Incident Response

& Digital Forensics

JAMES ESPINOSA

Agenda
Host Forensics
Prefetch Analysis
ShimCache Analysis
Windows Persistence

Network Forensics
Lab: Network Traffic Analysis

Log Analysis
Lab: Log Forensic Analysis

Malware Triage
Static Analysis
Dynamic Analysis

Drag picture to placeholder or click icon to add

Host Forensics
Hunt for malware through host-based artifacts

Prefetch Analysis
Examination of prefetch files may help identify:

When a binary was executed

Where a binary was executed from
The number of times the binary was executed
Any DLLs that were loaded by the binary

Located in the C:\Windows\Prefetch directory

Prefetch files: *.pf
Superfetch files: Ag*.db

Disabled on Windows Servers by default

Enable: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\PrefetchParameters
EnablePrefetcher: DWORD:0x00000003
EnableSuperfetch: DWORD:0x00000003

Prefetch vs. Superfetch

Figure 1: Microsoft Windows 7 Professional

Figure 2: Microsoft Windows XP Professional

Analysis Approach
Sort entries by Date Created
Search for suspicious binaries
The hash in the filename is a hash
of the path of execution
Multiple entries with different
hashes indicates execution from
different paths
C:\WINDOWS\1.exe
C:\WINDOWS\addins\1.exe

Figure 1: Prefetch entries sorted by Date Created

Parsing Prefetch Files

Figure 1: Parsed prefetch file using prefetch_info.exe

ShimCache Analysis
Created to track compatibility issues with executed programs
Entries are created as a result of an activity, such as browsing a directory
Does not necessarily indicate that a binary was executed
Timestamps do not indicate the time and date of binary execution
Except when an attacker uses the PsExec utility
The timestamp for PSEXESVC will reflect when the binary above it executed

The cache contains the following information:

Full path of the binary

The file size of the binary
Last modified timestamp
Last updated timestamp
Process execution flag

Analysis Approach
In this example, C:\WINDOWS\addins\svchost.exe is a suspicious binary
The binary was likely executed using the PsExec utility on 03/01/15 at 12:01:42
Search for suspicious filenames in suspicious paths
Pivot on this data to conduct additional analysis and scope out other hosts
Last
Modified

Last
Update

Path

File
Size

Exec.
Flag

01/02/15
01:03:53

N/A

C:\WINDOWS\System32\cmd.exe

743217

N/A

03/15/12
05:21:41

N/A

C:\Program Files\Norton AntiVirus\nav.exe

58192

N/A

02/12/13
11:23:15

N/A

C:\WINDOWS\addins\svchost.exe

43939

N/A

Figure 1: Parsed ShimCache data exported to a CSV file

03/01/15
12:01:42

N/A

C:\WINNT\PSEXESVC.EXE

53248

N/A

11/12/13

N/A

C:\Program Files\Internet

87234

N/A

Parsing the ShimCache

The data structure is serialized to the Windows Registry in the following
locations:
HKLM\SYSTEM\
\CurrentControlSet\Control\Session
Manager\AppCompatibility\AppCompatCache
\CurrentControlSet\Control\Session
Manager\AppCompatCache\AppCompatCache

Figure 1: Serialized data structure in the Windows Registry

Parsing the ShimCache, Contd.

Figure 1: ShimCacheParser.py to parse local Windows Registry hive

Analyzing the ShimCache

Output
These files can be lengthy depending on the usage of the system
Export results to a CSV file for analysis
Leverage the power of egrep and regular expressions to hunt for malware
Example: egrep -i C:\\Temp\\\w+\.\w{2,4}\, output.csv | more

Figure 1: Export ShimCacheParser results to CSV for analysis

Hunting for Malware

Search for common malicious extensions:
egrep -i \.(bat|scr|rar|7z|jar|js|part|tmp|swf|ps1|job) appcompat.csv

Search for suspicious binaries in the following locations:

C:\
C:\hp\
C:\wmpub\
C:\Temp\
C:\Windows\
C:\Windows\Temp\
C:\Windows\Debug\
C:\Windows\Addins\
C:\Windows\System32\
C:\Windows\SysWow64\
C:\Windows\Prefetch\
\AppData\Local\Temp\
\AppData\Roaming\

Hunting for Malware, Contd.

