Your Registry Blobs Belong to Me (RegHexDump)

So I was reading Trend's blog post Without a Trace: Fileless Malware Spotted in the Wild and although not totally new, it got me thinking a bit. I downloaded some of the MD5s they posted and started infecting my lab box. I noticed a couple different behaviors when infecting my lab machine with two different samples.

  • As mentioned in the blog: Creations of Rc4Encoded32 and Rc4Encoded64 registry values in HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components{Bot GUID}
  • A couple of the hashes created a Software entry: Software\ xsw\binaryImage32 and the data was an EXE.

How the malware uses these blobs of data is not the objective of this post. You can read the Trend blog for that information.

Both entries were binary blobs and were large relative to everything else I had in my test hives so I wondered how feasible it would be to recurse through a hive and return any entry larger than a user specified size.

I started writing some Python code and came up with: reghexdump (i'm terrible at coming up with script names). You can download the code here from my GitHub page.

Let's take a look at what I ended up with.

Help

python reghexdump.py -h

usage: reghexdump.py [-h] [--hive HIVE] [--size SIZE] [--write WRITE]
Parse Registry hive looking for malicious Binary data.
optional arguments:
  -h, --help     show this help message and exit
  --hive HIVE    Path to Hive.
  --size SIZE    Size in bytes.
  --write WRITE  Write the binary values out to a directory.

Output - No Write

You will see here we have Path, LastWrite MD5 along with VT lookups on the binary blobs of data. In one of the instances you can see it's hitting 35/57, and lastly I also included the data size and a hex preview.

You're able to change up the --size to any size you want to help reduce FPs.

python reghexdump.py --hive NTUSER.DAT.copy0 --size 20000

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\ xsw\binaryImage32
LastWrite: 2015-04-21T14:17:17.642979Z
MD5: 5be923a9a323667dc6ae33fb2f4a80a6 - 35/57
Size: 223744
00000000   4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00    MZ..............
00000010   B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00    ........@.......
00000020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000030   00 00 00 00 00 00 00 00 00 00 00 00 E8 00 00 00    ................
00000040   0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68    ........!..L.!Th
00000050   69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F    is program canno
00000060   74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20    t be run in DOS
00000070   6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00    mode....$.......

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Active Setup\Installed Components\{72507C54-3577-4830-815B-310007F6135A}\Rc4Encoded32
LastWrite: 2015-04-21T14:17:26.051649Z
MD5: 26ef08eb9dd49c53e0526bf148d23e3d - None
Size: 54669
00000000   87 87 3F 5C D1 25 67 7D C8 47 0F 5A 9C B7 D1 3E    ..?..%g}.G.Z...>
00000010   0B 34 AB 0E 9D 2E 59 D6 A2 51 C7 66 18 54 5A C2    .4....Y..Q.f.TZ.
00000020   1D 6B C0 B8 17 F6 23 C3 7D CA B2 2F E3 10 82 5A    .k....#.}../...Z
00000030   C8 99 9C 83 C9 4C 58 FB C7 FC 14 3E 15 9C B4 70    .....LX....>...p
00000040   82 3B 35 AF E3 B9 B2 E3 34 47 7F 50 46 74 01 B6    .;5.....4G.PFt..
00000050   F2 72 D1 76 44 71 B2 F5 82 21 F6 79 0F FE EE 68    .r.vDq...!.y...h
00000060   CE 04 8E 0F 51 2D C3 FE 70 BC 78 BC 2C 6E 94 1D    ....Q-..p.x.,n..
00000070   E9 0C 40 C5 98 DD 2F 09 2D 27 7E 14 B6 DA 28 3C    ..@.../.-'~...(<

