Malware Forensic Field Guides: Tool Box Chapter 1 Malware Incident Response
In Chapter 1 we examined the incident response process step-by-step, using certain tools to acquire different aspects of stateful data from subject system. There are a number of tool suites specifically designed to collect digital evidence in an automated fashion from Windows systems during incident response, and generate supporting documentation of the preservation process.
• Some of these local incident response tool suites execute commands on the compromised computer, and rely on system libraries on the compromised system.
• Other programs, commonly known as “remote forensics tools,” address some of the limitations of local incident response suites and use a servlet that enables remote evidence gathering while trying to rely on the compromised operating system as little as possible (with varying degrees of success).
• Using remote forensic tools, digital investigators can access many machines from a central console, making more effective use of your expertise than spending time running around to touch each machine physically.
• Furthermore, using a remote forensics tool is more subtle than running various commands on the system and is less likely to alert the subject of investigation.
• These tool options, including the strengths and weakness of these tools, are covered in this section.
| Name: Windows Forensic Toolchest |
| Page Reference: 11 |
| Author/Distributor: Monty McDougal/FoolMoon |
| Available From: http://www.foolmoon.net/security/wft/ |
| Description: Older free versions of the The Helix Live CD provides a powerful suite of tools for incident response and forensic preservation of volatile data for both Windows and UNIX systems. In addition to dumping RAM as discussed earlier in this chapter, the older versions of the Helix CD comes with the Windows Forensic Toolchest. The Windows Forensic Toolchest (WFT) provides a framework for performing consistent information gathering using a variety of utilities. The WFT can be configured to run any utilities in an automated fashion and in a specific sequence. In addition, the WFT generates MD5 values and supporting audit information to document the collection process and integrity of the acquired data. However, the WFT cannot list deleted files. |
 |
| A significant limitation of the WFT is that it relies on the operating system of the compromised host. Some malware hides information from incident response tools that rely on the operating system. For instance, the figure below shows file listing results on a live system on which the HackerDefender rootkit is concealing certain files from the operating system. As such, if a rootkit is installed on the subject system, even trusted commands in the WFT can provide incorrect results. |
 |
| Name: Helix3 Pro |
| Page Reference: 11 |
| Author/Distributor: E-Fense |
| Available From: http://www.e-fense.com/helix3pro.php |
| Description: Helix3 Pro is a live response CD that contains a bootable Linux environment (known as a the “bootable side”) and a Live response framework for use in Windows environments (known as a the “Live side”). Upon until 2009, Helix CD was freeware tool set; the Live side was a graphical framework that invoked 3rd party utilities to collect volatile data from Windows systems. In early 2009, E-Fense announced the release of a new proprietary version of Helix, known as Helix3 Pro which no longer relies upon the 3rd party applications and utilities, but rather, proprietary code. Rich with features, Helix3 Pro, depicted below, allows the digital investor to image physical memory, collect volatile data, and acquire physical devices, among other live response tasks; the results acquired with Helix3 Pro can be saved locally to external media or transferred remotely over the network using a proprietary remote collection utility called the “Helix3 Pro Imager Receiver.” |
Acquiring physical memory with Helix3 Pro  |
Volatile data acquisition with Helix3 Pro  |
| Helix3 Pro Image Receiver  |
| Name: OnlineDFS/LiveWire |
| Page Reference: 11 |
| Author/Distributor: Cyber Security Technologies/WetStone |
| Available From: http://www.onlinedfs.com/products_dfs.asp; https://www.wetstonetech.com/faq_livewire.html#faq0 |
| Description: The Online Digital Forensics Suite (OnlineDFS), which is also licensed as LiveWire, has the capability to capture volatile data from a remote Windows computer, and can be used to capture a full memory dump and a forensic duplicate of the hard drive on a remote computer, as shown in the figure below. |
 |
| Rather than running a servlet on the evidentiary machine, OnlineDFS/LiveWire uses the SMB protocol to execute commands on the remote system, since this approach relies on components of the compromised system and therefore could conceivably be undermined by malware. |
| Name: ProDiscoverIR |
| Page Reference: 11 |
| Author/Distributor: Technology Pathways |
| Available From: http://www.techpathways.com/ProDiscoverIR.htm |
| Description: Live response forensic tools suites that do not rely upon the subject operating system, but rather, run agents on the subject system at the bit level, such as PRoDiscoverIR (a commercial forensic utility), are often capable of unearthing stealth files. In the figure below, PRoDiscoverIR was able to identify the HackerDefender rootkit. |
 |
| Keep in mind that some rootkits or anti-forensic techniques may still successfully conceal some information, like hidden processes, from a remote forensic tool like ProDiscoverIR. Another risk of running utilities on a live system is that they may crash and overwrite valuable digital evidence on the compromised system. This risk emphasizes the importance of capturing a full memory dump and forensic image prior to performing such analysis on a live system. As noted above, ProDiscoverIR can capture volatile data from a remote computer via a servlet running on the compromised computer. The figure below shows part of the process list obtained from a remote computer using ProDiscoverIR. |
 |
| Although the servlet attempts to provide a complete and accurate view of the compromised computer, it can be tricked by some rootkits. For instance, current versions of ProDiscoverIR cannot see processes and open ports that are hidden by the HackerDefender rootkit. |
| Name: Encase Enterprise |
| Page Reference: 11 |
| Author/Distributor: Guidance Software |
| Available From: http://www.guidancesoftware.com/computer-forensics-fraud-investigation-software.htm |
