Happy New Years!
As part of the new year, let's make an effort to make your defensive posture better, especially through quicker and more effective malware analysis! A few years ago I created a sample malware analysis sandbox script to use for the analysis and reverse engineering that I performed on a daily basis. Let's show how you can perform analysis of malware within just a few seconds with almost no setup at all.
For those who are already familiar with Noriben, feel skip to the second section to see the new content.
If you've followed me on Twitter, or kept up with this blog, you would be familiar with Noriben. If not, it's a very simple script. In typical behavior analysis one would run malware within a sandbox to see exactly what files it creates, what processes it runs, and what changes it makes to the system. The most common way that many defense teams use is to upload the file to a central anti-virus testing site like VirtusTotal and to online sandboxes like Malwr and those using Cuckoo.
For teams who are leery of uploading their files to the Internet, which is especially inadvisable for APT-related investigations. As advanced actors monitor online sites to see if their files are uploaded, they can determine if their free reign within the environment comes to an end and an IR response has started.
Running malware locally is most commonly performed through Cuckoo, an awesome and open-source sandbox application designed for malware that produces very comprehensive results. However, there is is arguably considerable effort required to set up Cuckoo correctly, with multiple sites offering walkthroughs for various environments. While relatively easy to install on Linux, installing on Windows or OSX can be frustrating for many. And, in my case, I'm often on the road with a random laptop and need to make a sandbox very quickly.
If you take a malware analysis training course, you've also likely been exposed to the SysInternals Procmon tool to monitor a system's environment. For those with more vintage knowledge, you learned Regmon and Filemon. Others use Regshot, a tool that is inadequate for many malware as it doesn't track finite changes within runtime.
Noriben is a simple wrapper for Procmon to collects hundreds of thousands of events then uses a custom set of whitelisted system events to reduce this down to a few dozen for quick review. For more, take a look at the slide deck I put together for the 2015 Black Hat Arsenal:
_____
______
This post won't really focus on the details tool itself. You can check out it's main page here: www.ghettoforensics.com/noriben
Typical usage of Noriben requires that you run it interactively within a sandbox while running your malware. After running Noriben, it collects overall system artifacts as you run malware. Many analysts use it to collect malware indicators for when they need to interact with the malware within the sandbox, such as with this video that does VM checking:
However, this blog post is to highlight an automated way to avoid this and to submit samples, and receive the resulting reports, directly from your host system.
By using VMware's vmrun command, the script will revert the VM to a known snapshot, copy the malware in, run Noriben, then zip and extract the report out. From the command line, one can receive a malware report within 60 seconds on a file. Below is an example of the bash script that runs from OSX:
Obviously, this script needs minor editing on your part to establish the correct paths. By default it places the malware sample as "C:\Malware\malware.exe", runs Noriben off the desktop of the Administrator account, and outputs the results to "C:\Noriben_Logs\".
In action, here's a video of a malware file being scanned using this script:
Similarly, there's a script on Github for those running a Windows host:
A similar script can be written for VirtualBox. However, I ran into numerous issues getting the "guestcontrol copyto" to copy files in and out. If you'd like to take a stab at this, based on the code above, feel free!
As the developer of open-source software, the biggest hurdle is in handling every edge case. I am the sole developer (currently) of Noriben, therefore it is geared and written to my experiences. I love getting bug reports because (a) I know people are using it and (b) each person's system has its own unique qualities.
Noriben is hosted publicly on Github at: https://github.com/Rurik/Noriben.
As part of the new year, let's make an effort to make your defensive posture better, especially through quicker and more effective malware analysis! A few years ago I created a sample malware analysis sandbox script to use for the analysis and reverse engineering that I performed on a daily basis. Let's show how you can perform analysis of malware within just a few seconds with almost no setup at all.
- Introduction
- Automating Sandboxing with VMware
- How you can help! Even with no technical background!
- Download Information
For those who are already familiar with Noriben, feel skip to the second section to see the new content.
Introduction
If you've followed me on Twitter, or kept up with this blog, you would be familiar with Noriben. If not, it's a very simple script. In typical behavior analysis one would run malware within a sandbox to see exactly what files it creates, what processes it runs, and what changes it makes to the system. The most common way that many defense teams use is to upload the file to a central anti-virus testing site like VirtusTotal and to online sandboxes like Malwr and those using Cuckoo.
