Bangeter 03-persistence_techniques_v40.pdf

Binary patching used to be called "virus"

Trojanized system binaries: add malicious code to executables or DLLs that are part of the OS, and which thus get loaded on system startup.

MBR patching: allows malware to start very early in the boot process, before anu security mechanism get loaded. (master boot record is modified to load malware) [new secure boot mechanisms allow BIOS to verify signature of boot loader]

• check hash of flies on system against DB of known good binaries
• Check signature of files

Sigcheck form sys internals is a tool to perform signature checks can also be used to perfome a Virustotal lookup for unknown files.

These can be modified.

• Logon items for users (e.g. Dropbox, Skype...)
• Services
• Scheduled tasks

hivelist: locates the virtual addresses of registry hives in memory and the full paths to the corresponding hive on disk.

• Autostart / malware persistence
• Data stored by malware in registry
• Partial information on programs executed and the files accessed
• Encrypted / obfuscated malware payloads

Aditional infromation

• user related information
• Hardware configs
• Credentials / passwords

Autoruns: this is a tool for inspecting autostart mechanisms on a live system

• Autoruns is a kind of refernce of Windows autostart mechanisms
• Unfortunately, autoruns does not work on memory images

printkey -K "key"

Displayes the subkeys, values, data and data types contained within a specified registry key.

Windows services are processes that are running independently of user logons etc.

They provide system functions for:

• System updates
• Printing
• Windows security
• Anti-Virus
• Etc...

Services can be abused by malware in the following ways:

• As persistance and launching mechanism, i.e. to get a malware process started or malware driver loaded into the kernel.
• Services can be switched of to prevent security mechanisms from starting / updating such as AV and system updates.
• Services can be manipulated and hidden by malware
  • E.g. by unlinking services from kernel lists

• Kernel drivers
• Standalone processes
• Shared services (where multiple services run in a single process.
  • Example: svchost.exe the shared services are loaded as DLLs into the svchost.exe process.

• sc query [command shell]
• psservice.exe [command shell, Sysinternals]
• Process Hacker
• Process Explorer
• Services.msc

svscan: scans services and walks the linked lis of services (within SCM / services.exe)

• Detects some unlinked / hidden services
• svccan allow us to identify services as such and reveals service specific information

Unlinking a service from the service list

• much like process and DLL unlinkin
• Tricks live tools
• Can still be found using svcscan

Malware can avoid SCM altogether, and use alternative techniques for launcing services

• No traces left in svcscan
• Additional traces are left in Windows event log and the registry
• Som of these can be tricked

tbd.