null0x4d5a

This post is just about running a tool created by hasherezade  to perform process doppleganging. All credit goes to the researchers Tal Liberman   and Eugene Kogan from  enSilo and also  hasherezade I just wanted to simulate the same process doppleganging and detect with  pe-sieve , it is recommended to walk through author's blackhat presentation  Lost in transaction - Process Doppelgänging and tool creator's write up  Process Doppelgänging – a new way to impersonate a process Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected. The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollow...

Introduction  This post explains how to use PowerForensics ( https://github.com/Invoke-IR/PowerForensics ) to extract ZeroAccess infected system's NTFS extended attributes content. ZeroAccess used NTFS extended attributes to maintain persistent mechanism on infected system. "If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A subroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper. A large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes are a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be stored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the PE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes it. The shellcode then loads and e...