For teams who are leery of uploading their files to the Internet, which is especially inadvisable for APT-related investigations. As advanced actors monitor online sites to see if their files are uploaded, they can determine if their free reign within the environment comes to an end and an IR response has started.
Running malware locally is most commonly performed through Cuckoo, an awesome and open-source sandbox application designed for malware that produces very comprehensive results. However, there is is arguably considerable effort required to set up Cuckoo correctly, with multiple sites offering walkthroughs for various environments. While relatively easy to install on Linux, installing on Windows or OSX can be frustrating for many. And, in my case, I'm often on the road with a random laptop and need to make a sandbox very quickly.
If you take a malware analysis training course, you've also likely been exposed to the SysInternals Procmon tool to monitor a system's environment. For those with more vintage knowledge, you learned Regmon and Filemon. Others use Regshot, a tool that is inadequate for many malware as it doesn't track finite changes within runtime.
Noriben is a simple wrapper for Procmon to collects hundreds of thousands of events then uses a custom set of whitelisted system events to reduce this down to a few dozen for quick review. For more, take a look at the slide deck I put together for the 2015 Black Hat Arsenal:
_____
______
This post won't really focus on the details tool itself. You can check out it's main page here: www.ghettoforensics.com/noriben
Automating Sandboxing from VMware
Typical usage of Noriben requires that you run it interactively within a sandbox while running your malware. After running Noriben, it collects overall system artifacts as you run malware. Many analysts use it to collect malware indicators for when they need to interact with the malware within the sandbox, such as with this video that does VM checking:
However, this blog post is to highlight an automated way to avoid this and to submit samples, and receive the resulting reports, directly from your host system.
By using VMware's vmrun command, the script will revert the VM to a known snapshot, copy the malware in, run Noriben, then zip and extract the report out. From the command line, one can receive a malware report within 60 seconds on a file. Below is an example of the bash script that runs from OSX:
#!/bin/bash
#Noriben Sandbox Automation Script
#Responsible for:
#* Copying malware into a known VM
#* Running malware sample
#* Copying off results
#
#Ensure you set the environment variables below to match your system
if[!-f$1];then
echo"Please provide executable filename as an argument."
echo"For example:"
echo"$0 ~/malware/ef8188aa1dfa2ab07af527bab6c8baf7"
exit
fi
DELAY=10
MALWAREFILE=$1
VMRUN="/Applications/VMware Fusion.app/Contents/Library/vmrun"
VMX="/Users/bbaskin/VMs/RSA Victim.vmwarevm/Windows XP Professional.vmx"
VM_SNAPSHOT="Baseline"
VM_USER=Administrator
VM_PASS=password
FILENAME=$(basename$MALWAREFILE)
NORIBEN_PATH="C:\\Documents and Settings\\$VM_USER\\Desktop\\Noriben.py"
ZIP_PATH=C:\\Tools\\zip.exe
LOG_PATH=C:\\Noriben_Logs
"$VMRUN"-TwsrevertToSnapshot"$VMX"$VM_SNAPSHOT
"$VMRUN"-Twsstart"$VMX"
"$VMRUN"-gu$VM_USER-gp$VM_PASScopyFileFromHostToGuest"$VMX""$MALWAREFILE"C:\\Malware\\malware.exe
"$VMRUN"-Tws-gu$VM_USER-gp$VM_PASSrunProgramInGuest"$VMX"C:\\Python27\\Python.exe"$NORIBEN_PATH"-d-t$DELAY--cmd"C:\\Malware\\Malware.exe"--output"$LOG_PATH"
if[$?-gt0];then
echo"[!] File did not execute in VM correctly."
exit
fi
"$VMRUN"-Tws-gu$VM_USER-gp$VM_PASSrunProgramInGuest"$VMX""$ZIP_PATH"-jC:\\NoribenReports.zip"$LOG_PATH\\*.*"
if[$?-eq12];then
echo"[!] ERROR: No files found in Noriben output folder to ZIP."
exit
fi
"$VMRUN"-gu$VM_USER-gp$VM_PASScopyFileFromGuestToHost"$VMX"C:\\NoribenReports.zip$PWD/NoribenReports_$FILENAME.zip
Obviously, this script needs minor editing on your part to establish the correct paths. By default it places the malware sample as "C:\Malware\malware.exe", runs Noriben off the desktop of the Administrator account, and outputs the results to "C:\Noriben_Logs\".
