Reference no: EM132577487 , Length: 4 pages

Part 1 - Dynamic Analysis Using Immunity Debugger

Perform an in-depth analysis on the sample Lab4.exe using Immunity Debugger. Your analysis should start with documenting the basic static file information (filename, size, MD5, SHA1, file type, and compile time). It is important to always document this information up front for forensic soundness. You must use the debugger to modify execution of the software. The software will not run unless certain conditions are met. You must modify the software at runtime to force it to execute until completion. You know the software has completed successfully when you get a success message.Screenshots accompanied by explanations must be included as evidence of your analysis. You must explain which values you changed, why you changed them, and how you changed them.

The software checks for three things before it will display the success message. Why do you suppose some malware would check for those specific things before installation? Include a concise summary of the sample. You may insert your analysis below, or you may create a separate document.

Part 2 - Kernel Debugging and Rootkits

1) Suppose you are analyzing a sample that is a suspected rootkit or a driver. You initially suspect a rootkit because you observe the following code.

What about this code is indicative that you may be dealing with a rootkit?

2) In the same sample, you see the malware is writing to the Mlwx486.sys file via a call to the WriteFile function. You then see the malware establish a connection to the service control manager by calling the OpenSCManager function. Following, you observe this code:

Explain what is happening in this code.

3) Suppose you executed the malware to verify if the service you suspected was installed and running. You did this through the "sc" utility and observed the following ouput:

As shown, the service is running. Being the motivated analyst you are, you attach a WinDbgkernel debugger to the VM to check if the driver was successfully loaded. The output, shown below, indicates that a driver was loaded because it has the same name as the .sys file that was created.

What is the address range of the loaded module of interest?

4) After analyzing the dropped Mlwx486.sys file in IDA, you observe the DriverEntry routine access theKeServiceDescriptorTable structure. Therefore, you suspect there may by some SSDT hooking. What is SSDT hooking?

5) You want to test your SSDT hooking theory by running the dd command on the SSDT. Here is your output:

Do you observe any evidence of SSDT hooking by the malware?

6) Which function can a rootkit call to register a handler for a particular interupt code in order to specify an ISR? What is the Interrupt Descriptor Table (IDT)?

7) Briefly describe the following rootkit defensive measures: Kernel Patch Protection (KPP, commonly referred to as PatchGuard), and driver signing enforcement.

Attachment:- Dynamic Analysis Using Immunity Debugger.rar