Malware Forensics Field Guide for Windows Systems Digital Forensics Field Guides Cameron H. Malin Eoghan Casey James M. Aquilina Curtis W. Rose Technical Editor Acquiring Editor: Cris Katsaropoulos Project Manager: Paul Gottehrer Designer: Alisa Andreola Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA © 2012 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-472-4 For information on all Syngress publications visit our website at http://store.elsevier.com Printed in the United States of America 12 13 14 15 16 10 9 8 7 6 5 4 3 2 1 Typeset by: diacriTech, Chennai, India For our moms, who taught us determination, patience, creativity, and to live passionately. Acknowledgments Cameron would like to thank a number of people for their guidance, support, and ideas on this book—without them it would not have happened. James and Eoghan I appreciate your willingness to keep an open mind and embrace the format and structure of this book; it was a rewarding challenge. I’m proud to work with you both. Thanks to the Syngress crew for your patience and understanding of our vision: Steve Elliot, Angelina Ward, Laura Colantoni, Matthew Cater, Paul Gottehrer, Chris Katsaropoulos, and David Bevans. Not to be forgotten are the some terrific researchers, developers, and forensic practitioners who assisted and supported this book: Mila Parkour (contagiodump.blogspot.com), Ero Carera and Christian Blichmann (Zynamics), Matthew Shannon (F-Response), Maria Lucas (HBGary), Thorsten Holz (Assistant Professor at Ruhr- University Bochum; http://honeyblog.org/), Tark (ccso.com), and Danny Quist (offensivecomputing.net). For your friendship, camaraderie, and day-to-day hi-jinks, For your friendship, camaraderie, and day-to-day hi-jinks, “Team Cyber” of the Los Angeles Cyber Division—you are a fantastic crew and I miss you. Jason, Ramyar, and Bryan—my friends and confidants—thank you for everything, we had a good run. My sister Alecia—your determination and focus are an inspiration to me. “No lying on the couch!” Finally, to my lovely wife Adrienne, I am so lucky to have you in my life—thanks for being a “team” with me—I love you. Bentley and Barkley—thanks for being Daddy’s little “writing buddies.” Special Thanks to the Technical Editor Malware Forensics Field Guide for Windows Systems was reviewed by a digital forensic expert who is a fantastic author in his own right. My sincerest thanks to Curtis W. Rose for your tenacity and attention to detail—we’re lucky to work with you. About the Authors Cameron H. Malin is a Supervisory Special Agent with the Federal Bureau of Investigation assigned to a Cyber Crime squad in Los Angeles, California, where he is responsible for the investigation of computer intrusion and malicious code matters. In 2010, Mr. Malin was a recipient of the Attorney General’s Award for Distinguished Service for his role as a Case Agent in Operation Phish Phry. Mr. Malin is the Chapter L ead for the Southern California Chapter of the Honeynet Project, an international non-profit organization dedicated to improving the security of the Internet through research, analysis, and information regarding computer and network security threats. Mr. Malin currently sits on the Editorial Board of the International Journal of Digital Evidence (IJDE) and is a Subject Matter Expert for the Information Assurance Technology Analysis Center (IATAC) and Weapon Systems Technology and Information Analysis Center (WSTIAC). Mr. Malin is a Certified Ethical Hacker (C|EH) and Certified Network Defense Architect (C|NDA) as designated by Certified Network Defense Architect (C|NDA) as designated by the International Council of Electronic Commerce Consultants (EC-Council) and a Certified Information Systems Security Professional (CISSP), as designated by the International Information Systems Security Certification Consortium 2® ((ISC) ). Prior to working for the FBI, Mr. Malin was an Assistant State Attorney (ASA) and Special Assistant United States Attorney (SAUSA) in Miami, Florida, where he specialized in computer crime prosecutions. During his tenure as an ASA, Mr. Malin was also an Assistant Professorial Lecturer in the Computer Fraud Investigations Masters Program at George Washington University. The techniques, tools, methods, views, and opinions explained by Cameron Malin are personal to him, and do not represent those of the United States Department of Justice, the Federal Bureau of Investigation, or the government of the United States of America. Neither the Federal government nor any Federal agency endorses this book or its contents in any way. Eoghan Casey is founding partner of cmdLabs, author of the foundational book Digital Evidence and Computer Crime, and coauthor of Malware Forensics: Investigating and Analyzing Malicious Code. For over a decade he has dedicated himself to advancing the practice of incident handling and digital forensics. He helps client organizations handle security breaches and analyzes digital evidence in a wide range of investigations, including network intrusions with international scope. He works at the Department of Defense Cyber Crime