| Description: EnCase Enterprise can capture full memory contents, and it can be used to inspect volatile data on a remote computer and preserve some high level information such as lists of running processes, network connections, listening ports and open files. The figure below shows the Snapshot module in EnCase Enterprise being used to view information about processes running on a remote computer. |
 |
| Name: RPIER (aka "The Rapid Assessment & Potential Incident Examination Report (RAPIER)") |
| Page Reference: 11 |
| Author/Distributor: Steve Mancini and Joseph Schwendt |
| Available From: http://sourceforge.net/projects/rpier; http://code.google.com/p/rapier/downloads/list A number of whitepapers and PowerPoint presentations regarding RPIER/RAPIER are also available: -http://www.first.org/conference/2006/papers/mancini-steve-papers.pdf; -http://www.first.org/conference/2006/program/rapier_a_1st_responders_info_collection_tool.html; -http://code.google.com/p/rapier/downloads/list; -http://crime.zotconsulting.com/slides/2007_Q1_CRIME_presentation.pdf; -http://www.first.org/conference/2006/papers/mancini-steve-slides.pdf |
| Description: RPIER (which also goes by the name “The Rapid Assessment & Potential Incident Examination Report (RAPIER)”) was developed by Steve Mancini and Joe Schwendt of Intel. RPIER serves as a framework, or “engine” for the automatic acquisition of volatile and non-volatile system state data from a subject system. In particular, the RPIER framework is intended to be run on a subject machine in a running state from an external media, such as a USB thumb drive. -Upon execution, the RPIER runs a series of individual modules that invoke numerous third-party utilities, to collect information from a subject system. The collected information is then either uploaded to a central secured repository or deposited on local external media, where analysts can examine the output from the program. RPIER can be used on Windows 2000, XP, 2003, and Vista systems, but requires the Microsoft.NET framework 1.1 or higher be installed on the subject system. -The RPIER framework can be used in three different scanning modes: Fast, Slow, and Special. The Fast scan takes approximately 10 minutes to complete and gathers a variety of volatile and non-volatile system data, depending upon the modules selected by the investigator. The Slow mode includes a more in-depth acquisition of system data, including acquisition of physical memory, and process memory acquisition for every running process on the system. Lastly, the Special Scan includes a series of more invasive probes, which can potentially alter system data, such as anti-virus scanning, networking monitoring, and steganography detection. -For in-depth discussions about the different scan modes, see Mancini and Schwendt’s whitepaper, “RAPIER: A 1st Responders Information Acquisition Framework” and PowerPoint presentations discussing RPIER that are available online. (URLs provided above) -Once the investigator selects the scan mode, he or she must select the individual modules he or she wants to deploy, using the RPIER user interface, as shown in the figure below |
 |
| -Once the investigator has selected the modules, the tool is deployed by clicking the “Run Rapier” button on the user interface. The results from each module are deposited into a main “Results” folder, which can be sent over the network to a secure server, or can be directed to a local external media, such as a USB thumb drive or external hard drive enclosure. |
| Name: Nigilant32 |
| Page Reference: 8 |
| Page Reference: Author/Distributor: Agile Risk Management |
| Available From: http://www.agileriskmanagement.com/publications_4.html |
| Description: Nigilant32 is a GUI-based incident response tool designed to capture volatile information from a live Windows 2000, XP, and 2003 systems with minimal impact to the system. In addition to being available for deployment individually, Nigilant32 is also integrated into the older versions of the Helix incident response CD. The tool provides the investigator with a variety of features including: -System Snapshot Gathers and generates a report on ephemeral information on a running system including processes, services, user accounts, scheduled tasks, network connections, among other information. - Filesystem Review Allows the investigator to explore the file system and potentially locate hidden files or folders, recently deleted content, or extract files for offline analysis. - Active Memory Imaging As we discussed earlier in the chapter, Nigilant32 provides the investigator with the means of imaging the physical memory (RAM) of the subject system. |
| Name: Computer Online Forensic Evidence Extractor (COFEE) |
| Page Reference: 11 |
| Author/Distributor: Microsoft |
| Available From: http://www.nw3c.org/; https://cofee.nw3c.org/ (Available to Law Enforcement Only) |
| Description: COFEE is a Live Response Framework with a GUI frontend, which invokes commonly used digital forensics tools (such as Microsoft/Sysinternals utilities and trusted versions of utilities built into Windows operating systems) to help law enforcement officers at a digital crime scene gather volatile evidence. A lot of controversy surrounding this tool erupted in December 2009, when a copy of the tool was leaked to a file sharing site. Up in arms, a cadre of hackers developed an “counter-forensic” utility named Detect and Eliminate Computer Acquired Forensics (“DECAF”) to obstruct the use if COFEE; the controversy was later quelled when Ovie Carroll, producer of the popular digital forensic podcast CyberSpeak interviewed one of DECAF’s developers, calling for the removal of the tool. |
| Name: Forensic Server Project (FSP)/Forensic Responder Utility (FRU) |
| Page Reference: 11 |
| Author/Distributor: Harlan Carvey |
| Available From: http://sourceforge.net/projects/windowsir/files/; http://windowsir.blogspot.com/2005/02/forensic-server-project.html |
| Description: Written in Perl, (of course!), the FSP is a client/server based approach for information collection from a live system. |
| Name: SecCheck |
| Page Reference: 13 |
| Author/Distributor: myNetWatchman |
| Available From: http://www.mynetwatchman.com/tools/sc/ |
| Description: SecCheck is a Windows forensic tool which gathers volatile and non-volatile information from a live system and aids in the detection and removal of malicious code. |
| Name: The Incident Response Collection Report (“IRCR”) |
| Page Reference: 11 |
| Author/Distributor: PhantomByte |
| Available From: http://sourceforge.net/projects/ircr/ |
