You are browsing the archive for Reversing.

aitstatic.exe – Application Impact Telemetry Static Analyzer – brief analysis wannabe post

January 28, 2018 in Forensic Analysis, Reversing

I was browsing the Windows 10 system32 directory and this executable caught my eyes. I never looked at it before and the information on the internet was scarce. After checking its version information I learned that it’s supposed to be ‘Application Impact Telemetry Static Analyzer’. There is a thread on the Microsoft site that summarizes all the information about this program quite well (nothing is known :)), but the last entry at the time I read it says this (edited to remove some obvious typos):

The Microsoft Application Impact Telemetry Agent is installed with Windows and runs as a scheduled task when Windows boots. Application Impact Telemetry Agent is designed to collect various system information and report to Microsoft as part of Windows Customer Experience Improvement Program (CEIP). CEIP collects information about how our customers use Microsoft programs and about some of the problems they encounter.

Basically a spyware, collects information from your computer and sends it to the NSA servers Microsoft servers.

Still not much wiser I decided to poke around a bit more. I discovered that it takes a number of various arguments that I don’t fully understand, but for these I figured out I decided to document.

Who knows, maybe someone will find it useful.

So…

  • -arp — no idea
  • -dir <directory> — scans directory and retrieves telemetry for files present in the directory
  • -dn – no idea
  • -dnf – no idea
  • -dro — no idea
  • -e — enables logging the errors to the screen; it’s helpful to enable it during searches
  • -fid — file ID for which telemetry is retrieved (see below)
  • -fp — no idea
  • -le — no idea
  • -o — output file
  • -op — no idea
  • -pfn — no idea
  • -ph — no idea
  • -pid — program PID for which telemetry is retrieved (see below)
  • -ui — no idea
  • -wrt — no idea

The syntax is a bit quirky, so it’s good to always include the ‘-e’ argument to enable output of the error messages.

The PID (–pid) is not a process ID (decimal or hexadecimal), but a 44-character long string. I was surprised at first, until I used Procmon and discovered that the program is reading ‘\REGISTRY\A\’ hive which is a result of using RegLoadAppKey API function that in turn loads the local hives in a temporary folder that seem to be similar to the ‘Amcache.hve’ file. (update: I have updated the previous paragraph after some more testing – the ‘\REGISTRY\A\’ is related to the locally create hive file, but not ‘Amcache.hve’, at least not directly)

The PID it expects is an identifier one can find under the Programs node:

  • Root\Programs\

as shown using an excellent Registry Explorer from Eric R. Zimmerman’s toolkit:

So… one can run e.g. this:

  • aitstatic.exe -e -o pid_test -pid 00006f8ae7433257edc86c41e1350afdf5510000ffff

and obtain an output file ‘pid_test’ that contains the following data:

<?xml version="1.0" encoding="utf-8"?>
<AitStaticAnalysis 
 ProgramId="00006f8ae7433257edc86c41e1350afdf5510000ffff" 
 AnalysisVersion="1.60" 
 DictionaryVersion="3.1" 
 Type="Program" 
 Id="00006f8ae7433257edc86c41e1350afdf5510000ffff"/>

Not much. I tried to run it with other PIDs I spotted and eventually got a much larger file as a result of using the Total Commander’s program ID obtained from ‘Amcache.hve’.

