAME.png. Use your
DNS Traffic of key12
56. In Wireshark, type in the filter bar: frame contains samsclass.
57. Find the flag covered in green.

58. Make sure the Wireshark window showing the flag is visible.
59. Save the image with the filename Lab-Proj12f-YOURNAME.png. Use your
HTTP Traffic of key13
60. Download this sample and unzip it with the password malware.
key13
61. Examine the network traffic generated by the key13.exe sample.
62. Find the key in the HTTP traffic, as shown below.
63. In Wireshark, type in the filter bar: http.request.method eq GET and
frame contains flag.
64. Make sure the Wireshark window showing the flag is visible.
65. Save the image with the filename Lab-Proj12g-YOURNAME.png. Use your
Turning in your Project
66. Submit the images, you save in the steps Saving a Screen Image,
to: cms with a subject line of Lab-Proj12-YOURNAME, replacing
YOURNAME with your real name.

Lab Proj 12 - Basic Dynamic Analysis

Uploaded by

Copyright:

Available Formats

Lab Proj 12 - Basic Dynamic Analysis

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab Proj 12 - Basic Dynamic Analysis

Uploaded by

Copyright:

Available Formats

Lab-Project 12: Basic Dynamic Analysis

What You Need for This Project

1. Practicing basic dynamic analysis techniques.

Downloading the sample

2. Download the sample from key.7z. (Pass: malware)

4. Open key.exe in PEview.

9. Scroll up and find the key definitions, including #SHIFT# and

Running Process Explorer

Running the Malware

24. In File Explorer, right-click key.exe and choose Run as Administrator.

25. In Process Explorer, find the flag covered in green.

Saving a screen image

Viewing the Running Malware in Process Monitor

33.Find the flag covered in green.

Saving a screen image

Testing out the keylogger

36. Open Notepad and type some text.

46. Open Registry Editor.

48. The flag is covered in green.

Examining another sample

Saving a screen image

DNS Traffic of key12

56. In Wireshark, type in the filter bar: frame contains samsclass.

57. Find the flag covered in green.

HTTP Traffic of key13

Saving a screen image

Turning in your Project

You might also like