| Description: IRCR is a script to call a collection of tools that gathers information from a live Microsoft Windows system. IRCR is included as a incident response tool option on older (non-proprietary versions) of the Helix Incident Response CD. |
| Name: FRED (First Responder's Evidence Disk) |
| Page Reference: 11 |
| Author/Distributor: Jesse Kornblum |
| Available From: The FRED batch script can be found at the end of Kornblum’s white paper “Preservation of Fragile Digital Evidence by First Responders,” http://www.csa.syr.edu/Jesse_Kornblum.pdf. |
| Description: FRED is considered one of the first scripted live response tool scripts, draws upon trusted binaries to collect system information. |
| Name: FRISK |
| Page Reference: 13 |
| Author/Distributor: John “Four” Flynn |
| Available From: http://sourceforge.net/projects/frisk |
| Description: Written in Perl, FRISK is an incident response framework with a flexible plugin architecture. |
| Name: WinAudit |
| Page Reference: 13 |
| Author/Distributor: Parmavex Sevices |
| Available From: http://www.pxserver.com/WinAudit.htm |
| Description: Although not solely designed for Live Response, WinAudit is GUI based tool that reports on a numerous aspects of a running system, including both volatile and non-volatile information. |
| Name: FirstonScene |
| Page Reference: 13 |
| Author/Distributor: Beau Monday |
| Available From: Previously available on http://bmonday.com/articles/975.aspx, now archived on http://web.archive.org/web/20100630202543/http://bmonday.com/articles/975.aspx |
| Description: A Visual Basic that draws from over 20 different trusted binaries to collect volatile and non-volatile system data. |
| Name: SIW (System Information for Windows) |
| Page Reference: 13 |
| Author/Distributor: Gabriel Topala/Topala Software Solutions |
| Available From: http://www.gtopala.com/ |
| Description: Like WinAudit, SIW is a GUI based system auditing tool was not designed solely for incident response, but can assist in gathering valuable system details from a running system. |
| Remote Collection Tools |
Recall that in some instances, to reduces system interaction, it is preferable and conducive to deploy live response tools from your trusted toolkit locally on a subject system but collect the acquired data remotely. This process requires establishing a network connection, typically with a netcat or cryptcat listener, and transferring the acquired system data over the network to a collection server. Remember, that although this method reduces system interaction, it relies on the ability of being able to traverse the subject network through the ports established by the netcat listener.
| Name: Netcat |
||||||||
| Page Reference: 3 | ||||||||
| Author/Distributor: Hobbit | ||||||||
| Available From: http://netcat.sourceforge.net | ||||||||
| Description: Commonly referred to as the "Swiss Army Knife" of tools, netcat is a versatile networking utility which reads and writes data across network connections, using the TCP/IP protocol. Netcat is commonly used by digital investigators during live response as a network based transfer solution. | ||||||||
Helpful Switches:
|
| Name: Cryptcat |
||||||||
| Page Reference: 3 | ||||||||
| Author/Distributor: L0pht | ||||||||
| Available From: http://cryptcat.sourceforge.net/ | ||||||||
| Description: Netcat enhanced with twofish encryption | ||||||||
Helpful Switches:
|
| Volatile Data Collection and Analysis Tools |
| Physical Memory Acquisition |
Chapter 1 emphasized the importance of first acquiring a full memory dump from the subject system prior to gathering data using the various tools in your live response toolkit. This is important, particularly due to the fact that running incident response on the subject system will alter the contents of memory. To get the most digital evidence out of physical memory, it is advisable to perform a full memory capture prior to running any other incident response processes. There are a variety of tools to accomplish this task, described below.
| Name: Forensic Acquisition Utilities (FAU)/dd ("dd.exe") |
| Page Reference: 7 |
| Author/Distributor: George M. Garner, Jr. |
| Available From: http://gmgsystemsinc.com/fau/ |
| Description: A commonly used approach to capture the physical memory of a Windows system is running the “dd” (dd.exe) command from removable media and gathering the contents either locally to external media or over a remote collection utility, such as netcat. Unlike *nix distributions, dd, is not a native utility to Windows systems; George M. Garner, Jr. ported dd and included it in his freely available Forensic Acquisition Uilities in 2007; versions of utility were included in older versions of the Helix Live Response CD. -The following command takes the contents of memory from a Windows system and saves it to a file on removable media along with the MD5 hash, for integrity validation purposes and audit log that documents the collection process. E:\WinIR\memory>dd.exe if=\\.\PhysicalMemory of="E:\images\host1 memoryimage-20070124.dd" conv=sync,noerror --md5sum --verifymd5 --md5out="E:\images\host1-memoryimage-20070124.dd.md5" --log="E:\images\host1-memoryimage-20070124.dd_audit.log" |
To ensure consistency and avoid typographical errors, the same command can be launched via an older version of the Helix graphical user interface: |
| Name: FastDump/FastDump Pro | ||||||||||||||||||||||||
| Page Reference: 6 | ||||||||||||||||||||||||
| Author/Distributor: HBGary | ||||||||||||||||||||||||
| Available From: FastDump Community version is available from http://hbgary.com/free-tools#fastdump; FastDump Pro is available from http://hbgary.com/fastdump | ||||||||||||||||||||||||
| Description: Commandline physical memory acquisition tools. -The FastDump community version (FD.exe) is a free version of FastDump that supports the acquisition of memory from 32 bit systems with up to 4 gigabytes of RAM (does not support Vista, Windows 2003, or Windows 2008, or 64 bit platforms). -FastDump Pro (FDPro.exe) is the commercially supported version of Fastdump, which supports all versions of Window operating systems and service packs and can acquire memory from both 32 and 64 bit systems, including systems with more than 4 gigabytes of RAM (up to 64 gigs of RAM), including the Windows pagefile. -Memory dumps acquired by both versions are saved as .bin files; FastDump Pro memory file dump files, including pagefile acquisition, are saved as .hpak files and the command switches associated with creating .hpak files slightly vary. |
||||||||||||||||||||||||
| Helpful Switches: FastDump Community
FastDump Pro
|
| Name: Memoryze | ||||