<?xml version="1.0" encoding="utf-8"?>
<AitStaticAnalysis 
 ProgramId="0000ab4489404bbd3353a97823b213e6ab910000ffff" 
 AnalysisVersion="1.60" 
 DictionaryVersion="3.1" 
 Type="Program" 
 Id="0000ab4489404bbd3353a97823b213e6ab910000ffff">
<AitFile 
 ErrorCode="0" 
 Name="TCMDLZMA.DLL" 
 Id="0000101c41574f37269984e55e89e49dcf0b0db2e695">
<AitCategory Id="ApiStatic">
<AitFeature Name="kernel32.dll!CloseHandle"/>
<AitFeature Name="kernel32.dll!CreateEventA"/>
<AitFeature Name="kernel32.dll!CreateSemaphoreA"/>
<AitFeature Name="kernel32.dll!CreateThread"/>
<AitFeature Name="kernel32.dll!DeleteCriticalSection"/>
<AitFeature Name="kernel32.dll!EnterCriticalSection"/>
<AitFeature Name="kernel32.dll!ExitProcess"/>
<AitFeature Name="kernel32.dll!ExitThread"/>
<AitFeature Name="kernel32.dll!FreeEnvironmentStringsA"/>
<AitFeature Name="kernel32.dll!FreeEnvironmentStringsW"/>
<AitFeature Name="kernel32.dll!GetACP"/>
<AitFeature Name="kernel32.dll!GetCPInfo"/>
<AitFeature Name="kernel32.dll!GetCommandLineA"/>
<AitFeature Name="kernel32.dll!GetCurrentProcess"/>
<AitFeature Name="kernel32.dll!GetCurrentThreadId"/>
...
[...]

The file is pretty long and appears to contain:

  • List of programs in Total Commander directory – focuses is on .exe and .dll
  • Each binary is parsed to extract its static dependencies (imported functions)
  • The output file includes these dependencies in a fancy xml format

So, it’s a bit like running Dependency Walker on the whole directory and extracting the info about the files.

Another way to obtain the dependencies information is to use the ‘-dir’ parameter. It takes one argument which is a directory name we want to enumerate.

Running:

  • aitstatic.exe -e -o dir_test -dir .

will give us a similar listing and will include data from the current directory.

The FID parameter takes 2 44-character long identifiers that seem to be searched for inside the Root\File branch, but I didn’t make it work in the end.

All in all, probably a bit of wasted time, but perhaps someone will find it useful.

Enter Sandbox – part 15: rE[mn]u[mn]eration games

November 24, 2017 in Reversing, Sandboxing

Observing a malware is one thing. Observing the very same malware in a rich context is another.

The traditional approach to sandboxes focuses on scoring the sample’s badness, extracting IOCs, and not focusing that much on the in-depth analysis. It’s understandable, because in-depth analysis are not the ultimate goal. Still… being able to extract more information that may help with the manual analysis is always welcome. And it’s actually getting better – the competition is slowly changing the landscape and newer sandboxes support memory dumping, PE file rebuilding, show nice process / thread trees, various graphs, etc… and place more and more hooks in place. And then again, even if they intercept the most popular APIs, inline functions, or even intercept virtual tables, it may still not be enough.

I thought, what would happen if I intercepted not only the most popular APIs that are used by malware, but also these that are less-frequently looked at, and in particular, these that may help to understand a flow of events in a better context – enriching the data that sandbox presents and making the in-depth analysis easier.

What are these APIs?

Let me show you an example…

Imagine you intercept the function CreateToolhelp32Snapshot to take a note of the fact that the malware is enumerating processes. This may add to the ‘badness’ weight, but on its own is not a malicious feature per se. Lots of ‘clean’ processes enumerate processes.

What if we not only did that, but also intercepted Process32First and Process32Next?

This could be the result (output is simplified to demo the idea):

CreateToolhelp32Snapshot
Process32First: [System Process]
Process32Next: System
Process32Next: smss.exe
Process32Next: csrss.exe
Process32Next: winlogon.exe
Process32Next: services.exe
Process32Next: lsass.exe
Process32Next: svchost.exe
Process32Next: svchost.exe
Process32Next: svchost.exe
Process32Next: svchost.exe
Process32Next: svchost.exe
Process32Next: spoolsv.exe
Process32Next: explorer.exe
Opens Process: %WINDOWS%\explorer.exe
VirtualAllocEx: %WINDOWS%\explorer.exe
NtWriteVirtualMemory: %WINDOWS%\explorer.exe
VirtualAllocEx: %WINDOWS%\explorer.exe
NtWriteVirtualMemory: %WINDOWS%\explorer.exe
VirtualAllocEx: %WINDOWS%\explorer.exe
NtWriteVirtualMemory: %WINDOWS%\explorer.exe
VirtualAllocEx: %WINDOWS%\explorer.exe
NtWriteVirtualMemory: %WINDOWS%\explorer.exe
VirtualAllocEx: %WINDOWS%\explorer.exe
NtWriteVirtualMemory: %WINDOWS%\explorer.exe
CreateRemoteThread: %WINDOWS%\explorer.exe
NtResumeThread: %WINDOWS%\explorer.exe

