Hello, Siberians, and welcome back
to Incident Response and Advanced
Forensics.
My name is Max Alexander and I'll be
your subject matter expert for
today's lesson.
Malware incidents, the
malware incidents.
We're going to talk about some of
the common ways to
examine malware and
then to to remediate malware.
Is this this is probably going to be
something that you're going to face
a lot of times or most of the times
when you're doing incident response.
And, of course, forensics is going
to tie into the malware
analysis of radiation as well.
So, again, as we talked about,
malware is going to be a very
common incident and probably
something that you're going to have
to deal with almost every
other day.
Malware can be benign
and annoying or it could be very
serious, just key logging,
ransomware or remote access.
So varying types
of malware with various
types of results.
The best case scenario for your
malware is that your antivirus
is going to notify the user admin
that it was quarantined, some
type of program.
So hopefully
all you're going to have to do is
ensure that the antivirus did its
job and then go back in and see
how the malware got onto
your system and kind
of what actions that
the antivirus took.
And just to ensure that nothing
serious happened to your system.
Worst case,
more than likely, the end user might
notify you that he's going to have
to pay five hundred dollars in
Bitcoin to someone in Russia to
unlock his files, or
you're going to have the serious
malware incident that's going to
spread throughout
your network, such as has recently
happened among hospitals in the US
and Canada, where they've had to pay
upwards of seventeen thousand
dollars to
Russian hackers.
So best case, worst case, best
case, nothing
really happens.
Worst case, you're having to call
your attorney.
You're having to call on remediation
specialist because something
went very, very wrong
that day.
So analyzing malware.
So when we get malware on
our systems, one of the first things
that we want to do is
figure out what it is, what it does,
how did it happen, and
go headfirst into this
this battle against the person
who's trying to attack our our
systems.
The biggest takeaway from this is do
not analyze malware on your
own system without taking
precautions to ensure that it
will not spread to your system
or to other places in
your network where it has not
already done so since you're going
to be generally
higher level admins
kind of working in that network
environment.
If the malware to get loose on your
system, that has essentially a
foothold into something a lot
greater than maybe it would have
been on a regular user system.
But bottom line, don't make
the incident worse.
Take precautions to ensure
that you're protecting your network
at all times.
Ideally, what you want to do is set
up some type of virtual machine
or use a standalone offline
system to analyze any
type of malware that you have.
Now, both of those have their
advantage, disadvantages.
Virtual machine is great.
You can kind of easily go
back and
reconfigure that machine to an
earlier state, an
offline system that allows you to
look at the malware more
or less in a native environment.
Oftentimes some malware
will know that it executes in a
virtual machine and it will not
behave as it would if
it were on a normal system.
So kind of some pros and
cons there.
Now, this is not going to be an all
inclusive guide to analyzing
malware. It will provide some of the
broad brush strokes and then we
can talk about later on and other
courses of doing that deep
dove into malware analysis.
But this will provide a good
overview on some of the steps
that the incident responder
can take to figure out what
type of malware you
have and what it's doing to
your networks.
So when we're looking at malware
that essentially go into the four
stages of malware and as you
can see from our info
graphic here down at the very bottom
of that, that
pyramid is your automated analysis.
And that's going to be your
your lowest level and your easiest
way to end up doing
your malware analysis.
Then moving up in difficulty
to the top of the pyramid, we go
from static analysis to
dynamic analysis all
the way up to reverse engineering.
All of these processes have.
Have their strengths and weaknesses,
automated analysis is we're going to
talk about next.
It's very fast.
It's automated.
The biggest drawback to automated
analysis is that, one,
you're uploading files to the
Internet generally.
And by uploading those files,
a potential attacker
could be tipped off
that you are uploading those files
and that you have detected whatever
it is he is trying to do
on your system.
So that is one of the disadvantages
with the automated analysis.
And then as we go up, obviously,
in that level of difficulty, as
we work our way up the pyramid, the
harder it is.
So you have to be essentially
trained on how to do some of these
these tactics, techniques and
procedures, looking at that
malware at a deeper level.
So the first thing we're
going to talk about is the
difference between static and
dynamic analysis.
We know what automated analysis is.
We're going to upload a file
and a program is going
to come back and produce
some type of result.
However, static,
dynamic analysis, the first step
is essentially to be is going
to be running an antivirus on
that suspected malware file.
Before we do anything, we
essentially want to know if someone
else already knows something about
this file.
This essentially just prevents us
from having to do extra
work if someone has already
done the work for us.
There's no need to go back in and
reinvent the wheel and it can
shorten the time that we need for
analysis if we're not able
to determine anything about the
file from from that
analysis.
The next step that we would want to
do is to essentially hash that file,
get an one deep
or short, one deep
file checksum,
and then we can upload that to other
programs.
One of the more common ones that you
can upload to is virus total
and virus total opposite
to the great API virus
scanner or Windows based uploader
that you can upload these files to
and that will analyze
the information from numerous
antivirus services
to provide you some type of result.
And then virus total can scan
the URLs domains and
these.
So it's a pretty powerful tool.
It scans, I think, 50 something
antivirus providers.
Again, though, the problem with
virus total is that you're uploading
a file to the Internet
and that could tip off
that that attacker that you
are onto, whatever it is that
he was doing. So you're going
to end up having to weigh the pros
and cons of kind of uploading
these things, because
depending on the environment that
you're in, you may not
want to provide those tippers
to to your potential adversary.
So going back to that
very bottom level of the pyramid,
the automated analysis,
your automated tools are great.
They're faster on the fly analysis.
They can save a lot of time and they
can provide an overview of your
virus, that you have its
capabilities so that you
can decide essentially where to
focus more of your attention
and efforts towards.
And then I've listed a couple of
the the automated
analysis tools here.
There's there's at least six or
seven out there. There's probably
more.
And the good thing about using more
than one is that they all do
different things.
So there are certain vile
profile analysis programs
such as file analyzer
that look specifically at files.
And then there are other types of
systems that you have, such as
malware, or it may LWR
that can take different types of
submissions.
There's a document analyzer
that looks just specifically at
documents.
So each of these has their own
strengths and weaknesses and
it's good to at least hit one
or two of these to help confirm some
of the answers that you might be
getting from another
automated analysis provider.