| Page Reference: 7 | ||||
| Author/Distributor: Mandiant | ||||
| Available From: http://www.mandiant.com/products/free_software/memoryze/ | ||||
|
Description: Memoryze is a physical memory acquistion and analysis tool for Windows systems. Unlike other memory acquisition tools, memoryze allows the digital investigator to perform advanced analysis of memory from a live subject system, or from an acquired memory dump. Memoryze officially supports memory acquisition from the following operating systems: -Windows 2000 Service Pack 4 (32-bit)-Windows XP Service Pack 2 and Service Pack 3 (32-bit) -Windows Vista Service Pack 1 and Service Pack 2 (32-bit) -Windows 2003 Service Pack 2 (32-bit) -Windows 2003 Service Pack 2 (64-bit) -Windows 7 Service Pack 0 (32-bit) [Beta] -Windows 7 Service Pack 0 (64-bit) -Windows 2008 Service Pack 0 (64-bit) [Beta] The official Memoryze User Guide (version 1.4.2900 as of this writing) is available from http://www.mandiant.com/products/free_software/memoryze/. -To acquire a physical memory image with Memoryze, invoke the memoryzeDD.bat script from your live response tool kit. |
||||
|
Helpful Switches:
|
| Name: Mantech DD (MDD) | ||||||||
| Page Reference: 7 | ||||||||
| Author/Distributor: Ben Stotts/Mantech | ||||||||
| Available From: http://sourceforge.net/projects/mdd/ |
||||||||
| Description: MantechDD is a physical memory acquistion tool for Windows systems. MDD is capable of acquiring memory images (up to 4 gigabytes) from the following operating systems: -Windows 2000 -Windows Server 2003 -Windows XP -Windows Vista, and -Windows Server 2008 |
||||||||
|
Helpful Switches:
|
| Name: MoonSols Windows Memory Toolkit/Win32dd |
| Page Reference: 7 |
| Author/Distributor: Matthieu Suiche/MoonSols |
| Available From: http://moonsols.com/product |
|
Description: The MoonSols Memory Toolkit (MMT) is a physical memory acquisition, conversion and analysis took kit that is available in Professional (commercial) and Community (freeware) versions. Included in the MMT is Win32dd, a command-line based tool used to acquire physical memory images. |
|
Helpful Switches:
|
| Collecting Subject System Details |
System details are a fundamental aspect of understanding a malicious code crime scene. In particular, system details will inevitably be crucial in establishing an investigative timeline, and identifying the subject system in logs and other forensic artifacts. In addition to the tools mentioned in the chapter, others tools consider include:
| Name: DumpWin |
| Page Reference: 13 |
| Author/Distributor: Nii Consulting |
| Available From: http://www.niiconsulting.com/innovation/tools.html |
|
Description: Another tool to consider implementing while collecting subject system details is NII Consulting’s DumpWin, a multipurpose utility that can assist in collecting general system information among other items, such as a list of all software installed on the system, shares present, startup programs, active processes, list and status of services, list of local Group Accounts and User Accounts, among other things, as shown in the tool menu, below E:\WinIR\Sysinfo>DumpWin.exe DumpWin v2.00 (Windows NT/2K) Network Intelligence India Pvt. Ltd. http://www.nii.co.in Arjun Pednekar (arjunp@nii.co.in)
Parameters : -i : List installed Programs. -d : Drive Information. -s : System Information. -m : Check for Modem Drivers. -h : List shares present. -t : List Startup Programs. -p : List active Processes. -v : List of Services. -g : List Local Group Accounts -u : List User Accounts. -l : dumpACL -n : Account Lockout Policy -a : All of above. |
| Name: Srvinfo (Server Information) | ||||
| Page Reference: 13 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: Included in the Windows NT Resource Kit Supplement 4 and the Windows 2000 Server Resource Kit | ||||
| Description: Srvinfo is a command line utility that that displays detailed system information including the subject system name, uptime, operating system, build, service pack, hotfixes, registered owner, registered company, hostname, enabled protocols, running/stopped services and drivers, network card, and IP address, among other information | ||||
|
Helpful Switches:
|
| Identifying Users Logged into the System |
Remember that identifying users logged into the subject system servers a number of investigative purposes: 1) Help discover any potential intruders logged into the compromised system; 2) Identify additional compromised systems; 3) provide insight into a malicious insider malware incident; and provides additional investigative context by being correlated with other artifacts. Some other tools to consider for this task include:
| Name: Quser (Query User Utility) | ||||||||
| Page Reference: 14 | ||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: http://technet.microsoft.com/en-us/library/cc754583%28WS.10%29.aspx | ||||||||
|
Description: A useful tool for identifying logged-in users is the Microsoft Query User utility, or quser, which reveals logged-in users, the time and date of logon time, and the session type and state among other details, as seen in below. |
||||||||
Helpful Switches:
|
| Name: Netusers | ||||||||||||
| Page Reference: 14 |
||||||||||||
| Author/Distributor: Systemtools | ||||||||||||
| Available From: http://www.systemtools.com/free.htm | ||||||||||||
|
Description: Another helpful utility to identify users logged onto a system is Netusers, which provides the digital investigator with the ability to query a subject system for users logged on locally to the system, as well as the last logon date of each user account, as seen below.
|
||||||||||||
Helpful Switches:
|
| Name: LoggonSessions | ||||||
| Page Reference: 14 |
||||||
| Author/Distributor: Microsoft | ||||||
| Available From: http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx. | ||||||
| Description: Logonsessions is a CLI utility developed by Bryce Cogswell, that is a part of the PSTools suite. Querying the subject system with logonsessions with the –p argument reveals the processes running in the logged-on session, which is helpful information in a malicious code incident. | ||||||
|
Helpful Switches:
|
| Network Connections and Activity |
Malware network connectivity is a critical factor to identify and document; connectivity from a subject system may be to communicate with an attacker’s command and control structure, download additional malicious files, or to exfiltrate data from the system, among other things. In addition to netstat, openports, fport, currports, and other tools mentioned in the chapter, another to consider is tcpvcon.
