December 14, 2022
Advent of Cyber 2022 : [Day 12 Walkthrough]
[Day 12] Malware Analysis Forensic McBlue to the REVscue!
By Muhammad Abdullah Niazi
3 min read
- 1 Analyzing Malware Samples
- – Q#1: What is the architecture of the malware sample? (32-bit/64-bit)
- – 2: What is the packer used in the malware sample? (format: lowercase)
- – Q#3: What is the compiler used to build the malware sample? (format: lowercase)
- – Q#4: How many MITRE ATT&CK techniques have been discovered attributed to the DISCOVERY tactic?
Day 12 covers the concept of Malware Behaviours and how to Analyze Malware Samples.
Learning Objectives
- Learn the fundamentals of analyzing malware samples without relying on automated sandbox scanners.
- Learn and understand typical malware behavior and its importance in the incident investigation pipeline
Analyzing Malware Samples
Malware is software created to harm a computer or an entire network. Threat actors develop malware to achieve specific goals, such as infiltrating networks, breaching sensitive data, or disrupting operational services.
Static Analysis_ is a way of analyzing a malware sample without executing the code. This method mainly focuses on profiling the binary with its readable information, such as its properties, program flow, and strings. Given the limitation of not executing it, sometimes this method gives insufficient information, which is why we resort to Dynamic Analysis. Meanwhile, Dynamic Analysis mainly focuses on understanding the malware by executing it in a safe environment, such as a Sandbox. A sandbox is a controlled test environment that mimics a legitimate end-user working environment. It gives analysts a safe environment to execute malware samples and learn their behavior._
WALKTHROUGH
Q#1: What is the architecture of the malware sample? (32-bit/64-bit)
Let's Open the File with Detect It Easy ( DIE )
Hence it is a 64-bit Architecture!!!
Answer: 64-bitAnswer: 64-bit2: What is the packer used in the malware sample? (format: lowercase)
Analyze the Image Above Image!
Ans: upxAns: upxQ#3: What is the compiler used to build the malware sample? (format: lowercase)
Let's use capa to Analyse the file
Hint: capa -vv mysterygiftHint: capa -vv mysterygift
Answer: nimAnswer: nimQ#4: How many MITRE ATT&CK techniques have been discovered attributed to the DISCOVERY tactic?
Answer: 2Answer: 2Q#5: What is the registry key abused by the malware?
Add the Process name as mysterygift.exe and click Add
Change the File Extension into exe
Now notice the Process Monitor
You may observe that only one Registry Key has both RegCreateKey and RegSetValue. This key is related to a persistence technique called Registry Run Key Modification and is commonly used by malware developers to install a backdoor.
Answer: HKCU\Software\Microsoft\Windows\CurrentVersion\RunAnswer: HKCU\Software\Microsoft\Windows\CurrentVersion\RunQ#6: What is the value written on the registry key based on the previous question?
Answer: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wishes.batAnswer: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wishes.batQ#7: What are the names of two files created by the malware under the C:\Users\Administrator\ directory? (format: file1,file2 in alphabetical order)
Click on the Folder Filter at the top right in the Below Image, Include only the CreateFile Operation
Answer: test.jpg, wishes.batAnswer: test.jpg, wishes.batQ#8: What are the two domains wherein malware has initiated a network connection? (format: domain1,domain2 in alphabetical order)
Add the Below Filter and Search for the Domain
Here we can see, the 2 Domains in Network Activity are
Answer: bestfestivalcompany.thm, virustotal.comAnswer: bestfestivalcompany.thm, virustotal.comQ#9: Going back to strings inside the malware sample, what is the complete URL used to download the file hosted in the first domain accessed by the malware?
Use Detect It Easy to Find the Strings in the EXE
Answer: http://bestfestivalcompany.thm/favicon.icoAnswer: http://bestfestivalcompany.thm/favicon.icoIf you enjoyed malware analysis, try the Intro to Malware Analysis or Dissecting PE Headers rooms next!
Conclusion
We have covered several topics on this task about Malware Analysis. For a quick summary, we have learned the following:
- Key behaviors of malware aid in having an overview of what to expect in examining malware samples.
- The precautions needed to consider while handling malware samples and the importance of sandboxes.
- Conduct a Static Analysis and profile the nature of the binary without executing it.
- Perform a manual Dynamic Analysis and observe the interactions of the malware sample in the Registry, File System, and Network.
Congrats on finishing the 12th day! I hope you found the walkthrough and task exciting. For Day 13, click here.