Analysing a log like this tells you straight away that the malware is enumerating processes, and when it finds explorer.exe, it injects a bunch of buffers into it (possibly mapping sections of the PE payload?), and then creates a remote thread. As a result, the explorer.exe process now is hosting malicious payload.

While the code injection into explorer.exe can be deducted from manual dynamic analysis, or may be even obviously apparent when we are evaluating the process tree and network connections from a report generated by a sandbox, there is a subtle difference. The context these 2 additional intercepted APIs provide allows to be quite certain that the malware is actually quite specifically looking for the explorer.exe, and not for the other process.

It also tells us HOW the process is found.

And mind you, this is actually not a trivial question if you are doing in-depth malware analysis.

There are cases where this determination is very important. Having an ability to quickly determine if we are missing some target process on the test system can save us a lot of time spent on mundane manual analysis. This is actually one of the first questions your customer will ask you, especially when it comes to targeted attacks. It is a very responsible job to deliver the results and not to miss stuff!

When you look at malware that is highly targeted, f.ex. malware that is targeting Point of Sale systems, running it through a sandbox may _not_ give you any good results, because you either won’t see the process enumeration at all, or may miss the name of the process that the malware is looking for. The malware will look ‘broken’ to us. I can’t count how many times I wasted time on manual analysis and even incorrectly concluded that the malware is ‘broken’ while looking at heavily obfuscated, or bloatwarish malware samples. Until I started looking at the context of the early exit.

It is really helpful to be able to cheat a bit.

For the case of the process enumeration one can not only intercept the Process32First and Process32Next functions, but also enhance the results with the interception of string comparison functions.

If we get lucky, the result could look like this:

Process32First: [System Process]
lstrcmpiA ([System Process], explorer.exe)
Process32Next: System
lstrcmpiA (System, explorer.exe)
Process32Next: smss.exe
lstrcmpiA (smss.exe, explorer.exe)
Process32Next: csrss.exe
lstrcmpiA (csrss.exe, explorer.exe)
Process32Next: winlogon.exe
lstrcmpiA (winlogon.exe, explorer.exe)
Process32Next: services.exe
lstrcmpiA (services.exe, explorer.exe)
Process32Next: lsass.exe
lstrcmpiA (lsass.exe, explorer.exe)
Process32Next: vmacthlp.exe
lstrcmpiA (vmacthlp.exe, explorer.exe)
Process32Next: svchost.exe
lstrcmpiA (svchost.exe, explorer.exe)
Process32Next: svchost.exe
lstrcmpiA (svchost.exe, explorer.exe)
Process32Next: svchost.exe
lstrcmpiA (svchost.exe, explorer.exe)
Process32Next: svchost.exe
lstrcmpiA (svchost.exe, explorer.exe)
Process32Next: svchost.exe
lstrcmpiA (svchost.exe, explorer.exe)
Process32Next: spoolsv.exe
lstrcmpiA (spoolsv.exe, explorer.exe)
Process32Next: PERSFW.exe
lstrcmpiA (PERSFW.exe, explorer.exe)
Process32Next: explorer.exe
lstrcmpiA (explorer.exe, explorer.exe)

That makes the in-depth malware analysis supereasy, doesn’t?

I think there is a potential market for supporting in-depth malware analysis with sandbox technology – make the interception configurable (offer a list of APIs to monitor, allow time to run to be selected manually, rebuild files, perhaps give live access to the analysis box, etc.).

Reversing ykS is the limit.

And while I do commercial in-depth analysis and I may be shooting myself in a foot here, I can’t stress enough how important ROI is for both you and the customer.