| Name: tcpvcon | ||||||||
| Page Reference: 22 | ||||||||
| Author/Distributor: Mark Russinovich/Microsoft (formerly Sysinternals) | ||||||||
| Available From: http://technet.microsoft.com/en-us/sysinternals/bb897437 | ||||||||
| Description: Tcpvcon is a command-line utility that is bundled with the Microsoft utility TCPView, a graphical based utility that diplays TCP/IP and UDP connections and endpoints in realtime. Tcpvcon provides granular and structured output, identifying the protocol of the connection, the path of the executable spawning the network connection, the process ID, network connection state, local address and the address of the remote connection, as shown in the output below. E:\WinIR\Network>tcpvcon.exe -a TCPView v2.34 - TCP/UDP endpoint lister Copyright (C) 1998-2003 Mark Russinovich Sysinternals - www.sysinternals.com [TCP] C:\WINDOWS\temp\spoolsv\spoolsv.exe PID: 864 State: LISTENING Local: Kim-mrktg-ws5:auth Remote: xxx.xxx.xxx.xxx:6667 [TCP] C:\WINDOWS\system32\svchost.exe PID: 1004 State: LISTENING Local: Kim-mrktg-ws5:epmap Remote: Kim-mrktg-ws5:0 |
||||||||
Helpful Switches:
|
| Process Analysis |
As many malware specimens (such as worms, viruses, bots, key loggers, and Trojans) will often manifest on the subject system as a process, collecting information relating to processes running on a subject system is essential in malicious code live response forensics. Process analysis should be approached holistically—examine all relevant aspects of a suspicious process, as outlined in the chapter. Below are additional tools to consider for your live response toolkit.
| Name: pmon |
| Page Reference: 18 |
| Author/Distributor: Microsoft |
| Available From: http://www.microsoft.com/downloads/en/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en |
|
Description: Pmon is very similar to that of the top command in *Nix systems, providing for a real-time granular look at the statistics relating to running processes such as memory usage and duration. |
| Name: pstat (process and thread status) |
| Page Reference: 18 |
| Author/Distributor: Microsoft |
| Available From: http://support.microsoft.com/kb/927229; (http://download.microsoft.com/download/win2000platform/pstat/1.0/nt5/en-us/pstat.exe) ; Available in the Windows XP SP2 Support Tools pack |
| Description: Process and thread analysis tool. |
| Name: pulist |
||||||
| Page Reference: 18 |
||||||
| Author/Distributor: Microsoft | ||||||
| Available From: http://support.microsoft.com/kb/927229; (http://download.microsoft.com/download/win2000platform/pulist/1.00.0.1/nt5/en-us/pulist_setup.exe); also available from the Windows 2000 Resource Kit | ||||||
| Description: Similar to tlist, pulist displays processes that are running on local or remote computers, but also lists the user name that is associated with each process on a local computer. | ||||||
|
Helpful Switches:
|
| Name: memsnap (Microsoft Memory Snapshot utility) | ||||
| Page Reference: 18 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: http://technet.microsoft.com/en-us/library/cc757686%28WS.10%29.aspx | ||||
| Description: Takes a snapshot of the memory resources being consumed by all running processes and writes this information to a log file (memsnap.log by default). | ||||
Helpful Switches:
|
| Handles |
| Name: OpenHandles |
| Page Reference: 21 |
| Author/Distributor: Microsoft |
| Available From: http://support.microsoft.com/kb/927229 and http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe. |
| Description: In addition to handle, another utility that can be used to inspect file handles is Microsoft’s Open Handles (oh.exe) utility, which is available as part of the Windows 2000 Resource Kit Tools for administrative tasks. |
| Loaded DLLs |
| Name: Procinterrogate | ||||||||||
| Page Reference: 21 |
||||||||||
| Author/Distributor: Kirby Kuehl/WinFingerprint | ||||||||||
| Available From: http://winfingerprint.sourceforge.net/wininterrogate.php | ||||||||||
|
Description: Procinterrogate allows the digital investigator to identify all DLLs imported by running processes, but also gives the investigator the ability to query individual processes by PID using the –pid switch. Further, the procinterrogate output provides the entry point address of each loaded module, as shown in the output excerpt below: E:\WinIR\Processes>procinterrogate.exe -pid 864 |
||||||||||
Helpful Switches:
|
| Name: PRCView (pv.exe) | ||||||||||||||
| Page Reference: 21 |
||||||||||||||
| Author/Distributor: Igor Nys/CTI | ||||||||||||||
| Available From: http://www.teamcti.com/pview/prcview.htm | ||||||||||||||
| Description: PRCView is a powerful process viewing suite of tools that comes with both a GUI based utility and a command line functional equivalent, named pv.exe. Using the pv -m <process name> switch provides very similar output to procinterrogate, and reveals the Module, Base, Size and Path of the DLLs associated with the queried process. | ||||||||||||||
Helpful Switches:
|
| Name: ListModules | ||||
| Page Reference: 21 |
||||
| Author/Distributor: Arne Vidstrom | ||||
| Available From: http://ntsecurity.nu/toolbox/listmodules/ | ||||
| Description: ListModules reveals the modules loaded into a process in memory on the subject system in a clean and intuitive format. | ||||
Helpful Switches:
|
| Name: tlist | ||||||
| Page Reference: 20; 26 |
||||||
| Author/Distributor: Microsoft | ||||||
| Available From: http://www.microsoft.com/downloads/en/details.aspx?familyid=C055060B-9553-4593-B937-C84881BCA6A5&displaylang=en | ||||||
| Description: tlist is a multi-functional process analysis tool, with specific functionality to extract information regarding loaded modules from running processes. | ||||||
Helpful Switches:
|
| Name: tasklist | ||||
| Page Reference: 19 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: Trusted Windows system; user guide available from http://technet.microsoft.com/en-us/library/bb491010.aspx. | ||||
| Description: From Windows XP forward, Microsoft replaced the tlist utility with tasklist, a command line process analysis tool with similar functionality. A noticable difference between the tools is switch invocation—which in the case of tasklist is the use of slashes as opposed to dashes. Tasklist also lacks some of the robustness and granular analysis options that tlist has, such as the ability to extract commandline arguments from running processes and individually inspect processes. | ||||
Helpful Switches:
|
| Command Line Arguments |
| Name: tlist | ||||
| Page Reference: 20 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: http://www.microsoft.com/downloads/en/details.aspx?familyid=C055060B-9553-4593-B937-C84881BCA6A5&displaylang=en | ||||
| Description: Tlist, referenced above in the ”Loaded DLLs” section, can also be used to display the command line arguments associated with all running processes on a subject system. | ||||
|
Helpful Switches:
|
| Services |
| Name: psservice | ||||||||
| Page Reference: 24 |
||||||||
| Author/Distributor: Mark Rusinovich/Microsoft (formerly Sysinternals) | ||||||||
| Available From: http://technet.microsoft.com/en-us/sysinternals/bb897542.aspx | ||||||||
