Hello everyone and welcome Paul.
First lecture in this lecture we're going to talk about the dynamic and static analysis and then we
will do some quick the analysis to recover the files and previewed by our first somewhat before we begin
let's discuss some housekeeping rules to make sure our data is safe always on malware or anon files
in a secure virtual machine.
Don't risk infecting your host what other machines on the network.
Better snapshot before the analysis.
Otherwise you risk losing your files and by having a snapshot we speed up the analyses and you will
be able to revert to a safe snapshot whenever needed.
Make sure that then you share drives or folders that the virtual machine has the right access to only
contain disposable data will not store anything confidential as your risk keep being encrypted autographs
is able Internet connectivity of the analyses virtual machine otherwise you risk excuse breaking sensible
information or even tipping off the attackers.
All that was mentioned during the course are freely available online and we see them in action on the
following screen just be those
as you know the aim of any creep thirties to force the victim to pay a ransom of money in order to have
their files be created once they have been infected.
In this session we will analyze our first quarter which we will name here Green Dot Exxon let's verify
DMV five of hash of the file.
The simplest way to get the empty five hash of the file is to use the terminal command Endy 5 which
will provide the results as seen in the slide.
Now go ahead and run it empty five Green Dot Exxon knowing the hash of the file can help us get more
information from the indictment.
For example we can use Virus Total to understand this behavior to see if any network connections are
indeed to see if any sensitive operations are performed and get the general indicators about possible
malicious behavior of the sample.
We will see through the annual analysis of the the algorithms used during the encryption stage that
we will actually be able to reverse the process and restore the files.
Let us begin since we already know that the malware is a creep there will play some XP EMG JPEG or any
other common files on the desktop for the creep that will increase.
The first thing to observe is what a creep third does after the victim runs it.
For these thought processes for and process monitoring in process monitor set the field or use the combination
control cell to open filtering menu to monitor just the activity of the creator.
This can be done by filtering it by process name and its hash
after preparing process monitoring process explore stop the capturing process monitor Prop 1 and launch
the creeper in process bar.
You will notice a new process being created and after it completes its execution a blank note by reputation
will open.
This is not very important at the moment.
However if you try to open any excuse or any other type of file you will notice that it has been obfuscated
in some sort of manner and these are readable.
Our aim is to figure out how the program has performed the scrambling of the text and possibly to be
able to reverse this logic.
If you have set up the correct filters you should now see many events in Brooklyn.
It is a good idea to quickly scroll through the events initially to get familiar with what the program
has done.
If your files have been encrypted Process Monitor should get or read write loop of events for d You
can set up filters for read file and write file operations as well as query directory events as it moves
through the file system.
This is expected sees the creep there starts and browsing directories of your file sees them.
In this case the C drive and then encrypt each file it finds to some internal algorithms that we add
after this particular creep Darden stores the path of the encrypted files in a log file.
The process of browsing through the file sees them these are repeated until it has encrypted everything
would access for static analysis and we will use the free version of IDR.
This assembler to understand how the files are encrypted started up rule and open the greater executable
with default settings.
You might actually have to revert to your snapshot wi fi that broad doesn't thought because important
files in each directory would have been encrypted.
Here's the first reason why our snapshots will come in handy.
Logic tells us that the creator of the DOJ the filing the file system Obama and the read into memory
possibly with a read file operation then encrypt its contacts and write it with right file function.
Therefore the simplest way to search the encryption routine is to figure out what happens after the
read file operation.
This could be done easily with Process Monitor or just double click on one of the Read file operations
as we can see in the picture.
There are several general operations Mark with capital K and use our operations Mark with capital based
on the second column with the name of the application.
We know that the read file function in operation then was initiated from within the crypto program and
then we can go straight to this address in either portal by using the address from Operation eleven
as seen here unite up real press capital G or jump menu then jump to address and then type you the others
from the operation you live on above be mindful that in your case this address might be different.
Let's continue with the static analysis using our favorite this assembler.
If you look carefully through the code that gathers where you have just jumped to.
