PMA Lab 7-1: Analyzing Malicious Windows Programs
Analyze the Malware found in the file Lab07-01.exe.
Lab 7-1
Analyze the Malware found in the file Lab07-01.exe.
1) How does this program ensure that it continues running (achieves persistence) when the computer is restarted?
The Malware achieves persistency by Creating a Service named Malservice:
In order to understand with more detail the definitions of this process
From this function, we can see that the Service will run in its own process (dwServiceType is 10h - SERVICE_WIN32_OWN_PROCESS) and is set to auto-start (dwStartType is 2h - SERVICE_AUTO_START). Also, the Binary Path is set to the path of the executable file of the current process.
These configurations can be confirmed by running the following command during Dynamic Analysis:
- sc qc Malservice
2) Why does this program use a mutex?
This program uses a Mutex in order to guarantee that only one instance of this file runs at the same time:
If OpenMutexA returns a value other than NULL, the program will exit.
3) What is a good host-based signature to use for detecting this program?
The Mutex HGL345 and service Malservice can be used as host indicators in order to detect this program.
4) What is a good network-based signature for detecting this Malware?
The Malware uses Threads in order to connect to:
5) What is the purpose of this program?
We can see several calls to API functions that are related to Dates and Timers. So we can see that there is a specific time when the Malware will “unleash” its true functionality.
First, we see SystemTimetoFileTime being used in order to convert a system time to file time format (01/01/2100 00:00:00):
After that, the Malware uses CreateWaitableTimerA in order to create a timer object. Then the timer object is set to activate at the previously seen date (SetWaitableTimer). Finally, WaitForSingleObject is used. This function waits until the specified object is in the signaled state or the time-out interval elapses. In this case, it either waits for 01/01/2100 00:00:00 or after timing out (4294967295 milliseconds = ~49,71 days)
If the time-out interval elapses the Malware will sleep for another 49,71 days and then exits. If the date 01/01/2100 00:00:00 is reached the Malware creates 20 Threads:
These Threads are set to start 0x401150 (StartAddress). Each one of these Threads will then request http://www.malwareanalysisbook.com over and over again (infinite loop).
Thus, we can conclude that the objective of this program is most likely to inflict a Denial of Service attack to www.malwareanalysisbook.com.
6) When will this program finish executing?
The Malware will eventually stop executing before the year 2100, after it ran for at least ~100 days (~49,71 days on WaitForSingleObject call + ~49,71 days on a Sleep call). However, the Malware has acquired persistency via the created Service (Malservice) and will start running again after a likely Reboot.
After the date 01/01/2100 00:00:00 is reached, it won’t ever stop running (gracefully) since the Threads are executing an infinite loop.