| Description: Provides a very detailed view of the services on a subject system | ||||||||
|
Helpful Switches:
|
| Name: ServiWin | ||||||||
| Page Reference: 24 |
||||||||
| Author/Distributor: Nirsoft | ||||||||
| Available From: http://www.nirsoft.net/utils/serviwin.html | ||||||||
|
Description: GUI and CLI tool Serviwin, which when used with the /stext ><log file name> switch, provides a detailed description of each individual service |
||||||||
|
Helpful Switches:
|
| Name: servicelist | ||||
| Page Reference: 24 |
||||
| Author/Distributor: Path Solutions | ||||
| Available From: http://www.pathsolutions.com/resource-center/tools/#windows | ||||
| Description: Another tool to consider implementing is servicelist from Path Solutions, which provides the investigator with a very structured output that includes the service name, display name, state, type, and controls. | ||||
|
Helpful Switches:
|
| Name: Sclist (Service Controller List Tool) | ||||||||
| Page Reference: 24 |
||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: Windows NT Resource Kit Supplement 4 and the Windows 2000 Server Resource Kit | ||||||||
| Description: Sclist is a command line utility that displays three columns, including service state, service name and service display name. | ||||||||
Helpful Switches:
|
| Name: Srvinfo (Server Information) | ||||
| Page Reference: 24 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: Included with the Windows NT Resource Kit Supplement 4 and the Windows 2000 Server Resource Kit. | ||||
| Description: CLI tool that displays service states and display names. | ||||
|
Helpful Switches:
|
| Name: Tlist | ||||
| Page Reference: 24 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: http://www.microsoft.com/downloads/en/details.aspx?familyid=C055060B-9553-4593-B937-C84881BCA6A5&displaylang=en | ||||
| Description: Included with Microsoft Debugging Tools for Windows, tlist –s identifies any services active in each running process. | ||||
|
Helpful Switches:
|
| Name: Net | ||||
| Page Reference: 24 |
||||
| Author/Distributor: Microsoft | ||||
| Available From: Trusted Windows system | ||||
| Description: Net is multipurpose native Windows utility. Used with the start switch, net provides a list of running services by display name only. | ||||
Helpful Switches:
|
| Name: SvcUtil | ||||
| Page Reference: 24 |
||||
| Author/Distributor: Joeware | ||||
| Available From: http://www.joeware.net/freetools/tools/svcutil/index.htm | ||||
| Description: SvcUitl is a simple command-line service analysis utility. The operative command switch is simply a period (“.”) . | ||||
Helpful Switches:
|
| Drivers |
| Name: ListDrivers |
| Page Reference: 25 |
| Author/Distributor: Arne Vidstrom |
| Available From: http://ntsecurity.nu/toolbox/ |
| Description: ListDrivers is a lightweight command-line utility that lists the loaded kernel drivers and associated memory addresses on a subject system. The tool does not require (nor have) any command switches to invoke. |
| Opened Files |
| Name: openfiles | ||||||||
| Page Reference: 25 |
||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: Trusted Windows system; user reference is available from http://technet.microsoft.com/en-us/library/bb490961.aspx | ||||||||
| Description: An alternative to OpenedFilesView is openfiles, a command-line utility that can query and display files that are opened locally or by network users . | ||||||||
|
Helpful Switches:
|
| Determining Scheduled Tasks |
| Name: schtasks | ||||||||
| Page Reference: 27 | ||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: Trusted system; information regarding the utility is available from http://technet.microsoft.com/en-us/library/cc772785%28WS.10%29.aspx | ||||||||
| Description: Schtasks is native microsoft utility that provides detailed information regarding any tasks scheduled on the subject system; the level of granularlity in the output can be calibrarted using a combination of swtiches. To simply identify whether there are any tasks scheduled on the system, simply invoke the "schtasks /query" command; if you identify a scheduled task, detailed information can be extracted using the command string "schtasks /query /fo /LIST /v" | ||||||||
Helpful Switches:
|
| Clipboard Content |
| Name: InsideClipboard | ||||||
| Page Reference: 27 |
||||||
| Author/Distributor: NirSoft | ||||||
| Available From: http://www.nirsoft.net/utils/inside_clipboard.html | ||||||
| Description: Another tool that can be used to harvest clipboard contents is NirSoft’s InsideClipboard, which is a GUI and CLI utility that displays the binary content of all formats that are currently stored in the clipboard, and allows you to save the content of specific format into a binary file. InsideClipboard can be invoked from the command prompt, and the results of the query can be saved in multiple report formats including standard text, Hypertext Markup Language (HTML), and eXtensible Markup Language (XML), among others. | ||||||
|
Helpful Switches:
|
| Non-Volatile Data Collection and Analysis Tools |
| System Security Configuration |
| Name: Microsoft Baseline Security Analyzer | ||||||
| Page Reference: 30 |
||||||
| Author/Distributor: Microsoft | ||||||
| Available From: http://msdn2.microsoft.com/en-us/library/aa302360.aspx | ||||||
| Description: Microsoft Baseline Security Analyzer (MBSA), available in both a GUI (Mbsa.exe) and command-line (Mbsacli.exe) utility scans a subject system for a insecure configurations and checks for available updates, service packs and patches for the operating system, among other things. | ||||||
Helpful Switches:
|
| Prefetch File Analysis |
| Name: Windows File Analyzer |
| Page Reference: 31 |
| Author/Distributor: Mitec |
| Available From: http://www.mitec.cz/wfa.html |
|
Description: Recall that when a program is executed, the Windows operating system creates a “prefetch” file that enables speedier subsequent access to the program. Embedded within the Prefetch files are the most recent time a program was executed (bytes 120–128) and the number of times it was executed (bytes 144–148). This embedded information can be extracted manually, or using a tool like Windows File Analyzer. The figure below shows Windows File Analyzer being used to view the Prefetch information on a subject system. Another approach to viewing this information is to mount the forensic duplicate using a tool like MountImage Pro and directing Windows File Analyze to read the Prefetch folder on the mounted drive, as discussed in Chapter 3. The rightmost column shows the number of times the executable was run, but this number is not incremented when an executable is automatically run from an autostart location when the system boots |
 |
| Auto-starting Locations |
As we discussed in the chapter, malware often has a persistence mechanism to ensure longevity on a computer. A frequent method used for this purpose is the creation of an auto-start location (also referred to as an “autorun”) in the registry. In addition to the Microsoft Autoruns tool, another option for discovering and analyzing autorun locations is StartupRun.
