Extracting ZeroAccess from NTFS Extended Attributes using PowerForensics

Introduction 

This post explains how to use PowerForensics (https://github.com/Invoke-IR/PowerForensics) to extract ZeroAccess infected system's NTFS extended attributes content. ZeroAccess used NTFS extended attributes to maintain persistent mechanism on infected system.

"If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A subroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper.
A large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes are a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be stored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the PE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes it. The shellcode then loads and executes the embedded PE file. This file is a DLL that has equivalent functionality to the main component, so the services.exe modifications provide a backup means for the bot to function if the two main components are discovered and removed."

Source: http://journeyintoir.blogspot.in/2012/12/extracting-zeroaccess-from-ntfs.html

Tools

1. PowerForensics - PowerForensics provides an all in one platform for live disk forensic analysis (https://github.com/Invoke-IR/PowerForensics) 
2. analyzeMFT (https://github.com/dkovar/analyzeMFT) 
3.  Hex Editor 

Disclaimer    

• You are dealing with real malware samples
• Don’t expose them to internal networks or internet
• Analyze them in a controlled environments (sandboxes)
• We are not responsible for any consequences of damage if you fail to obey the rules
  

 Analysis 

A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot.  The below mentioned ZeroAccess variant is going to be run on windows 7 sandbox.

Hash 
MD5 : c6e73a75284507a41da8bef0db342400

The $MFT file can be parsed using two methods to observe for any extended attributes. The first method is offline $MFT file analysis using analyzeMFT.py which is an intelligent way to check for any type of interested attribute. It's always recommended to parse and analyze MFT entry attributes 

 
Extracting  $MFT  using Get-ForensicFileRecord

Get-ForensicChildItem lists all files including protected files and file system metadata files. Observe that $MFT itself is having an entry in $MFT file  with record number 0. 

Offline $MFT Analysis: Parsing $MFT before infecting ZeroAccess. The tool analyzeMFT.py is used to parse offline $MFT file

A quick filter on $EA attribute shows services.exe is not associated with any extended attribute content

A quick look at the MFT  record of services.exe shows that it does not have any additional data streams (apart from legitimate $DATA attribute) like Alternate Data Streams (ADS-an extra $DATA attribute) and Extended Attributes (EA & EA_INFORMATION)

PowerForensics cmdlet  Get-ForensicFileRecord shows the below output where no extended attribute was observed

The live analysis of $MFT on windows 7 prior to infection shows no extended attributes

Once the ZeroAcess  specimen is executed, it disguised as AdobeFlash player and was asked to accept installation of Adobe flash player

Let's check for any extended attributes in services.ex. The below output shows that record number of services.exe has been changed

The Extended attribute was also observed in patched services.exe

To extract EA attribute content, the data run of the attribute is used to find the clusters allocated on volume

 Get-ForensicVolumeBootRecord 

Invoke-ForensicDD to extract the content
Invoke-ForensicDD -InFile \\.\C: -OutFile C:\demo\ze_extended_attribute -Offset ($dr[0].StartCluster*$vbr.BytesPerCluster) -BlockSize ($dr[0].ClusterLength*$vbr.BytesPerCluster) -Count 1 

The extracted file was extracted in C:\demo folder. View the contents of extracted file

The shellcode was observed at the beginning of the file followed by a traditional MZ header and modern PE header 

The extracted file is opened in hexeditor to trim the shellcode content and save the file with MZ header at offset 0. The hash values of both files are submitted to virustotal.com.

Malware initial assessment using pestudio https://www.winitor.com/

Offline $MFT analysis using analyzeMFT.py after infection shows extended attributes of other files including services.exe

In the End ... 
Further analysis needs to be done on extracted content from NTFS extended attributes ($EA & $EA_INFORMATION). PowerForensics is  going to be more efficient while performing a live response or offline forensic analysis of images

Thanks to 
 PowerForensics - https://github.com/Invoke-IR/PowerForensics - @jaredcatkinson