Downloaded 166 times
Uploaded bySam Bowne
CNIT 126 7: Analyzing Malicious Windows Programs
Chapter 7 of 'Practical Malware Analysis' discusses the Windows API, its structure, and functions related to malicious software analysis. It covers topics such as handles, file system functions, the Windows registry, and how malware utilizes threading and services for persistence. Additionally, it explores the differentiation between user mode and kernel mode, as well as the native API used by malware authors to interact stealthily with the system.
More Related Content
Similar to CNIT 126 7: Analyzing Malicious Windows Programs
CNIT 126 7: Analyzing Malicious Windows Programs
- 1. Practical Malware Analysis Ch7: Analyzing Malicious Windows Programs Rev. 2-27-17
- 2. The Windows API (ApplicationProgramming Interface)
- 3. What is theAPI? • Governs how programs interact with Microsoft libraries • Concepts – Types and Hungarian Notation – Handles – File System Functions – Special Files
- 4. Types and HungarianNotation • Windows API has its own names to represent C data types – Such as DWORD for 32-bit unsigned integers and WORD for 16-bit unsigned integers • Hungarian Notation – Variables that contain a 32-bit unsigned integer start with the prefix dw
- 5. Common API Types Type(Prefix) Meaning WORD (w) 16-bit unsigned value DWORD (dw) 32-bit unsigned value Handle (H) A reference to an object Long Pointer (LP) Points to another type
- 6. Handles • Items openedor created in the OS, like – Window, process, menu, file, ... • Handles are like pointers to those objects – They not pointers, however • The only thing you can do with a handle is store it and use it in a later function call to refer to the same object
- 7. Handle Example • TheCreateWindowEx function returns an HWND, a handle to the window • To do anything to that window (such as DestroyWindow), use that handle
- 8. File System Functions •CreateFile, ReadFile, WriteFile – Normal file input/output • CreateFileMapping, MapViewOfFile – Used by malware, loads file into RAM – Can be used to execute a file without using the Windows loader
- 9. Special Files • Sharedfiles like servershare – Or ?servershare • Disables string parsing, allows longer filenames • Namespaces – Special folders in the Windows file system Lowest namespace, contains everything .Device namespace used for direct disk input/output Witty worm wrote to .PhysicalDisk1 to corrupt the disk Link Ch 7a
- 10. Special Files • AlternateData Streams – Second stream of data attached to a filename – File.txt:otherfile.txt
- 11.
- 12. Registry Purpose • Storeoperating system and program configuration settings – Desktop background, mouse preferences, etc. • Malware uses the registry for persistence – Making malware re-start when the system reboots
- 13. Registry Terms • Rootkeys These 5 • Subkey A folder within a folder • Key A folder; can contain folders or values • Value entry Two parts: name and data • Value or Data The data stored in a registry entry • REGEDIT Tool to view/edit the Registry
- 14.
- 15. Run Key • HKLMSOFTWAREMicrosoftWindowsCurrentVersion Run –Executables that start when a user logs on
- 16. Autoruns • Sysinternals tool •Lists code that will run automatically when system starts – Executables – DLLs loaded into IE and other programs – Drivers loaded into Kernel – It checks 25 to 30 registry locations – Won't necessarily find all automatically running code • Link Ch 7b
- 17.
- 18. Common Registry Functions •RegOpenKeyEx – Opens a registry key for editing and querying • RegSetValueEx – Adds a new value to the registry & sets its data • RegGetValue – Returns the data for a value entry in the Registry • Note: Documentation will omit the trailing W (wide) or A (ASCII) character in a call like RegOpenKeyExW
- 19. Ex, A, andW Suffixes • From Ch 2
- 21.
- 22.
- 23.
- 24.
- 25. Berkeley Compatible Sockets •Winsock libraries, primarily in ws2_32.dll – Almost identical in Windows and Unix – Berkeley compatible sockets
- 27. Server and ClientSides • Server side – Maintains an open socket waiting for connections – Calls, in order, socket, bind, listen, accept – Then send and recv as necessary • Client side – Connects to a waiting socket – Calls, in order, socket, connect – Then send and recv as necessary
- 28.