| Name: StartupRun (strun) | ||||||
| Page Reference: 32 |
||||||
| Author/Distributor: Nirsoft | ||||||
| Available From: http://www.nirsoft.net/utils/strun.html | ||||||
|
Description: StartupRun is an alternative GUI and command-line utility available from Nirsoft for displaying applications that are loaded automatically when Windows boot up, including the registry key associated with program. Using StartupRun to query our subject system we can identify an autorun location for the suspect process spoolsv, as shown in the output, below: ================================================== |
||||||
Helpful Switches:
|
| Event Logs |
On Windows systems, many activities related to a malware incident can generate entries in the Event Logs. Some other Event Log dumping tools to consider for your live response toolkit include:
| Name: psloglist | ||||||||
| Page Reference: 32 |
||||||||
| Author/Distributor: Mark Russinovich/Microsoft (formerly Sysinternals) | ||||||||
| Available From: http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx | ||||||||
| Description: Psloglist is a function rich Windows Event Log dumping tool, providing the digital investigator with numerous options to customize the scope, breadth, and presentation of the data output. | ||||||||
Helpful Switches:
|
| Name: Dump Event Log (dumpel) | ||||||||
| Page Reference: 32 |
||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: Windows 2000 Resource Kit; http://download.microsoft.com/download/win2000platform/WebPacks/1.00.0.1/NT5/EN-US/Dumpel.exe | ||||||||
| Description: Dump Event Log (dumpel) is a command-line utility that dumps a specified Windows Event Log for a local system or a remote system into a tab-separated text file; the tool also provides numerous event filtering switches. | ||||||||
Helpful Switches:
|
| Name: dumpevt | ||||||||||
| Page Reference: 32 |
||||||||||
| Author/Distributor: Somarsoft | ||||||||||
| Available From: http://www.systemtools.com/cgi-bin/download.pl?DumpEvt | ||||||||||
| Description: Similar to Dumpel, above, Dumpevt is a command-line tool that dumps event log messages to a text file (stdout). A key distinction between the tools is that in addition to the traditional Windows Event Viewer logs—Application, System and Security—dumpevt dumps additional logs: DNS (dns), File Replication (rpl), and Directory Service (dir) The results of the dump output are written to files specified by "/outfile" or "/outdir." | ||||||||||
Helpful Switches:
|
| Group Policies |
Remember to closely inspect user accounts that are local to the subject system or domain accounts that were used to log in—these can reveal how malware was placed on the computer. Below are additional tools that assist in examining user and group policy details.
| Name: GPList |
| Page Reference: 33 |
| Author/Distributor: Arne Vidstrom |
| Available From: http://ntsecurity.nu/toolbox/ |
| Description: Displays information about the following Group Policies applied to a system: Folder Redirection, Microsoft Disk Quota, QoS Packet Scheduler, Scripts, Security, Internet Explorer Branding, EFS recovery, Software Installation, and IP Security. The tool does not require (nor have) any command switches to invoke. |
| Name: UserDump | ||||||||
| Page Reference: 33 |
||||||||
| Author/Distributor: Joeware | ||||||||
| Available From: http://www.joeware.net/freetools/tools/userdump | ||||||||
| Description: List user accounts and associated information on a specified machine (/) | ||||||||
Helpful Switches:
|
| Name: GPResult | ||||||
| Page Reference: 33 |
||||||
| Author/Distributor: Microsoft | ||||||
| Available From: Windows Resource Kit or trusted system | ||||||
| Description: GRPesult is a command-line tool that verifies all policy settings for a specific user or computer. | ||||||
|
Helpful Switches:
|
| Name: Showmbrs | ||||||||
| Page Reference: 33 |
||||||||
| Author/Distributor: Microsoft | ||||||||
| Available From: Windows Resource Kit or trusted system | ||||||||
| Description: List all members of a given workgroup | ||||||||
|
Helpful Switches:
|
| File System: Hidden Files and Alternate Data Streams |
| Name: HFind | ||||
| Page Reference: 33 |
||||
| Author/Distributor: Foundstone | ||||
| Available From: http://www.mcafee.com/us/downloads/free-tools/index.aspx | ||||
|
Description: Hfind is a command-line utility included in the Foundstone Forensic Toolkit 2.0—a collection of freeware command-line utilities that allow the digital investigator to investigate a subject system (NTFS file system only) for metadata and artifacts. In particular, Hfind can be used to scan the target system for hidden files. If hidden files are detected, HFind lists the last access times to the files. Querying our subject system (targeting what we have learned through our investigation to be a suspicious directory) with HFind we discover numerous hidden files, as shown in the output below: E:\WinIR\Hiddenfiles\ForensicToolkit20>HFind.exe C:\WINDOWS\Temp |
||||
|
Helpful Switches:
|
| Name: LADS (List Alternate Data Streams) | ||||||||||
| Page Reference: 33 |
||||||||||
| Author/Distributor: Frank Heyne Software | ||||||||||
| Available From: www.heysoft.de |
||||||||||
| Description: As the name of the tool suggests, LADS lists files on Windows NTFS file systems that contain alternate data streams (ADS). LADS provides the digital investigator with an intuitive menu and command switch options. To invoke LADS, simply excute the utility at the command line and identify the target directory: LADS <Directory>; additional command switches can dig deeper into subdirectories and | ||||||||||