You will notice the read file and write file calls.
If you do not know what these functions do or what parameters are pushed to the stack to be used in
the functions.
Feel free to look up them on M S the M which is the Microsoft Development Network or library providing
information about all the necessary functions before the right file call.
We can see a core set file point but these function positions the point on we cannot file looking at
these parameters we can see that the DB double use method these Udall and AP distance move is also zero.
This means that after the file has been read the pointer is at the end of the file and needs to be moved
back to the beginning to write the encrypted bytes right before the code was set file point thought.
We can see another code a very interesting function which will deep dive in the next slide.
Now we're going to look at the beetle assembler code but don't worry everything will be explained to
analyze the suspicious function that I'll take to go inside the code.
Also you can press escape anytime to go back.
Notice the code of the function is not that it should be easy to understand.
We can see some called Saudi initialized in the beginning and then a comparison.
Where did you start a X is compared with the value.
Well two hundred thousand hex but we're not really concerned with what is being compared as of yet then
we can see more variables in your set initialization counters and buffers.
In this picture LP by far should actually contain the buffer with the bytes read which gets stored in
the E B I register that is a commonly used as a destination variable.
The comparison made with then hex switch is actually sixteen decimal probably refers to the length of
the encryption key that we are looking for it invites.
Next we can see an XOR operation which resets the UK's counter to zero.
Once it reaches sixteen This is so that you can be reused.
This makes us believe that we can have an extra operation with repeated the next instruction where E
A X registers XOR against an unknown value reference in relation to yay X register is what we are after.
At this point it will be useful to try this on your own virtual machine to understand better.
It seems that the variable points while memory location with an offset of the value of X..
Remember that EDI X registry is used as an index going from 0 to 15.
So most probably each block of the plaintiffs takes these XOR against the corresponding block of the
key to get the ciphertext double click or needs to go to its location in either role and you should
see the encryption key stored in there.
So we have found out that this creeper uses a simpler seem simple XOR with repetitive key to encrypt
the files for finding their size.
Try building a python program that would use this key to obtain your original files using the key.
We just recorded in the next lecture will exercise our creep analysis skills to recover the between
in a different way and also write the tool to decrypt all the files so don't miss lecture.
In this case the only method the wolf association was the XOR operation well our logic tells us that
if we saw any bite with a zero bite well you get the original bite hence if we pass a text file field
only with zero bites.
We thought we should obtain a file with the key because the key is repeated for each and every block
of text as you can see that we need cheese above the first file containing only zeal has been encrypted
to the second file containing only the PDB 16 bytes books since we can not write zero bytes from a normal
text.
That door if you're doing this in your own virtual machine the easiest ways to use a hex editor for
example age X the
the algorithm to break repeating key X or cipher is thoroughly documented in the attached python script
which we see in action in the next video.
Basically the idea is that since we know that the encryption is done using sixteen bytes you can these
XOR.
Will figure it out using statistical methods for these to work.
It's best to have an encrypted file with a large amount of English text as the algorithm uses techniques
based on the number of letter repetitions in the English language.
The method would work well even if we didn't know the key sites first will get the most probability
sizes using statistical methods.
Then we break the problem into multiple single character like source then finally solve them individually
thing to illustrate this idea let's look at how we would actually break the 16 by three or five steps.
Step 1.
Divide the cipher text into chunks of 16 bytes so that to transpose each block that 3 join them to obtain
a matrix that 4 so each row of the matrix as it would be a single character XOR encryption Step 5 for
each row the single biotechs are key that produces the best looking keystroke Rom is the repeating that
sort of key byte for that row with these bytes together and you have the two
to recap.
In these lecture we've done the following.
Learn how to create filters in process monitoring well we learn how to identify the areas of the encryption
routine how to reverse engineer the operations we use simple observation about blind logic using the
extra algorithm and about a block ciphers to force the ransomware to show us the sixteen bytes.
We also learned how to break or repeated key exorcised and how to recover the affected files.
Thank you.
This was lecture 1.
See you in lecture 2.