- 29. The WinINet API •Higher-level API than Winsock • Functions in Wininet.dll • Implements Application-layer protocols like HTTP and FTP • InternetOpen – connects to Internet • InternetOpenURL –connects to a URL • InternetReadFile –reads data from a downloaded file
- 30.
- 31. Transferring Execution • jmpand call transfer execution to another part of code, but there are other ways – DLLs – Processes – Threads – Mutexes – Services – Component Object Model (COM) – Exceptions
- 32. DLLs (Dynamic LinkLibraries) • Share code among multiple applications • DLLs export code that can be used by other applications • Static libraries were used before DLLs – They still exist, but are much less common – They cannot share memory among running processes – Static libraries use more RAM than DLLs
- 33. DLL Advantages • UsingDLLs already included in Windows makes code smaller • Software companies can also make custom DLLs – Distribute DLLs along with EXEs
- 34. How Malware AuthorsUse DLLs • Store malicious code in DLL – Sometimes load malicious DLL into another process • Using Windows DLLs – Nearly all malware uses basic Windows DLLS • Using third-party DLLs – Use Firefox DLL to connect to a server, instead of Windows API
- 35. Basic DLL Structure •DLLs are very similar to EXEs • PE file format • A single flag indicates that it's a DLL instead of an EXE • DLLs have more exports & fewer imports • DllMain is the main function, not exported, but specified as the entry point in the PE Header – Called when a function loads or unloads the library
- 36. Processes • Every programbeing executed by Windows is a process • Each process has its own resources – Handles, memory • Each process has one or more threads • Older malware ran as an independent process • Newer malware executes its code as part of another process
- 37. Many Processes Runat Once
- 38. Memory Management • Eachprocess uses resources, like CPU, file system, and memory • OS allocates memory to each process • Two processes accessing the same memory address actually access different locations in RAM – Virtual address space (link Ch 7c)
- 39. Creating a NewProcess • CreateProcess – Can create a simple remote shell with one function call – STARTUPINFO parameter contains handles for standard input, standard output, and standard error streams • Can be set to a socket, creating a remote shell
- 40. Code to Createa Shell • Loads socket handle, StdError, StdOutput and StdInput into lpProcessInformation
- 41. • CommandLine containsthe command line • It's executed when CreateProcess is called
- 42. Threads • Processes arecontainers – Each process contains one or more threads • Threads are what Windows actually executes • Threads – Independent sequences of instructions – Executed by CPU without waiting for other threads – Threads within a process share the same memory space – Each thread has its own registers and stack
- 43. Thread Context • Whena thread is running, it has complete control of the CPU • Other threads cannot affect the state of the CPU • When a thread changes a register, it does not affect any other threads • When the OS switches to another thread, it saves all CPU values in a structure called the thread context
- 44. Creating a Thread •CreateThread – Caller specified a start address, also called a start function
- 45. How Malware UsesThreads • Use CreateThread to load a malicious DLL into a process • Create two threads, for input and output – Used to communicate with a running application
- 46. Interprocess Coordination withMutexes • Mutexes are global objects that coordinate multiple processes and threads • In the kernel, they are called mutants • Mutexes often use hard-coded names which can be used to identify malware
- 47. Functions for Mutexes •WaitForSingleObject – Gives a thread access to the mutex – Any subsequent threads attempting to gain access to it must wait • ReleaseMutex – Called when a thread is done using the mutex • CreateMutex • OpenMutex – Gets a handle to another process's mutex
- 48. Making Sure OnlyOne Copy of Malware is Running • OpenMutex checks if HGL345 exists • If not, it is created with CreateMutex • test eax, eax sets Z flag if eax is zero (link Ch 7d)
