Malware Forensics Field Guide for Windows Systems: Digital Forensics Field Guides

710 Pages·2012·26.96 MB·English

by  Cameron H. Malin

Malware Forensics Field Guide for
Windows Systems
Digital Forensics Field Guides
Cameron H. Malin
Eoghan Casey
James M. Aquilina
Curtis W. Rose
Technical Editor
Acquiring Editor: Cris Katsaropoulos
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
© 2012 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or any information storage and retrieval system, without
permission in writing from the publisher. Details on how to seek permission, further information about the
Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance
Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher
(other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden
our understanding, changes in research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and
using any information or methods described herein. In using such information or methods they should be
mindful of their own safety and the safety of others, including parties for whom they have a professional
responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any
liability for any injury and/or damage to persons or property as a matter of products liability, negligence or
otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the
material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-472-4
For information on all Syngress publications visit our website at http://store.elsevier.com
Printed in the United States of America
12 13 14 15 16 10 9 8 7 6 5 4 3 2 1
Typeset by: diacriTech, Chennai, India
For our moms, who taught us determination, patience, creativity, and to live
passionately.
Acknowledgments

Cameron would like to thank a number of people for their guidance, support, and
ideas on this book—without them it would not have happened. James and
Eoghan I appreciate your willingness to keep an open mind and embrace the
format and structure of this book; it was a rewarding challenge. I’m proud to
work with you both.

Thanks to the Syngress crew for your patience and understanding of our
vision: Steve Elliot, Angelina Ward, Laura Colantoni, Matthew Cater, Paul
Gottehrer, Chris Katsaropoulos, and David Bevans.
Not to be forgotten are the some terrific researchers, developers, and
forensic practitioners who assisted and supported this book: Mila Parkour
(contagiodump.blogspot.com), Ero Carera and Christian Blichmann (Zynamics),
Matthew Shannon (F-Response), Maria Lucas (HBGary), Thorsten Holz
(Assistant Professor at Ruhr-University Bochum; http://honeyblog.org/), Tark
(ccso.com), and Danny Quist (offensivecomputing.net).
For your friendship, camaraderie, and day-to-day hi-jinks, “Team Cyber” of
the Los Angeles Cyber Division—you are a fantastic crew and I miss you. Jason,
Ramyar, and Bryan—my friends and confidants—thank you for everything, we
had a good run.
My sister Alecia—your determination and focus are an inspiration to me.
“No lying on the couch!”
Finally, to my lovely wife Adrienne, I am so lucky to have you in my life—
thanks for being a “team” with me—I love you. Bentley and Barkley—thanks
for being Daddy’s little “writing buddies.”
Special Thanks to the Technical Editor

Malware Forensics Field Guide for Windows Systems was reviewed by a digital
forensic expert who is a fantastic author in his own right. My sincerest thanks to
Curtis W. Rose for your tenacity and attention to detail—we’re lucky to work
with you.
About the Authors

Cameron H. Malin is a Supervisory Special Agent with the Federal Bureau of
Investigation assigned to a Cyber Crime squad in Los Angeles, California, where
he is responsible for the investigation of computer intrusion and malicious code
matters. In 2010, Mr. Malin was a recipient of the Attorney General’s Award for
Distinguished Service for his role as a Case Agent in Operation Phish Phry.