Search for binaries with single digit filenames (i.e. 1.exe)
Use a large collection of known malicious filenames as a blacklist
Might generate a lot of false-positives
Quick wins if the filenames are unique enough

This process is time consuming but very effective in identifying malware

Findings can be used to pivot from and hunt for additional artifacts on other
hosts
Stacking this data across several hosts can help weed out malicious binaries
If 90% of the hosts have specific binaries, they are likely good
If only a couple of hosts have a specific binary, its likely malicious or worth
investigating

Windows Persistence
Windows Services
Windows Task Scheduler
Windows Registry

Run
Userinit
AppInit DLLs
Installed Components
Startup Folder
Active Setup

DLL Search Order Hijacking

Windows Services
Services are a very common way for malware to persist on a host
Use tools like Process Hacker to receive notifications of newly installed services
Windows Services provide the following information:

Service Name
Display Name
Description
Path to Executable
Startup Type
Service Status

Windows Services can also be analyzed via:

services.msc
HKLM\SYSTEM\CurrentControlSet\Services\servicename

Analyzing Windows Services

Identify malicious Windows Services:
Suspicious filenames
Empty service descriptions
Suspicious file executable paths

Meterpreter persistence script uses cscript.exe to execute the VBS script

Figure 1: Meterpreter persistence script as a Windows Service

Analyzing Windows Services,

Contd.
By default, a host that has a Meterpreter persistence script running will have
the following:
C:\WINDOWS\system32\cscript.exe will be running on the system
A suspicious looking binary will execute as a child process of cscript.exe

There will be a number of suspicious entries in the Windows Prefetch

directory
The binary description is typically ApacheBench command line utility
A solution is to disable Windows Script Host from the Windows Registry

Figure 1: Suspicious Meterpreter persistence script running via cscript.exe

Disable Windows Script Host

May cause problems with programs that rely on it, but highly unlikely
It will help prevent Meterpreter persistence from persisting across reboots
HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings
Create a new DWORD value
Name it Enabled
Set the value to 0x00000000 (0)

Figure 1: Error received upon execution of cscript.exe or wscript.exe

Meterpreter Artifacts

Figure 2: Suspicious 3.exe, cscript.exe, and wqxnsqgkc.exe in prefetc

Figure 1: Meterpreter persistence script default startup location

Windows Task Scheduler

Scheduled tasks (or AT.exe jobs) are another popular persistence mechanism
for malware
Tasks are stored in the C:\WINDOWS\Tasks directory
They may be stored on disk with a .job file extension
Stored in a binary file format that requires parsing using 3 rd party tools
Identify potentially malicious scheduled tasks:
Unnamed tasks are the most suspect (i.e. At1.job)
Oddly and suspiciously named tasks should also be analyzed

Attackers typically use the at command to schedule tasks over the network
Creates an At#.job file in the C:\WINDOWS\Tasks directory

Using the AT Command

Figure 1: Example of a scheduled AT job using the Command Prompt

Example AT Job Created

As a reminder, tasks scheduled using the AT command will create an At#.job file
The following log file will tell you what tasks have executed on the system:
C:\WINDOWS\SchedLgU.txt
C:\WINDOWS\Tasks\SchedLgU.txt

Figure 1: Example of a scheduled AT job in the Tasks directory

Example of SchedLgU.txt

Figure 1: Example of the SchedLgU.txt log file on a Windows XP system

Parsing AT Job Files

Windows Registry
We can spend hours talking about all of the different persistence points
Were not going to do that, instead, Ill provide a few useful links
Well talk about useful tools to help identify persistent binaries in the registry

Microsoft Windows Sysinternals Suite

Autoruns provides the best snapshot of items starting up on your system

Process Hacker
Windows processes
Windows Services
Network Communications

Hunting with Autoruns

Process Hacker in Action

Most Popular Startup Locations

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

StubPath

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Windows\AppInit_DLLs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

