Ashford University Malware Analyzer and Cerbero Profiler Essay 1-However opening the file is Cerbero Profiler highlights that the file contains a binary re

Ashford University Malware Analyzer and Cerbero Profiler Essay 1-However opening the file is Cerbero Profiler highlights that the file contains a binary resource which has a MZ header (executable). Let’s extract the resource and re-analyze it with virus total and PEID.

2-As of 25th Jan 2016 there were 45/53 anti virus detection ratio for resource.exe.

3-PEID did not suggest that the extracted binary is packed. IDA Pro’s imports table looks legitimate as well.

To answer when is the binary compiled we can use Cerbero Profiler again to check.

4-From the above we can see that Lab01-04.exe compile date/time is fake. But the resource binary’s datetime stamp might be the real deal.

5-The ADVAPI32 Library allows us to gain higher privileges so as to facilitate in some of the functions call later. Kernel32 Library in this case allows us to loadlibrary, execute application, write file to disk and access resources.

6-The above screenshot shows that the malware is attempting to increase its privileges to SeDebugPrivilige. Once adjusted, it begin calling sfc_os.dll’s 2nd ordinal function which is the CloseFileMapEnumeration function.

7-We can find out more details in what this function can do here… in a nut shell, it is trying to disable the write protection that winlogon is providing. Once the protection is disabled, the malware then move the file “windows directorysystem32wupdmgr.exe” to “tempwinup.exe”. It then read its own resource @ #101 and write it out as a file at “windows directorysystem32wupdmgr.exe”. The malware then executes this freshly written binary using WinExec.

8-There are only 4 imports of interest here.

URLDownloadToFileA; downloads a file from a given url to the victim’s machine

GetWindowsDirectoryA; get the windows directory of the victim’s machine

GetTempPathA; get the path of the directory designated for temporary files

WinExec; run command/application

From the above import functions, we can make an educated guess that the malware is attempting to download another binary from a URL into either the victim’s temp directory or windows directory and execute it.

9-the disassembled code simply executes an exe located in “temppathwinup.exe” where temppath refers to the temporary folder specified in the environment variables. It then attempts to download another exe from http://www.practicalmalwareanalysis.com/updater.ex… and save it in “windows directorysystem32wupdmgrd.exe”. It then executes this exe via winExec.

10-Solutions to question 4 and 5 would have answered this question. A lot of malwares uses these techniques to drop malicious executables on the victim’s machine. there are various form of payload hidden in the dropper. Some are in the form of images (hidden via stengo) while some are just purely address offsets. Encryption/Encoding such as Rc4/XOR/Base64 is commonly used in droppers as well. What is interesting in this exercise is probably the technique to disable windows file protection using user code.