In action, here's a video of a malware file being scanned using this script:
Similarly, there's a script on Github for those running a Windows host:
:NoribenSandboxAutomationScript
:Responsiblefor:
:*CopyingmalwareintoaknownVM
:*Runningmalwaresample
:*Copyingoffresults
:
:Ensureyousettheenvironmentvariablesbelowtomatchyoursystem
@echooff
if"%1"==""gotoHELP
ifnotexist"%1"gotoHELP
setDELAY=10
setCWD=%CD%
setVMRUN="C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe"
setVMX="e:\VMs\WinXP_Malware\WinXP_Malware.vmx"
setVM_SNAPSHOT="Baseline"
SETVM_USER=Administrator
setVM_PASS=password
setFILENAME=%~nx1
setNORIBEN_PATH="C:\Documents and Settings\%VM_USER%\Desktop\Noriben.py"
setLOG_PATH="C:\Noriben_Logs"
setZIP_PATH="C:\Tools\zip.exe"
%VMRUN%-TwsrevertToSnapshot%VMX%%VM_SNAPSHOT%
%VMRUN%-Twsstart%VMX%
%VMRUN%-gu%VM_USER%-gp%VM_PASS%copyFileFromHostToGuest%VMX%"%1"C:\Malware\malware.exe
echo%VMRUN%-Tws-gu%VM_USER%-gp%VM_PASS%runProgramInGuest%VMX%C:\Python27\Python.exe%NORIBEN_PATH%-d-t%DELAY%--cmd"C:\Malware\Malware.exe"--output%LOG_PATH%
%VMRUN%-Tws-gu%VM_USER%-gp%VM_PASS%runProgramInGuest%VMX%C:\Python27\Python.exe%NORIBEN_PATH%-d-t%DELAY%--cmd"C:\Malware\Malware.exe"--output%LOG_PATH%
if%ERRORLEVEL%==1gotoERROR1
%VMRUN%-Tws-gu%VM_USER%-gp%VM_PASS%runProgramInGuest%VMX%%ZIP_PATH%-jC:\NoribenReports.zip%LOG_PATH%\*.*
%VMRUN%-gu%VM_USER%-gp%VM_PASS%copyFileFromGuestToHost%VMX%C:\NoribenReports.zip%CWD%\NoribenReports_%FILENAME%.zip
gotoEND
:ERROR1
echo[!]FiledidnotexecuteinVMcorrectly.
gotoEND
:HELP
echoPleaseprovideexecutablefilenameasanargument.
echoForexample:
echo%~nx0C:\Malware\ef8188aa1dfa2ab07af527bab6c8baf7
gotoEND
:END
A similar script can be written for VirtualBox. However, I ran into numerous issues getting the "guestcontrol copyto" to copy files in and out. If you'd like to take a stab at this, based on the code above, feel free!
How you can help!
As the developer of open-source software, the biggest hurdle is in handling every edge case. I am the sole developer (currently) of Noriben, therefore it is geared and written to my experiences. I love getting bug reports because (a) I know people are using it and (b) each person's system has its own unique qualities.
If you want to provide the most help for me there are two ways that I would greatly appreciate!
- Help me with the development through leveraging your programming expertise to improve it.
- Help to develop new white list filters.
The first is limited to a small set of people, but anyone can help with the second! The white list filters I use are based primarily off of my own VMs. But, as I've seen with others' reports, there are numerous other items that could be whitelisted. I had one analyst send me a report that had hundreds of items, whereas my own system typically produces less than two dozen. He simply had a lot of backend applications that I was not expecting (such as ngen.exe). Someone else had print drivers continuously being updated.
To help, right now, download the files here into your VM and simply run it. Let it run for a minute or two without malware. Simply run Calc or Notepad. Then stop collection and send me the results. As there is no malware running, the results shown should likely be whitelisted for everyone. Take this and email your files to me (feel free to scrub any proprietary information) at brian @@ thebaskins.com.
Download Information
Noriben is hosted publicly on Github at: https://github.com/Rurik/Noriben.
At a minimum, you can download Noriben.py and be up and running. It is preferable that you also download ProcmonConfiguration.pmc and store it alongside Noriben.py. This configuration file contains numerous pre-analysis whitelists that could reduce your process logs from hundreds of megabytes to less than 10MB.
Thanks for reading and hopefully this will help you improve your defenses and incident response reaction times for the new year!