Trick to Identify the Malware Infection on Windows System | blog-windows Blog
These articles provide the basis information about how to identify the infection on the systems at first level. There are some basic levels IOC (Indicators of compromise) which can help to confirm malware infection.
Below are the methods/ways which help us to proceed for confirmation.
1)Manual Method
2)Using Sysinternals
3)Using Redline Tools (Mandiant)
Manual Method:
- In manual Method, we will use inbuilt utilities to confirm the status of infection like foreign connection from base OS, Unknown Processes running, system boot processes and application details from Msconfig and regedit. Learn step by step.
- Before Proceeding important note: Malware/Trojan/Virus/Worm Developer write a code in such a way that they always tried to evade detection from anti-virus.
- Initially they tried to hide once it dumped into the OS.
Unhide hidden files/Folders/Drives:
To view the hidden malicious binary kindly go open Windows Explorer Tools Folder Options –Go to View Tab (refer below snap)
I.Uncheck below highlighted options to view hidden files/folders.
a.Hide empty drives in the Computer Folder
b.Hide Extensions for known file types
c.Hide protected operating system files (Recommended)
II.Select the “Show Hidden files, folders and drives” options.
1. Using Netstat:
Netstat is a common command line TCP/IP networking utility available in most versions of Windows, Linux, UNIX and other operating systems.
This command is useful to see the currently established connection with foreign IPs with port & protocol wise details.
State Details:
- ESTABLISHED: Indicate that Still connection/communication is live.
C:\>netstat –ano | findstr ESTABLISHED
TCP 172.16.174.228:59011 172.129.4.10:443 ESTABLISHED 8116
TCP 172.16.174.228:59025 172.66.15.20:39331 ESTABLISHED 8116
TCP 172.16.174.228:59065 172.128.30.85:8000 ESTABLISHED 452
TCP 172.16.174.228:59102 172.128.27.42:10123 ESTABLISHED 4892
TCP 172.16.174.228:59158 172.77.4.16:58734 ESTABLISHED 160
TCP 172.16.174.228:59179 172.137.12.41:445 ESTABLISHED 4
TCP 172.16.174.228:59723 172.135.128.228:8080 ESTABLISHED 2220
TCP 172.16.174.228:59736 172.66.24.17:443 ESTABLISHED 8116
TCP 127.0.0.1:6129 127.0.0.1:53398 ESTABLISHED 1532
TCP 127.0.0.1:53398 127.0.0.1:6129 ESTABLISHED 4064
- LISTENING: Indicate that some service is running on listening ports or port may be opened for listening. This may ready to connect to the Server who hit on listening port.
C:\>netstat –ano | findstr LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1056
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 4080
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 172.16.77.174.228:139 0.0.0.0:0 LISTENING 4
TCP 127.0.0.1:8307 0.0.0.0:0 LISTENING 4080
TCP 127.0.0.1:53507 0.0.0.0:0 LISTENING 6904
TCP 192.168.56.1:139 0.0.0.0:0 LISTENING 4
Here we will get information about current foreign connection. Help to analyse the incident.
I recommend you to use this commend first while analysing the incidents because, we can filter out the query for live traffic as per our requirement like live port communication/foreign IP communication/State/PID Value and Protocol
2.Tasklist:
- This command is useful to see currently running processes on the server or remote server.
Syntax: TASKLIST [/S system [/U username [/P [password]]]] [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]
(For GUI: use task manager)
- It will give you details about the currently running application/services so easy to track unknown processes.
Note: You may require the basic knowledge about system running default processes + whitelisted application processes.
3.Task Manager:
- It provides limited information about computer performance and running applications, processes and CPU usage, commit charge and memory information, network activity and statistics, logged-in users, and system services. The Task Manager can also be used to set process priorities, processor affinity, forcibly terminate processes, and shut down, restart, hibernate or log off from Windows.
- The task list was capable of listing currently running processes and killing them, or creating a new process.
4.Msconfig:
- This utility we can use to see whether any unknown application is stucked at Start-up with Manufacturer details, command with full path of application, registry path.
- If we observed unknown application directly uncheck it & go to folder path, try to remove the file manually (use AV scan to validate/remove it).
- Go to registry path to remove the entry of application or use Ccleaner application to clear unwanted Data from registry.
- Advantage of this utility is to check the unknown process/services running.
Tick the “HIDE ALL MICROSOFT SERVICES” SO ALL MS services will get hide. Analyse the remaining services are related to whitelisted application or not and trace the unknown process/Application running the services and uninstall it asap.
We can validate which service is required to run on system start-up.
5.Registry:
Easiest way to identify is to use registry path:
HKLM\Software\Microsoft\Windows NT\current Version\Run & \Runonce
Here you will get details about the application which are set to run itself when OS boot.
6.Common Path to Dump The Binary Files:
- Whenever system get infected malicious binary file dump itself in windows file system. There is some common path where you can check for the same.
Like: %temp%, %Appdata%, system32 etc & Documents Folder.
You may confirm the binary files is suspicious or not by uploading the same file on Virustotal.com /metascan.com site to confirm the status.
7.Scan With Anti-Virus:
- Kindly update the Av version and scan whole drive using FULL scan method.
- It is recommended to use Full Version of AV, mostly tried to avoid cracked version as there is chances of infection from cracked version. Most of the hacker use this technique to infect the user systems.
8.Use Virus Total / Metascan:
This is simplest and fast method to detect the binary files malicious status.
You may scan files (upload limit: Max 128 MB size)/URLs/IPs and HASH to check the status. Security Analyst using this site for first level analysis.
9.Use Sandboxie:
Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.
- It is useful when we find the file and need to understand the functionality or infection level, this tool is useful.
- Most of the analyst use sandboxie to check the behaviour of malicious binary files.
Download URL: http://www.sandboxie.com/SandboxieInstall.exe
Using Sysinternals utility:
10.Using Process Explorer to Identify Malware:
Process Explorer is a free 1.47 MB download from the Windows Sysinternals web page on the TechNet site. Tool
List: https://technet.microsoft.com/en-us/sysinternals/bb545027.aspx
Useful Links:
• Hunt Down and Kill Malware with Sysinternals Tools (Part 1)
• Hunt Down and Kill Malware with Sysinternals Tools (Part 2)
• Hunt Down and Kill Malware with Sysinternals Tools (Part 3)
Video Demonstration: Malware Hunting with the Sysinternals Tools https://www.youtube.com/watch?v=Wuy_Pm3KaV8
Using Redline Tools (Mandiant):
MANDIANT transforms how organizations detect, respond to, and contain security breaches. Through our commercial and free products, we equip front-line incident investigators with superlative tools and technologies that support them in providing a quick and effective response when organizations need it the most.
Redline is MANDIANT’s free tool for investigating hosts for signs of malicious activity through memory and file analysis, and subsequently developing a threat assessment profile.
User Guide: https://dl.mandiant.com/EE/library/Redline1.11.1_UserGuide.pdf
Redline Features:
Rapid Triage
Reveals Hidden Malware
Guided Analysis
With Redline you can:
- Collect run processes, files, registry data, and memory images.
- View imported data, including narrowing and filtering results around a given timeframe using Redline’s TimeWrinkle™ and TimeCrunch™ features.
- Identify processes more likely worth investigating based on their Redline Malware Risk Index (MRI) score.
- Perform Indicators of Compromise (IOC) analysis.
- Use whitelists to filter out known valid data based on MD5 hash values.
Your Good comments Encourages me to keep posting Nice Articles so keep Commenting & Sharing
0 Response to "Trick to Identify the Malware Infection on Windows System | blog-windows Blog"
Post a Comment