re-pwning the box you already own

Friday I was called to handle a malware situation. This was essentially a mission-critical workstation and the goal was not to fully reverse engineer or preserve the machine for evidence. The McAfee antivirus product identified a malicious .js and .exe, but the logs didn't show the detection. The behavior I was called to fix was that most executables failed to run.

I started experimenting with other useful commands, and found that wmic was not affected in the same way but still provided a shell. So start->run->wmic.exe. Once I had a wmic shell open, I could execute the following:

process call create cmd.exe

Which did spawn a shell where start-run failed. Once I'm in this shell I ran a few commands to look around to confirm there wasn't still a separate malicious process that didn't belong. It appears the McAfee client did successfully kill separate executables.

Here I ran via the cmd.exe shell a reg.exe command to enumerate drivers:

reg.exe query "hklm\software\microsoft\windows nt\CurrentVersion\Drivers32"

Here, most things seemed normal except for one value named "aux6" that was something like "../isgerh.exe" (parent directory then a random executable). On different systems, this will be a different aux device, so the important thing to remember is if the infection just happened, it will be the highest-numbered device.

To delete this device from the registry, I simply typed:

reg.exe delete "hklm\software\microsoft\windows nt\CurrentVersion\Drivers32" /va aux6

After a reboot, things behaved normally.

If you boot into safe mode you can make the registry edit with the regedit.exe or reg.exe without running wmic. A full scan of the drive in safe mode likely would have removed the malicious driver, but the registry would still attempt to load it and would result in an EventLog entry about a driver failing to load. It is also possible that a stager execuable could re-dowload the malicious driver as well. So far, it seems that the combination of the commercial scanner and the registry edit completely removed the malware that prevented most executables from running.

Often I'm asked why/how I ended up focusing on Incident Response/Handling plus Penetration Testing. Well, sometimes you have to re-pwn your machine you own. The command line building blocks are great for both. A good reason to follow the Command Line Kung Fu blog.

I have two majors projects I'm trying to wrap up today, and I promise I'll post info on them as soon as I can. Meanwhile, have you registered for the SANS Penetration Testing Summit?

More work on watermarking and stego

Trying to finish up some work on my defcon presentation has been difficult this week.

After a huge catastrophic infrastructure outage at my biggest client took most of my time this week, one of my longest-term clients had an obnoxious virus infection. This particular one was odd, I had to smile when it faked a bluescreen to try and get you to reboot. At least it was a good refreshing for the malware course I'm teaching in Boston during the last day of defcon. I'm bummed I miss some of my friends talks, but we've got work to do.

Also looking forward to teaching SANS Security 560, Penetration Testing and Ethical Hacking in Boulder, CO. This one has unadvertised extra bootcamp sessions (even though this course already has three times the hands-on as Security 504). It will be a blast.

Well, back to pollishing up some video stego stuff for Friday's talk.

Current State of Malware Analysis

The pauldotcom podcast from January 24, 2008 had a technical discussion on Advanced Malware Analysis and the new SANS Security 610 course. Security 610 is a four day course: the first two days are revised from the original Security 601 REM course, and two new days (also listed as Security 602). Day three's material is entirely on code analysis and is written by Mike Murr. I had the pleasure of contributing to Day four along with Lenny Zeltser, Pedro Bueno, and Bojan Zdrnja. My material was on Malware Self-Defenses and defeating those defenses. Day four also includes some in-depth Virtualization detection and Web-based malware.

Although I wasn't able to join in on the podcast, I've listened to it today and can say it is representative of Malware, Malware Analysis, and of course the new Security 610.