DLL Search Order Hijacking

Load malware by exploiting the Windows DLL search order
Windows searches in the following order:

Current directory where application is launched from

System directory, C:\WINDOWS\System32\
System directory (16-bit), C:\WINDOWS\System\
The Windows directory, C:\WINDOWS
The current working directory
Directories listed in the PATH system variable

A likely candidate is the Explorer.exe process

Attempts to load the C:\WINDOWS\System32\ntshrui.dll file
Hijack opportunities exist by placing a malicious C:\WINDOWS\ntshrui.dll file

Find Hijackable Locations

Figure 1: Open-source finddllhijack utility to identify hijackable locations

Drag picture to placeholder or click icon to add

Network Forensics
Identify malicious network traffic and anomalous activity

Command & Control (C2)

A centralized server that issues commands to compromised hosts
There has to be some sort of network communication with the remote server
Provides an opportunity for detection

Popular C2 communication options:

Internet Relay Chat (IRC)
Domain Name System (DNS)
Legitimate websites

Its common to see keep-alive packets traversing the network

These are also known as beacons
Detect and disrupt the C2 from receiving beacons and the hosts cant communicate

Analyzing Network Traffic

You need tools to aid with analysis

Bro
Tcpdump
WireShark
Network Miner
Suricata/Snort

Network traffic statistics can help provide some useful data

Protocol Hierarchy
Conversations
Endpoints
I/O Graph

Analysis Approach
Whats your goal? If its to identify malicious activity, then I do the following:
Update IDS signatures with the latest set (i.e. Emerging Threats)
Run the PCAP through Suricata or Snort and analyze alerts

Manual analysis approach

Run Bro to collect a number of useful logs

Analyze the conn.log for suspicious IP addresses
Analyze the files.log for carving files that were downloaded
Analyze the http.log for malicious HTTP requests

Statistical analysis approach

Drop the PCAP in WireShark to perform a manual and statistical analysis
Use the I/O Graph to identify network spikes that may indicate scanning, data
exfiltration, etc.
Use the Protocol Hierarchy to visualize the type of traffic that was observed on
the wire

PCAP Analysis Exercise

At minimum, WireShark is required for analysis
I would also recommend using Bro for network traffic analysis
If you dont have it, you can download the logs from here:
http://bit.ly/1M6Ue4m

Download the exercise PCAP from:

http://malware-traffic-analysis.net/2015/03/31/index.html

The task is to identify an activity from the network traffic

Does anything look suspicious?
What do you think happened?
Can you gather any network-based indicators to identify the traffic or activity?

Drag picture to placeholder or click icon to add

Log Analysis
Reconstruct an activity timeline through event correlation

Log Forensic Analysis

Painful and time consuming
Every log file may help reconstruct a timeline and tell a story
Its like solving a puzzle
Pivot across multiple logs, times, dates, etc.

Start with your initial leads

Do you have a known malicious IP address?
Do you have a sample of a piece of malware?
Do you have an approximate timeline?

Types of logs vary by operating system and applications

/var/log/message: General message and system related logs
/var/log/auth.log: Authentication logs
/var/log/kern.log: Kernel logs

Log Analysis Exercise

Challenge downloaded from The Honeynet Project
Use your favorite text editor, grep, strings, and any other utility that you want
Find out what happened to a virtual server using the logs from a possibly compromised server
You can download the logs from the following link:
http://bit.ly/1W62bl7

The challenge is to answer the following questions:

Was the system compromised and when? How do you know for sure?
If it was compromised, what was the method used?
Were there more than one attacker involved? Did they all succeed or fail?
What type of attack was performed?
What is the timeline of significant events?
What do you think happened?
What would you have done to avoid this type of attack?

Drag picture to placeholder or click icon to add

Malware Triage
Identify malware through binary static and dynamic analysis

Basic Malware Triage

Determine if a suspected binary is malicious or not
The two common methods are:
Static analysis
Dynamic analysis

In static analysis, you dont execute the binary

Focus on the file properties (hash, strings, compile timestamps, imports, exports,
etc.)

