Malware analysis
The aim of the practical task is to get acquainted with different types of malware, their detection and hiding methods. The work is performed on Windows 7 VM operating system.
Chosen package: https://github.com/fabrimagic72/malware-samples
UVK – ultra virus killer
Process Manager – This window shows the processes running on the computer. The convenience is that you can choose “Hide critical processes”, which makes it easier to discover processes that can be harmful, or run by our own.
This window shows one of the malicious processes, bitcoinMiner, which is a malware that mining the cryptocurrency. Also, you can see how much computer resources it is using, so you can make sure that possibly this process is not taking up all the resources to go unnoticed. However, in the long run, using this can lead to computer vulnerabilities and faster component failure.
Memory module:
Details:
File signature: Suppossing to be an element of Microsoft Corporation
File description: Shares the operation of malware with the user experience library.
Adware Killer Feature:
At the same time, the UVK tool can be used to scan for Ultra adware killer viruses, which helps to better detect and destroy KPK. In this case, more malware is visible.
VT Hash Check – virustotal.com
Comparing UVK and virustotal.com, it can be seen that virus total, using more sources and data, explores malware much more deeply / faster. From the other hand, the UVK tool can help detect unknown malware by monitoring services and actions on your computer.
During scan:
As you can see, you can obtain information about detected malware, it’s details, relations and sources. Moreover, there are strings, resources usage (we will read this from PeStudio, because it’s more convenient) information and so on..
PeStudio
The PeStudio tool analyzes malware by analyzing its operation, resources used, and so on.
When you open pestudio and compress the file, you can see general information when loading it. That file type is executable, 32bit.
The Indicator window shows logged events that can help you understand how malware works. It can be seen that the program requires Administrator rights. It can be seen that the program communicates with the privatelocker, so it can be said that malware encrypts computer data. It uses passwords and has an interface with Bitcoin that will probably ask for a ransom.
Strings – the text section stores a lot of informative information:
You can see which SQL queries are used, what methods, resources …:
It can be seen that the timer is used:
PeiD
Using this tool, it is sometimes possible to unpack malware using plugins, or find other information about program. For example, what methods and actions are performed:
Some malware issue how they are packed. Knowing this information, you can unpack the malware using the following tool:
Try to generate your malware
Malware generation used in In Shadow Batch Virus Generator:
Premade Viruses & Virus Gen’s can be selected from several virus generator options:
The tools produce .bat files. The second – DELmE’s generator proved to be more suitable because it has more functionality and the .bat file is more readable (Virus generator writes all the code on one line).
Generated .bat files that floods websites hide everything from the desktop and so on.
Finally, I selected the malware code, for which I additionally wrote a check and a request for administrator rights, because I did not find it in the tool:
The generated code must be allowed with Administrator rights. It disables Task manager, Windows Defender, Windows Update and Windows Security.
Hash Check finds virus(7/60): https://www.virustotal.com/gui/file/dced1d8305979b383f0e44c4ec3aee4ea4f2969f4894d5dd9b572cb465c03395/detection
Packing (hiding) virus purpose
For obfuscation, we will use the created .bat code, which changes the password and drops you to the page where you should pay for the change.
One engine in virus total finds it: https://www.virustotal.com/gui/file/af44184e973bfd89f66e496a8d4cf3a628c066fdb64b85621ae9429dd242f485/detection
We will use .bat code file to hide our virus:
@echo off
if "%~1"=="" exit /b
if /i "%~x1" neq ".bat" if /i "%~x1" neq ".cmd" exit /b
for /f %%i in ("certutil.exe") do if not exist "%%~$path:i" (
echo CertUtil.exe not found.
pause
exit /b
)
>"temp.~b64" echo(//4mY2xzDQo=
certutil.exe -f -decode "temp.~b64" "%~n1___%~x1"
del "temp.~b64"
copy "%~n1___%~x1" /b + "%~1" /b
Dragging other bat files onto this .bat file creates, new .bat files with __ in name beginning.
While comparing code before and after. You see simbols instead code. Virus total does not recognise virus.
SandBox environment
We will use the WannaCry virus:
We save several images in the SandBox Explorer environment:
We launch the created SandBox WannaCry environment:
We get a pop-up window:
Files have been encrypted:
TOOLS and resources:
https://www.carifred.com/uvk/UVKInstaller.exe
https://github.com/charonn0/VT-Hash/releases/download/v1.60/VT.Hash.zip
https://github.com/sandboxie-plus/Sandboxie/releases/download/v0.4.4/SandboxieInstall64-v5.44.0.exe
https://www.softpedia.com/dyn-postdownload.php/ccd3302b1f64aad009a70f3551b6ba36/5fafb9e0/1006/4/2
https://www.majorgeeks.com/mg/getmirror/runscanner,1.html
https://winitor.com/download
https://github.com/romanzaikin/OllyDbg-v1.10-With-Best-Plugins-And-Immunity-Debugger-theme-