Category Archives: Forensic Analysis

SleepStudy logs

Posted on by

Update

After I posted it, Bryan linked to this article which explains how to generate SleepStudy report. Thx!

Old Post

A few days ago I came across ETL logs I have not seen before. They are residing inside c:\WINDOWS\System32\SleepStudy and I posted about them on Twitter. Not sure if anyone looked at them from a forensic perspective in the past – quick Twitter and Google search returned nothing of interest, hence decided to quickly describe it here.

The logs originate from “Microsoft-Windows-Kernel-Power” and “Microsoft-Windows-UserModePowerService” ETW providers. Files that can be found inside the directory are as follows:

  • c:\WINDOWS\System32\SleepStudy\
    • ScreenOn\ScreenOnPowerStudyTraceSession-YYYY-MM-DD-HH-MM-SS.etl
    • UserNotPresentSession.etl
    • user-not-present-trace-YYYY-MM-DD-HH-MM-SS.etl

These marked with a YYYY-MM-DD-HH-MM-SS patterns include timestamps, meaning multiple files following the same file naming pattern exist in the folder.

The user* files can be quickly converted from ETL to XML format by using the following commands:

tracerpt.exe <etlfile>

or

tracerpt.exe -of csv

if you prefer CSV output. The resulting files are dumpfile.xml or dumpfile.csv.

What triggered my interest was the fact we can see both paths and timestamps inside the output user* files:

I don’t know exactly what these log mean, but it can be yet another source of process execution telemetry.

Propagate, Ribbonate

Posted on by

I thought Propagate technique is a dead horse. Described, implemented, used in malware.

But.

There is perhaps one more possibility, or four.

When you open Windows Explorer and Ribbons are enabled:

the UIRibbon.dll DLL gets loaded into this process address space:

One of the things the DLL does is setting properties of its internal windows using the following methods:

  • HWndContainer::Build(HWND hWnd, char a2, struct HWndContainer **a3)
    • Property:0xA91C
  • OfficeSpace::Root::SetEventLogger(OfficeSpace::Root *this, struct IUIEventLogger *a2)
    • Property: 0xBCDE
  • NetUI::SetCommandManager(HWND hWnd, HWND hData, struct NetUI::ICommandManager *a3)
    • Property:0xBCDF
  • UXHwndEffectsManager::FInitialize@(HANDLE hData@, HWND hWnd@, bool a3, bool a4, bool a5)
    • Property (atom name): SCENIC_UXHWNDEFFECTSMANAGER_WINDOW_PROP

Example:

So, what do we do with this?

These are all possible targets for a Propagate code injection as all these properties appear to be holding virtual table pointers…