Extracting ZeroAccess from NTFS Extended Attributes using PowerForensics
This post explains how to use PowerForensics (https://github.com/Invoke-IR/PowerForensics) to extract ZeroAccess infected system's NTFS extended attributes content. ZeroAccess used NTFS extended attributes to maintain persistent mechanism on infected system.
"If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A subroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper.
A large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes are a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be stored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the PE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes it. The shellcode then loads and executes the embedded PE file. This file is a DLL that has equivalent functionality to the main component, so the services.exe modifications provide a backup means for the bot to function if the two main components are discovered and removed."
- PowerForensics - PowerForensics provides an all in one platform for live disk forensic analysis (https://github.com/Invoke-IR/PowerForensics)
- analyzeMFT (https://github.com/dkovar/analyzeMFT)
- Hex Editor
- You are dealing with real malware samples
- Don’t expose them to internal networks or internet
- Analyze them in a controlled environments (sandboxes)
- We are not responsible for any consequences of damage if you fail to obey the rules
A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot. The below mentioned ZeroAccess variant is going to be run on windows 7 sandbox.
MD5 : c6e73a75284507a41da8bef0db342400
The $MFT file can be parsed using two methods to observe for any extended attributes. The first method is offline $MFT file analysis using analyzeMFT.py which is an intelligent way to check for any type of interested attribute. It's always recommended to parse and analyze MFT entry attributes
Extracting $MFT using Get-ForensicFileRecord
A quick look at the MFT record of services.exe shows that it does not have any additional data streams (apart from legitimate $DATA attribute) like Alternate Data Streams (ADS-an extra $DATA attribute) and Extended Attributes (EA & EA_INFORMATION)
PowerForensics cmdlet Get-ForensicFileRecord shows the below output where no extended attribute was observed
Invoke-ForensicDD -InFile \\.\C: -OutFile C:\demo\ze_extended_attribute -Offset ($dr.StartCluster*$vbr.BytesPerCluster) -BlockSize ($dr.ClusterLength*$vbr.BytesPerCluster) -Count 1
The extracted file was extracted in C:\demo folder. View the contents of extracted file
The shellcode was observed at the beginning of the file followed by a traditional MZ header and modern PE header
Offline $MFT analysis using analyzeMFT.py after infection shows extended attributes of other files including services.exe
Further analysis needs to be done on extracted content from NTFS extended attributes ($EA & $EA_INFORMATION). PowerForensics is going to be more efficient while performing a live response or offline forensic analysis of images
PowerForensics - https://github.com/Invoke-IR/PowerForensics - @jaredcatkinson