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Active Setup\Installed Components\{72507C54-3577-4830-815B-310007F6135A}\Rc4Encoded64
LastWrite: 2015-04-21T14:17:26.051649Z
MD5: 233ec524cd7b88e18661298d8de549dd - None
Size: 68909
00000000   87 46 53 6F 96 A7 6B AA E8 65 C2 DA AE 96 4C 98    .FSo..k..e....L.
00000010   43 B5 8E E5 99 2E 59 9E 2B CD E3 66 1C 54 5A 8A    C.....Y.+..f.TZ.
00000020   C1 5E 01 31 FF EE 27 8B F4 F7 0B D7 1C EF 7D 9F    .^.1..'.......}.
00000030   F4 D1 43 64 32 C5 E5 42 B5 D1 51 B5 50 94 3D 0A    ..Cd2..B..Q.P.=.
00000040   B0 A6 AC 36 F8 A2 D8 F8 8E 95 7F 05 9F 70 01 B6    ...6.........p..
00000050   86 4F 04 2E 46 F8 A6 F1 4B 56 7F 79 4F 77 18 05    .O..F...KV.yOw..
00000060   76 F8 71 F0 6C 93 7F FE 70 CE 89 BC 2C 6E 94 1D    v.q.l...p...,n..
00000070   EB 0C 40 C5 98 9A E4 99 D2 E4 84 9D 6D 9B A9 94    ..@.........m...

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
LastWrite: 2015-04-21T12:53:08.684547Z
MD5: 630f44e2a9ae05d72f5aecb471d608e3 - None
Size: 74419
00000000   13 00 00 00 C3 53 5B 62 48 AB C1 4E BA 1F A1 EF    .....S[bH..N....
00000010   41 46 FC 19 00 80 00 00 00 7E 00 31 00 00 00 00    AF.......~.1....
00000020   00 69 42 79 3F 11 00 50 72 6F 67 72 61 6D 73 00    .iBy?..Programs.
00000030   00 66 00 08 00 04 00 EF BE 69 42 50 3F 69 42 79    .f.......iBP?iBy
00000040   3F 2A 00 00 00 3F 01 00 00 00 00 02 00 00 00 00    ?*...?..........
00000050   00 00 00 00 00 3C 00 00 00 00 00 50 00 72 00 6F    .....<.....P.r.o
00000060   00 67 00 72 00 61 00 6D 00 73 00 00 00 40 00 73    .g.r.a.m.s...@.s
00000070   00 68 00 65 00 6C 00 6C 00 33 00 32 00 2E 00 64    .h.e.l.l.3.2...d

Write

You also have the option to write out the binary blobs to disk. When using the --write arguement you will also have an additional message included. In this example it says, "Writing Data: binaryImage32 to out/"

reghexdump.py --hive NTUSER.DAT.copy0 --size 20000 --write out/

Writing Data: binaryImage32 to out/
Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\ xsw\binaryImage32
LastWrite: 2015-04-21T14:17:17.642979Z
MD5: 5be923a9a323667dc6ae33fb2f4a80a6 - 35/57
Size: 223744
00000000   4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00    MZ..............
00000010   B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00    ........@.......
00000020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000030   00 00 00 00 00 00 00 00 00 00 00 00 E8 00 00 00    ................
00000040   0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68    ........!..L.!Th
00000050   69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F    is program canno
00000060   74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20    t be run in DOS
00000070   6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00    mode....$.......

List Output

If you use the --write option it will write out and of the "hits" into the directory specified as seen below.

ls out/

  • ProgramsCache
  • Rc4Encoded32
  • Rc4Encoded64
  • binaryImage32

file out/*

  • out/ProgramsCache: Spectrum .TAP data BASIC program
  • out/Rc4Encoded32: data
  • out/Rc4Encoded64: data
  • out/binaryImage32: MS-DOS executable

Summary

I hope this is useful. I'll add some additional features over the next few days. I'm short on time these days. Let me know if you would like to see any additional features/functionality. I don't know how practical it is yet, but saw the blog and wanted a quick script to detect it if I needed.

You can download the code here from my GitHub page.

If you find these posts useful and educational you can donate via PayPal.Me here: $1, $2, $3, $4, $5 or Custom.

Enjoy!