In this demo,
we are going to analyze the Windows services running on
the system for any suspicious activity.
Attackers may create or modify Windows services so that
they can repeatedly execute malicious payloads and
maintain persistence on the system.
Windows services are perhaps the most analyzed part of a system during
the incident response process. Windows services are basically programs
that have the ability to run automatically when the system is booted
without any interaction from the user.
So it is common for malware to be installed as Windows
services to maintain persistence on the system.
It is worth noting that this malware are not exploiting any
vulnerability in Windows services itself,
but only using it as a persistence mechanism.
The full path of the services registry key is HKLM\SYSTEM\CurrentControlSet,
which is usually ControlSet001, and Services.
This is one of the most important registry keys as all of
the Windows services installed on a system and their
properties can be found in this key.
So now welcome back to the demo environment.
Let's do rip, and we'll again use the SYSTEM registry hive. RegRipper has
some really great plugins for Windows service analysis.
And here, I'll first use the services plugin and redirect the
output in this text file, services.txt, and run it.
Now let's open this output file, and as you can see,
this plugin will list all the Window services sorted by the LastWrite time.
The parameter we have here are the service Name and its Display name.
Then we have the ImagePath.
This parameter will provide the location of the executable for this service.
Next is the Type parameter.
This parameter classifies the services into two common types,
Own_Process, which are services that are the only service in
a process, and Share_Process,
which are services that share a process with another service.
So here you can see the type as Own_Process, and for this
service, the type is Share_Process.
So you can notice that for this service,
the ImagePath points to a svchost executable,
which is a host process. To understand more what these parameters mean,
let's go to the regedit on my system and open the services registry key,
We'll go to the path HKLM, System, ControlSet001, and Services.
So these are the services on my system.
Now let's open the key AJRouter.
Here, you can see ImagePath contains the path for svchost.exe. Svchost is
essentially a service host in that multiple copies of svchost can be running
and each hosting multiple services running from DLLs.
So where exactly is the location of the DLL mentioned?
If we open the Parameters subkey, we can find the ServiceDll parameter,
which provides the DLL location.
This is a very effective way to hide the malware and at the same time,
maintain persistence on the compromised system.
Now once we have an understanding of these values,
we can go ahead and analyze the services to find any suspicious activity,
but we need to get the same information in the svc file.
Thankfully,
RegRipper has a plugin for that. Plugin name is svc, and I think it's
one of the most important plugins of RegRipper.
I will send the output profile, services.csv, and run it.
Now let's open the services.csv file.
Let me adjust it.
Here we have the LastWrite Time, Name of the subkey, DisplayName,
ImagePath and ServiceDll path, and then service Type and Start mode.
This has been sorted by LastWrite Time, but I'll sort it using the
Name here. Note that this plugin also fetches the DLL file from
the parameter's subkey where present.
So if we look at the same key we saw before,
AJRouter, since it's a shared process,
there are two entries present for this service.
One is for the ImagePath,
which is svchost, and the other one is for the parameter's subkey with the
file location, AJRouter.dll. So to quickly locate malware in the sheet,
one of the tricks used is to search for keywords like temp or appdata in
the location path of these services.
So let's search for temp.
We have one entry with temp, and we can see that the
service Name looks suspicious here.
The service Type is an Own_Process, and the executable d3xi needs to be
further investigated for any suspicious behavior.
Now I'll search again for appdata keyword, and we
have one more entry, pnpsvc service.
It seems that the Plug and Play svc has been infected.
Since it is a shared process, we can use the parameter subkey,
which is pointing to a file, ALSysIO64.sys. This file also needs to be
further investigated for any suspicious behavior.
So now, by using the SVC plugin of RegRipper,
we were able to find two services with suspicious behavior.
RegRipper not only extracts the data from the Windows registry, but also
presents it in a format that makes it easier to analyze.