|
Helpful Switches:
|
| Name: lns (List NTFS Streams) |
| Page Reference: 33 |
| Author/Distributor: Arne Vidstrom |
| Available From: http://ntsecurity.nu/toolbox/ |
| Description: Like LADS, lns identifies alternate data streams on NTFS file systems. Lns is slightly less robust than LADS and simply requires the drive letter and target directory path as a parameters to invoke the tool: lns < drive\directory>. The tool does not have any additional command switches. |
| Name: streams | ||||
| Page Reference: 33 |
||||
| Author/Distributor: Mark Russinovich/Microsoft (formerly Sysinternals) | ||||
| Available From: http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx | ||||
| Description: Another helpful tool for identifying NTFS alternate data streams is Mark Russinovich’s streams. Similar to LADS, streams provides the digital investigator with the option of scanning subdirectories of investerest with a command switch (-s). The only required command parameter needed to invoke streams is a target file or directory name: streams.exe <file or directory> | ||||
|
Helpful Switches:
|
| Web History |
With client-side exploits become more and more prevalent, particularly through “drive-by-downloads.” Drive-by-downloads often occur when a user with an insecure or improperly configured web browser navigates to a compromised (or nefarious) web site that is surreptitiously hosting malware—allowing the malware to silently be downloaded onto the victim system. As a result, it is always advisable to examine the subject system web history to gain insight into whether a web based vector of attack caused the malicious code incident.
|
Name: Pasco |
| Page Reference: 33 |
| Author/Distributor: Foundstone |
| Available From: http://www.mcafee.com/us/downloads/free-tools/index.aspx |
| Description: Pasco is multi-platform command-line utility that parses Internet Explorer history files (Index.dat), the results of which are output into a field delimited text file, enabling the digital investigator to import into as spreadsheet to further analyze the data. |
| Name: Nirsoft Web History Tools |
| Page Reference: 33 |
| Author/Distributor: Nirsoft |
| Available From: http://www.nirsoft.net/utils/ |
|
Description: Nirsoft offers a variety of free dual functional GUI/command line tools that can extract and help resconstruct the web browsing history on a subject system. Some of these tools include: -IEHistoryView-Extracts information from the history file (index.dat) of Internet Explorer; stores only one record for every Web page visit. -IECacheviewer-Similar to IEHistoryView, the cache file stores multiple records for every Web page, including all images and other files loaded by the Web page. -IECookieView- Extracts the content of all cookie files stored by Internet Explorer. -MozillaHistoryView-extracts the details of all browsing history stored by Mozilla Firefox -MozillaCacheView-extracts the details of all cache files stored by Mozilla Firefox -MozillaCookieView-extracts the content of all cookie files stored by Mozilla Firefox -FavoritesView-Extracts list of Favorites/Bookmarks -ChromeCacheView-extracts the details of all cache files stored by Google Chrome Web browser -OperaCacheView-extracts the details of all cache files stored by Opera Web browser. -MyLastSearch-Scans the cache files for the four web browsers (IE, Mozilla, Opera, and Chrome) and extracts recent search queries made from the subject system. |
| Malware Extraction |
As discussed in Chapter 1, once a suspicious file is identified through live response, safely extractly and preserving the files for further analysis is an essential aspect of malware forensics. Another tool to consider for this process is HBGary’s FGET
| Name: FGET | ||||||||||||||
| Page Reference: 39 | ||||||||||||||
| Author/Distributor: HBGary | ||||||||||||||
| Available From: http://www.hbgary.com/free-tools | ||||||||||||||
|
Description: FGET is a command-line utility that can acquire files from local and remote subject systems. -Using FGET from our trusted live response tool kit locally on a subject, we can quickly acquire a suspicious file by invoking the tool using the "–extract" switch, identifying the target file and the location of where to copy the file, as shown in the output below: E:\WinIR\Extraction\FGET>FGET.exe -extract c:\WINDOWS\Temp\spoolsv\spoolsv.exe E:\WinIR\Extraction\Evidence\spoolsv.exe -= FGET v1.0 - Forensic Data Acquisition Utility - (c)HBGary, Inc 2010 =- [+] Extracting File From Volume ...SUCCESS!
-FGET is also intended for acquisition of files over a network, with varying degrees of difficulty and system preparation. To use FGET on remote systems, the local acquisition system must have a repository directory created (by default the directory is C:\FGETREPOSITORY). -Using the remote acquition capabilities of FGET we can copy the suspicious file from the subject system over the network from our analysis system, as shown in the output below. Note that FGET places the target files in the FGETREPOSITORY directory, and in turn, in an auto-generated subdirectory name to comport with the target system IP address in an effort to easily parse acquisition results. E:\WinIR\Extraction\FGET>FGET.exe -scan 192.168.79.130 -extract c:\WINDOWS\Temp\spoolsv\spoolsv.exe |
||||||||||||||
|
Helpful Switches: Local System Commands
Remote System Commands
|
