Learning Malware Analysis

After compromising the system, an attacker may execute various commands on the command shell to enumerate users, groups, and shares on your network, or an attacker may transfer a tool such as Mimikatz (https://github.com/gentilkiwi/mimikatz) to the comprised system and execute it to dump Windows credentials. Mimikatz is an open source tool that was written by Benjamin Delpy in 2011. It is one of the most popular tools for gathering credentials from Windows systems. Mimikatz is distributed in different flavors, such as the compiled version (https://github.com/gentilkiwi/mimikatz), and is part of PowerShell Modules such as PowerSploit (https://github.com/PowerShellMafia/PowerSploit) and PowerShell Empire (https://github.com/EmpireProject/Empire).

Command history can provide valuable information about an attacker's activity on the compromised system. By examining the command history, you can determine information such as the commands that have been executed, programs invoked, and files and folders accessed by the attackers. The two volatility plugins, cmdscan, and consoles can extract command history from the memory image. These plugins extract the command history from csrss.exe (before Windows 7) or conhost.exe (Windows 7 and later versions) processes.

To understand the detailed workings of these plugins, read the book "The Art of Memory Forensics" or read the research paper "Extracting Windows Command Line Details from Physical Memory" by Richard Stevens and Eoghan Casey (http://www.dfrws.org/2010/proceedings/2010-307.pdf).

The cmdscan plugin lists the commands executed by cmd.exe. The following example gives insight into the credential-stealing activity on the system. From the cmdscan output, you can see that an application with the name net.exe was invoked via the command shell (cmd.exe). From the commands extracted from net.exe, you can tell that the commands privilege::debug and sekurlsa::logonpasswords are associated with Mimikatz. In this case, the Mimikatz application was renamed to net.exe:

$ python vol.py -f mim.vmem --profile=Win7SP1x64 cmdscan
[REMOVED]
CommandProcess: conhost.exe Pid: 2772
CommandHistory: 0x29ea40 Application: cmd.exe Flags: Allocated, Reset
CommandCount: 2 LastAdded: 1 LastDisplayed: 1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x5c
Cmd #0 @ 0x29d610: cd \
Cmd #1 @ 0x27b920: cmd.exe /c %temp%\net.exe
Cmd #15 @ 0x260158: )
Cmd #16 @ 0x29d3b0: )
[REMOVED]
**************************************************
CommandProcess: conhost.exe Pid: 2772
CommandHistory: 0x29f080 Application: net.exe Flags: Allocated, Reset
CommandCount: 2 LastAdded: 1 LastDisplayed: 1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0xd4
Cmd #0 @ 0x27ea70: privilege::debug
Cmd #1 @ 0x29b320: sekurlsa::logonpasswords
Cmd #23 @ 0x260158: )
Cmd #24 @ 0x29ec20: '

The cmdscan plugin displays the commands executed by the attacker. To get an idea of whether the command succeeded or not, you can use the consoles plugin. After running the consoles plugin, you can see that net.exe is indeed a Mimikatz application and, to dump the credentials, Mimkatz commands were executed using the Mimikatz shell. From the output, you can tell that the credentials were successfully dumped and that the password was retrieved in clear text:

$ python vol.py -f mim.vmem --profile=Win7SP1x64 consoles
----
CommandHistory: 0x29ea40 Application: cmd.exe Flags: Allocated, Reset
CommandCount: 2 LastAdded: 1 LastDisplayed: 1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x5c
Cmd #0 at 0x29d610: cd \
Cmd #1 at 0x27b920: cmd.exe /c %temp%\net.exe
----
Screen 0x280ef0 X:80 Y:300
Dump:
Microsoft Windows [Version 6.1.7600] 
Copyright (c) 2009 Microsoft Corporation. All rights reserved. 
                                                                                
C:\Windows\system32>cd \ 
                                                                                
C:\>cmd.exe /c %temp%\net.exe

[REMOVED] 
                                                                                
mimikatz # privilege::debug 
Privilege '20' OK 
                                                                                
mimikatz # sekurlsa::logonpasswords                                                                             
Authentication Id : 0 ; 269689 (00000000:00041d79) 
Session : Interactive from 1 
User Name : test 
Domain : PC 
Logon Server : PC 
Logon Time : 5/4/2018 10:00:59 AM 
SID : S-1-5-21-1752268255-3385687637-2219068913-1000 
        msv : 
         [00000003] Primary 
         * Username : test 
         * Domain : PC 
         * LM : 0b5e35e143b092c3e02e0f3aaa0f5959 
         * NTLM : 2f87e7dcda37749436f914ae8e4cfe5f 
         * SHA1 : 7696c82d16a0c107a3aba1478df60e543d9742f1 
        tspkg : 
         * Username : test 
         * Domain : PC 
         * Password : cleartext 
        wdigest : 
         * Username : test 
         * Domain : PC 
         * Password : cleartext 
        kerberos : 
         * Username : test 
         * Domain : PC 
         * Password : cleartext

You may not be able to dump a password in clear text using Mimikatz on Windows 8.1 and later versions, however, Mimikatz provides various capabilities to an attacker. An attacker may use an extracted NTLM hash to impersonate an account. For detailed information on Mimikatz and how it can be used to extract Windows credentials, read https://adsecurity.org/?page_id=1821.

Table of Contents for
Learning Malware Analysis

11. Extracting Command History

Table of Contents for Learning Malware Analysis

Table of Contents for
Learning Malware Analysis