Tools and techniques for cleaning malware incidents

33 Pages·2012·2.46 MB·English

g
n

:
m
i
n o
r
f
a d
e
e . d
c
a
t
l e o
c l
, n
s r
e w
/
k o s
r t
c d r
o n a e pe
H b a
f e p
d al an m/
s c c
s i o
e i e h s c
c c Et le s.
u c g
iq in Servi sics, d arti musin
n e y n an o
e
r t r s m
h ri o r /
a u F e :/
pp p
c c
w , a t
e e E pp ht
S M
d
l
t S e
a M
h

d m B re is
I a bl
n – w u
l pp
a n a
o M yy
m
t -
s er nti All
l v A
o O /
e

n r
o a
i
t w
T r
a al
M M
s
ll
a e
v ll
p
o
m
m
a
e
x
s
RR
EE
n
s
&& o
dd n
i
t ll o
g p r
o i
n O s
WW
ii u
n
r l
erer s n e ll c s
a n n
mm n a h
o
e o
o c
ii t i
aa i SS O RR C t
ll t s
cc u
e
ss l
o – – – – u
a ii
DD S Q
d
n
•• • •
e
g
A
f
o

m
r
o ..

s f dd
a y ee
n gg
d
a dd
e
ee
s s
ll
u a ww
oo
e n
nn
r e
a kk
k
cc
n a
aa
o t

i e ee
t
a b rr
aa
t
n t
o ss
e
n . tt
s SS hh

e d gg
SS
r l ii
p u II rr
yy
o rr
s h oo pp
i oo
h s
MM cc
t
d
n BB dd
n
i II nn
a
d yy aa

e , bb
y ss
m
l tt kk
r n nn
a rr
e o ee aa
n
mm mm
m s
s
e ee ee
t
i c pl ss dd
a u m rr aa
d oo rr
l o a dd tt
c
r x nn llll
s P e ee AA
i
D
• •
…
…
s
n
o
i
t
u
l
o
S
tt
nn
-
eei ee
t
e
d n hh
rr
n ar eeat tt
a ff n’ gg
ffe
s didi d nn
s e h
t i ii
olar oo td ss
hu l uu
o wwld
t a
t
t a tt e rr
e ee
e e ttry
r sse dd
r f o
au aat ii
n fl ss
ws eeap
o nn
n
ll e
l i , oo
aet ttyd
c aa cc
m r
,e oe
d ee ,.
- t gv ddt
iee ss i
ntid uuea eee
f
i th ttv
at a cc
nc dd o
mm e eri ulul cou tetem
tde h ee
ee a n oo y dde
i c
d hh r
tt -se ssan ss
ss oig eo o
?? ii
yy -tngd ououm utiitit ee l t
SS pp n rro
i yyoldd aa
uha o o
r ii ww
ee t yy sdd t
hys f
ll lln
hh tnc. bbse, aa
i dd tt o
TT watiee aactari i mmi
s rr tt t
n fiblbl eeuwcc ee c
i
nn r ffd ee e
aeuaa ee l hh
aa oatt t
ceenn rr ee tte
rm
cc Sshee PPp dd ffd
II
SS
• • ••
V !!
dd
!!
nn g A !!
tt
aa n i i
tt hi e ctct
ss k
rr t -- a ee
o nn
ee tt
n oo F ee
dd
nn dd
nn s t
. a
uu s i aa nn
h
k e ee
,, gg w
ss r r vv
nn o e nn ee
s
oo w th vivi t’ tt
titi e , oo a n’n
pp
r s mm h ss
oo
a e t ee
ee (
w v
ll oo
aa i rr ,
l t e dd
vv a i nn
s l
.. oo m o aa fi ee
tt mm hh rr
nn p e aa
c tt
ee r …
oo i e gg a ww
rr f
cc tt ci s nn w ptpt alal
…… aa e al yiyi l mm
a ee

p f oo
kk m cc
-
gg oo s r nn xx ii
nn oo e fo nn t ee ntnt
LL h aa n aa
k ))
nini …… t c ee te rr ee
nn w e rr s oo hh
tt
oo
uu h i ff
aa o mm x t t
BB C ss
h e ff
cc ii II
SS
• • •
……
ss
rr
ee
nn
nn
aa
cc
SS

ee
nn
ii
ll
nn
OO
,
e
rr. o
meelf p m th
hewevwevrse zihe gg so or t
d
t u t nnl
d ooo ed iia,
nhhy ctn nnd an
sess, es tesey. anananm
sisi o n cc r
les,alyalye fil d prandmpa tosto sotti, No
finnh Jyy
d aa t ord]o ss b
eed
err g wec llnn
t.t. ectfo fosin ssectre mpmp aru
nn rry a a l
poo f aaae
oo l pnw
sdda sstn
cc unnn a f ilal yy Too
…… seea om nn
o se
vv aa
e u td- uh
mm mee o nrtiti dd rt
ion i
rry nnVs
ee oaa swa a
swwp e ees
ystyst ve malmalsto t filassdred oso sh auch
a cpr ss .
SS t e csx
h-o e alalu
eff o
titin p e ss
ee wnn h dd b
s r e
hh oaas u tp ululs,xd
e e n
TT nrr s r ooeo
o s a
u uud e uu cccbS
nn ooo c[o uu vid
yys y nW
aa y ae oor
i ea
ooh l o
cc f Pil YYssC
Ittt ftt
SS
• • ••
ll
tu
a
ff
ee
rs
gu

nff
o
i

ss
et
n
l
i
fu

eo
hm
t
a
e

ss
yu
lo
a
ii
np
ao
c
l
l
ihh
w
t
ss s iwi
ee e
u
c
xx io
v
y
oo r
e
y
bb
sll
p

dd ep
nn su
e
s
aa h
dd
t
SS n
f
oa

ee ehh
.
mta
nn
p
t
oea
ii
ll Sddd
nn
•
OO
all
st
n
--i
e
x
e
s.
s
crsS) xe
t m32\CES ee.e
u steRO 82d
yP a
tp ss.exe OWS\SCHED_ 777886
ample CWSandbox Ou RlMlReal Malware Filesystem New FilesC\WINDOWS\St32\C:\WINDOWS\System32\crsss.exeOpened Files\SystemRoot\AppPatch\sysmain.sdb\SystemRoot\AppPatch\systest.sdb\Device\NamedPipe\ShimViewerC:\WINDOWS\System32\crsss.exeChronologicalorderChronological orderCopy File: c:\temp\ff37e574c7694879ff73777886a82dee.exe to C:\WINDOWS\System32\crsOpen File: \SystemRoot\AppPatch\sysmain.sdb (OPEN_EXISTING)Open File: \SystemRoot\AppPatch\systest.sdb (OPEN_EXISTING)Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING)Open File: C:\WINDOWS\System32\crsss.exe ()FindFile:crsss.exeFind File: crsss.exeRegistry Process Management Creates Process -Filename () CommandLine: (C:\WINDc:\temp\ff37e574c7694879ff73777886a82dee.exe) As User: () Creation Flags: (DETAKill Process -Filename () CommandLine: () Target PID: (588) As User: () Creation Flags: ()System Info Get System DirectoryThe following process was started by process: 1Analysis Number 2Parent ID 1Process ID 1020Filename C:\WINDOWS\System32\crsss.exe --install c:\temp\ff37e574c7694879ff73Filesize 215040 bytesMD5 ff37e574c7694879ff73777886a82deeStartReasonCreateProcessStart Reason CreateProcessTermination Reason NormalTerminationStart Time 00:03.750Stop Time 01:00.531
S
–