Mr. Malin is the Chapter Lead for the Southern California Chapter of the
Honeynet Project, an international non-profit organization dedicated to
improving the security of the Internet through research, analysis, and
information regarding computer and network security threats. Mr. Malin
currently sits on the Editorial Board of the International Journal of Digital
Evidence (IJDE) and is a Subject Matter Expert for the Information Assurance
Technology Analysis Center (IATAC) and Weapon Systems Technology and
Information Analysis Center (WSTIAC).
Mr. Malin is a Certified Ethical Hacker (C|EH) and Certified Network
Defense Architect (C|NDA) as designated by the International Council of
Electronic Commerce Consultants (EC-Council) and a Certified Information
Systems Security Professional (CISSP), as designated by the International
Information Systems Security Certification Consortium ((ISC)2®).
Prior to working for the FBI, Mr. Malin was an Assistant State Attorney
(ASA) and Special Assistant United States Attorney (SAUSA) in Miami,
Florida, where he specialized in computer crime prosecutions. During his tenure
as an ASA, Mr. Malin was also an Assistant Professorial Lecturer in the
Computer Fraud Investigations Masters Program at George Washington
University.
The techniques, tools, methods, views, and opinions explained by Cameron
Malin are personal to him, and do not represent those of the United States
Department of Justice, the Federal Bureau of Investigation, or the government of
the United States of America. Neither the Federal government nor any Federal
agency endorses this book or its contents in any way.
Eoghan Casey is founding partner of cmdLabs, author of the foundational
book Digital Evidence and Computer Crime, and coauthor of Malware
Forensics: Investigating and Analyzing Malicious Code. For over a decade he
has dedicated himself to advancing the practice of incident handling and digital
forensics. He helps client organizations handle security breaches and analyzes
digital evidence in a wide range of investigations, including network intrusions
with international scope. He works at the Department of Defense Cyber Crime
Center (DC3) on research and tool development. He has testified in civil and
criminal cases, and has submitted expert reports and prepared trial exhibits for
computer forensic and cyber-crime cases.
As a Director of Digital Forensics and Investigations at Stroz Friedberg, he
maintained an active docket of cases and co-managed the firm’s technical
operations in the areas of computer forensics, cyber-crime response, incident
handling, and electronic discovery. He also spearheaded Stroz Friedberg’s
external and in-house forensic training programs as Director of Training. Mr.
Casey has performed thousands of forensic acquisitions and examinations,
including Windows and UNIX systems, Enterprise servers, smart phones, cell
phones, network logs, backup tapes, and database systems. He also has extensive
information security experience, as an Information Security Officer at Yale
University and in subsequent consulting work. He has performed vulnerability
assessments; deployed and maintained intrusion detection systems, firewalls, and
public key infrastructures; and developed policies, procedures, and educational
programs for a variety of organizations.
Mr. Casey holds a B.S. in Mechanical Engineering from the University of
California at Berkeley, and an M.A. in Educational Communication and
Technology from New York University. He conducts research and teaches
graduate students at Johns Hopkins University Information Security Institute,
and is Editor-in-Chief of Digital Investigation: The International Journal of
Digital Forensics and Incident Response.
James M. Aquilina, Executive Managing Director and Deputy General
Counsel, contributes to the management of Stroz Friedberg and the handling of
its legal affairs, in addition to having overall responsibility for the Los Angeles,
San Francisco, and Seattle offices. He supervises numerous digital forensic,
Internet investigative, and electronic discovery assignments for government
agencies, major law firms, and corporate management and information systems
departments in criminal, civil, regulatory, and internal corporate matters,
including matters involving data breach, e-forgery, wiping, mass deletion and
other forms of spoliation, leaks of confidential information, computer-enabled
theft of trade secrets, and illegal electronic surveillance. He has served as a
neutral expert and has supervised the court-appointed forensic examination of
digital evidence. Mr. Aquilina also has led the development of the firm’s online
fraud and abuse practice, regularly consulting on the technical and strategic
aspects of initiatives to protect computer networks from spyware and other
invasive software, malware and malicious code, online fraud, and other forms of
illicit Internet activity. His deep knowledge of botnets, distributed denial of
service attacks, and other automated cyber-intrusions enables him to provide
companies with advice and solutions to tackle incidents of computer fraud and
abuse and bolster their infrastructure protection.
Prior to joining Stroz Friedberg, Mr. Aquilina was an Assistant U.S.
Attorney (AUSA) in the Criminal Division of the U.S. Attorney’s Office for the
Central District of California, where he most recently served in the Cyber and
Intellectual Property Crimes Section. He also served as a member of the Los
Angeles Electronic Crimes Task Force, and as chair of the Computer Intrusion
Working Group, an inter-agency cyber-crime response organization. As an
AUSA, Mr. Aquilina conducted and supervised investigations and prosecutions
of computer intrusions, extortionate denial of service attacks, computer and
Internet fraud, criminal copyright infringement, theft of trade secrets, and other
abuses involving the theft and use of personal identity. Among his notable cyber
cases, Mr. Aquilina brought the first U.S. prosecution of malicious botnet
activity against a prolific member of the “botmaster underground” who sold his
armies of infected computers for the purpose of launching attacks and spamming
and used his botnets to generate income from the surreptitious installation of
adware; tried to jury conviction the first criminal copyright infringement case
involving the use of digital camcording equipment; supervised the government’s
continuing prosecution of Operation Cyberslam, an international intrusion
investigation involving the use of hired hackers to launch computer attacks
against online business competitors; and oversaw the collection and analysis of
electronic evidence relating to the prosecution of a local terrorist cell operating
in Los Angeles.
During his tenure at the U.S. Attorney’s Office, Mr. Aquilina also served in
the Major Frauds and Terrorism/Organized Crime Sections, where he
investigated and tried numerous complex cases, including a major corruption
trial against an IRS Revenue Officer and public accountants, a fraud prosecution
against the French bank Credit Lyonnais in connection with the rehabilitation
and liquidation of the now defunct insurer Executive Life, and an extortion and
kidnapping trial against an Armenian organized crime ring. In the wake of the
September 11, 2001, attacks Mr. Aquilina helped establish and run the Legal