In dynamic analysis, you focus on behaviour

Files created, deleted, modified
Network traffic that was generated
Other interactions with the operating system

Static Analysis
Scan the suspected binary with an Anti-Virus scanner
Hash the binary and search a database like VirusTotal to see if it was
previously identified
Find strings in the binary that may help provide clues about what it does
Packed and obfuscated binaries defeat this method of analysis
Identify imports and exports to get a feel for its functionality and capabilities
Advanced static analysis involves using a disassembler like IDA Pro
Requires x86/x64 assembly knowledge
Ability to recognize code constructs in assembly
Programming and operating system internals experience

Statically Analyzing a Sample

Hash the binary and search for it online

md5 sample.exe
MD5 (sample.exe) = 4c754150639aa3a86ca4d6b6342820be
Detection ratio is 49/56 scanners identified it as malicious
There are several different results, all which mostly vary in name

Run strings against the binary and identify anything that appears interesting

Software\Microsoft\Windows\CurrentVersion\Run
Alina v
dwm.exe, win-firewall.exe, adobeflash.exe, desktop.exe, java.exe
firefox.exe, chrome.exe, steam.exe, skype.exe, dllhost.exe, lsass.exe
Accept: application/octet-stream
Content-Type: application/octet-stream
Connection: close
POST, HTTP/1.1

Statically Analyzing a Sample,

Contd.
/adobe/version_check.php
91.229.76.97
dlex=, update=, chk=, log=0, log=1
cardinterval=, updateinterval=, diag, update
\\.pipe\alina
C:\Users\dice\Desktop\SRC_adobe\src\grab\Release\Alina.pdb
Process32Next, OpenProcess, GetCurrentProcessId, Process32First
CreateToolhelp32Snapshot, GetComputerNameA, CreateProcessA
CopyFileA, Sleep, TerminateProcess, DeleteFileA, CreateFileA
RegSetValueExA, RegCloseKey, RegOpenKeyExA, HttpOpenRequestA

PEview for Static Analysis

Quickly view the structure and content of a Portable Executable (PE) file
Take note of the compile timestamp from the binary
Analyze the Import Address Table of the binary
Analyze the IMAGE_DEBUG_TYPE_CODEVIEW data
May contain a program database (PDB) string
Can be used for identifying and classifying malware families

Analyze each of the different PE sections

.text
.rdata
.data
.rsrc
.reloc

PEview for Static Analysis,

Contd.

Common DLL Usage

Kernel32.dll Contains core functionality, such as files, memory, and
hardware
Advapi32.dll Provides access to advanced core components, like services
and the registry
User32.dll Provides user-interface components
Gdi32.dll Provides functionality for displaying and rendering graphics
Ws2_32.dll Provides networking related functionality
Wininet.dll Provides higher-level networking functions (FTP, HTTP, NTP,
etc.)

Dynamic Analysis
Interact with the binary to understand how it behaves in an isolated
environment
Capture network traffic and analyze any requests that are made
DNS
HTTP

Take a snapshot of the Windows Registry before running the sample and
after
Diff the results after execution
Analyze the registry keys and files that were created

Monitor the processes with the Process Hacker program

Use the Procmon utility to gather verbose data about the execution of the binary

A quick alternative would be to run a sandbox like Cuckoo for analysis

Isolate the Environment

I prefer a virtual Windows XP or Windows 7
Set networking to Host Only in VMware
This will prevent the malware from communicating with the Internet

Disable sharing files between your host operating system and the virtual
environment
Ransomware can encrypt shares
Your data could be corrupted, deleted, or infected

Create a clean snapshot of your virtual machine before infecting it

Load all of the necessary tools for analyzing malware in the virtual machine

WireShark
RegShot
FakeNet
Process Hacker

Dynamic Analysis Approach

Run WireShark and capture network traffic
Run FakeNet to create fake services and log the results
Create a snapshot of the registry using RegShot
Run Process Hacker to observe process activity on the system
Execute the malware in your environment
Observe Process Hacker and FakeNet network activity
Give it some time to do some damage

Create a second snapshot of the registry using RegShot

Compare the results using the report
You should be able to identify changes to the system