1

Short version: Is there any way to analyze a temporary file from the C:\Windows\Temp folder, if is there any code, process, or to what it is associated.

Long version: In a Windows 7 computer, the Antivirus keeps sending messages about a detection of a trojan 'TR/Patched.Ren.Gen [trojan]' in the Temp files when nothing is running in the desktop, but it doesn't give any other information about it, and the system scan doesn't detect it. I managed to save the file before it was automatically deleted.Is there anything useful I can do to gather information about it? I can't change or update the system, because the computer isn't mine.

I have Kali on another pc, so it would be useful if there is a tool there to do such things.

The answer would be useful for both helping the owner of the pc, and learning about information security for future forensic analysis or reverse engineering (Please correct me if I'm wrong)

  • Why not uploading to VirusTotal? – BgrWorker May 29 '17 at 16:01
  • Because more than the virus itself, I want to find out where did it came from. It seems to try to execute itself from a program or process in the computer, like trying to perform a reverse_tcp session (I guess), and I would like to know which program is doing it (and if I can, I would like to figure out to where is it trying to connect). – gramsch May 29 '17 at 16:18
  • You should start by looking up how the Trojan works, that will give you clues as to its origin. – Julian Knight May 29 '17 at 18:58
  • Consider running procmon and wait for it to happen. – Jonathan Allon May 30 '17 at 1:02
1

In these cases if you have a file you wish to analyze saved. The kind of information i think you are looking for comes from reverse engineering.

first things first, you can download sysinternalssuite from a great guy at microsoft who released a series of tools for quick and dirty sysadmin tasks.

https://technet.microsoft.com/en-us/sysinternals/bb842062

most relevant to your case (which is i guess malware analysis) are the following tools specifically:

  • procmon - shows live changes to the system and what started them
  • tcpview - shows all tcp connections, where theyre from, where theyre going, and status
  • Sysmon - get some early boot logging going.
  • procexp - this will show a detailed version of task manager, with stress values and child processes all in one. one of my favorites for malware.

so the idea here is you will create a VM with the same OS (if possible) as your client computer. and let this thing loose inside it.

before you begin, you install the vm, no virus software, and get the sysinternals tools.

also you want some form of reverse engineering debugger.

  • IDA - the king of this area, very feature rich, they have a free version, but its older
  • ollydb - a free debugger with less features, but still does the job well
  • immunity db - similar to ollydb

these programs will show you the machine code of whatever file you attach them to. you can even step through the execution of the malware one code line at a time.

Basic methodology is as follows:

  • allow the malware to run wild by itself and use sysinternals to gather some information on the malware and what its doing where in the system, where it tries to connect to, and what kind of processes it creates.
  • attach a debugger to the malware and run: there will be alot of information, this is why the recon phase is so important, it narrows the scope of what you are looking for. you use this information to try to find the specific areas in the malware that are of particular interest. i.e. copying itself, changing system registries or files, making services on the pc, opening ports etc...

this is a basic overview of how analysis of a black box is done (black box = unknown entity). any additional information also helps this process, knowing the exact malware type also helps you know where to look with these tools for specifics. since those heuristics are already known they should be able to give you search material to find more information on where to look.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.