- 49. Services • Services runin the background without user input
- 50. SYSTEM Account • Servicesoften run as SYSTEM which is even more powerful than the Administrator • Services can run automatically when Windows starts – An easy way for malware to maintain persistence – Persistent malware survives a restart
- 51. Service API Functions •OpenSCManager – Returns a handle to the Service Control Manager • CreateService – Adds a new service to the Service Control Manager – Can specify whether the service will start automatically at boot time • StartService – Only used if the service is set to start manually
- 52. Svchost.exe • WIN32_SHARE_PROCESS – Mostcommon type of service used by malware – Stores code for service in a DLL – Combines several services into a single shared process named svchost.exe
- 53. Svchost.exe in ProcessExplorer
- 54. Other Common ServiceTypes • WIN32_OWN_PROCESS – Runs as an EXE in an independent process • KERNEL_DRIVER – Used to load code into the Kernel
- 55. Service Information inthe Registry • HKLMSystemCurrentControlSetServices – Start value = 0x03 for "Load on Demand" – Type = 0x20 for WIN32_SHARE_PROCESS • Link Ch 7e
- 56. SC Command • Includedin Windows • Gives information about Services
- 57. Component Object Model(COM) • Allows different software components to share code • Every thread that uses COM must call OleInitialize or CoInitializeEx before calling other COM libraries
- 58. GUIDs, CLSIDs, IIDs •COM objects are accessed via Globally Unique Identifiers (GUIDs) • There are several types of GUIDs, including – Class Identifiers (CLSIDs) • in Registry at HKEY_CLASSES_ROOTCLSID – Interface Identifiers (IIDs) • in Registry at HKEY_CLASSES_ROOTInterface • Link Ch 7f
- 59. Exceptions • Exceptions arecaused by errors, such as division by zero or invalid memory access • When an exception occurs, execution transfers to the Structured Exception Handler
- 60. fs:0 Stores ExceptionLocation • FS is one of six Segment Registers • Link Ch 7g-i
- 61. Kernel v. UserMode
- 62. Two Privilege Levels •Ring 0: Kernel Mode • Ring 3: User mode • Rings 1 and 2 are not used by Windows – Link Ch 7j
- 63. User Mode • Nearlyall code runs in user mode – Except OS and hardware drivers, which run in kernel mode • User mode cannot access hardware directly • Restricted to a subset of CPU instructions • Can only manipulate hardware through the Windows API
- 64. User Mode Processes •Each process has its own memory, security permissions, and resources • If a user-mode program executes an invalid instruction and crashes, Windows can reclaim the resources and terminate the program
- 65. Calling the Kernel •It's not possible to jump directly from user mode to the kernel • SYSENTER, SYSCALL, or INT 0x2E instructions use lookup tables to locate predefined functions
- 66. Kernel Processes • Allkernel processes share resources and memory addresses • Fewer security checks • If kernel code executes an invalid instruction, the OS crashes with the Blue Screen of Death • Antivirus software and firewalls run in Kernel mode
- 67. Malware in KernelMode • More powerful than user-mode malware • Auditing doesn't apply to kernel • Almost all rootkits use kernel code • Most malware does not use kernel mode
- 68.
- 69. The Native API •Lower-level interface for interacting with Windows • Rarely used by non-malicious programs • Popular among malware writers
- 70. • Ntdll.dll manages interactions between user spaceand the kernel • Ntdll functions make up the Native API
- 71. The Native API •Undocumented • Intended for internal Windows use • Can be used by programs • Native API calls can be more powerful and stealthier than Windows API calls
- 73. Popular Native APICalls in Malware • NTtQuerySystemInformation • NTtQueryInformationProcess • NTtQueryInformationThread • NTtQueryInformationFile • NTtQueryInformationKey – Provide much more information than any available Win32 calls
- 74. Popular Native APICalls in Malware • NtContinue – Returns from an exception – Can be used to transfer execution in complicated ways – Used to confuse analysts and make a program more difficult to debug