WAZUH Lab: yara

Cornerstones of Trust 2014: http://cornerstonesoftrust.com.
Presenters: Jaime Blasco (@jaimeblascob) and Santiago Bassett (@santiagobassett). Thank you Jaime.

Threat Intelligence has become increasingly important as the number and severity of threats is growing continuously. We live in an era where our prevention technologies are not enough anymore, antivirus products fail to detect new or sophisticated pieces of malware, our firewalls and perimeter defenses are easily bypassed and the attacker’s techniques are growing in complexity. In this new landscape, sharing threat intelligence has become a key component to mitigate cyber-attacks.

In this session we will define what Threat Intelligence is and discuss how to collect and integrate threat intelligence from public sources. In addition, we’ll demonstrate how to build your own Threat Intelligence data using Open Source tools such as sandboxes, honeypots, sinkholes and other publicly available tools.

The industry’s reticence to share information about attack vectors gives the adversary a huge advantage. Using Threat Intelligence we can reduce this advantage and enable preventative response. We will guide you through the different standards (OpenIOC, STIX, MAEC, OTX, IODEF…) to describe and share cyber intelligence, as well as Open Source Frameworks such as CIF (Collective Intelligence Framework) that allows you to combine different threat sources.

One of the biggest problems with Threat Intelligence is finding out how to take advantage of the data you have to actually improve the detection/prevention capabilities in your environment. We will describe how to leverage Threat Intelligence to detect threats and provide defenses, and we will focus on how to use Open Source Tools (Suricata, OSSIM, OSSEC, Bro, Yara…) to get the most of your Threat Intelligence.

Quoting their website Cuckoo sandbox is an Open Source automated malware analysis system. To do so it uses custom components that monitor the behavior of the malicious processes while running in an isolated environment (typically a Windows operating system).

It can retrieve the following type of results:

Traces of win32 API calls performed by all processes spawned by the malware.
Files being created, deleted and downloaded by the malware during its execution.
Memory dumps of the malware processes.
Network traffic trace in PCAP format.
Screenshots of Windows desktop taking during the execution of the malware.
Full memory dumps of the machines.

In our case I decided to use a combination of Ubuntu LTS server and VirtualBox to setup the platform where we are going to run Cuckoo. For further details on how to install these systems you can see my previous posts:

Cuckoo (version 0.5) has been developed in Python and integrated with MongoDB, Yara, SSDEEP, Tcpdump for different purposes. That is why my recommendation is to install all these packages including Cuckoo Python dependencies. Here are the necessary steps to do it:

1.- Installing Python and dependencies

 $ apt-get install python # installed by default  
 $ apt-get install python-magic # for identifying file formats  
 $ apt-get install python-dpkt # for extracting info from pcaps  
 $ apt-get install python-mako # for rendering html reports and web gui  
 $ apt-get install python-sqlalchemy  
 $ apt-get install python-jinja2 # necessary for web.py utility  
 $ apt-get install python-bottle # necessary for web.py utility

2.- Installing SSDEEP for calculating fuzzy hashes

 $ apt-get install ssdeep  
 $ apt-get install python-pyrex # required for pyssdeep installation  
 $ apt-get install subversion  
 $ apt-get install libfuzzy-dev   
 $ svn checkout http://pyssdeep.googlecode.com/svn/trunk/ pyssdeep  
 $ cd pyssdeep  
 $ python setup.py build  
 $ python setup.py install # run as root user

3.- Installing MongoDB and Python support

 $ apt-get install python-pymongo # for mongodb support  
 $ apt-get install mongodb # includes server and clients

4.- Installing Yara and Python support

 $ apt-get install g++  
 $ apt-get install libpcre3 libpcre3-dev  
 $ wget http://yara-project.googlecode.com/files/yara-1.6.tar.gz  
 $ tar -xvzf yara-1.6.tar.gz  
 $ cd yara-1.6  
 $ ./configure  
 $ make  
 $ make check  
 $ make install # finished yara installation  
 $ wget http://yara-project.googlecode.com/files/yara-python-1.6.tar.gz  
 $ tar -xvzf yara-python-1.6.tar.gz  
 $ cd yara-python-1.6  
 $ python setup.py build  
 $ python setup.py install # finished python support installation

5.- Modifying Tcpdump running privileges

This is necessary so Cuckoo can run Tcpdump as non-root user.

 $ apt-get install libcap2-bin  
 $ setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump  
 $ getcap /usr/sbin/tcpdump # to check changes have been applied

6.- Installing Cuckoo Sandbox

 $ sudo useradd cuckoo  
 $ usermod -a -G vboxusers cuckoo # add cuckoo to vboxusers group  
 $ id cuckoo # checks cuckoo user details  
 $ apt-get install git   
 $ git clone git://github.com/cuckoobox/cuckoo.git

7.- Configuring Windows Guest virtual machine

At this point we need to install Cuckoo python agent in the virtual machine that we want to use to run the malware. I am going to continue the work described in my previous post and use WindowsXPVM1 for this purpose.

First steps to prepare the Windows Guest system:

Install Pyton for Windows: http://python.org/download/
Install PIL Python module to created desktop screenshots: http://www.pythonware.com/products/pil/
Deactivate automatic Windows updates
Deactivate local firewall
Optional: Install third party applications (Office 2003/2007, Acrobat Reader...): http://www.oldapps.com/

Next we copy the Python agent to our Windows shared folder:

 $ cp /home/santiago/cuckoo/cuckoo/agent/agent.py /home/santiago/cuckoo/shares/WindowsXPVM1/

I also renamed it to agent.pyw to prevent the command prompt from showing. We can run it manually or configure it to run at Windows startup following these steps:

Copy to C:\Python27\agent.pyw
Add it to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: Name:'Agent' Type:'REG_SZ' Data:"C:\Python27\agent.pyw"

After executing the Python script on the virtual machine a new socket should be listening on 0.0.0.0:8000

Our virtual machine is now ready to run malware so it's time to save the system state creating a VirtualBox snapshot.

 $ vboxmanage snapshot "WindowsXPVM1" take "WindowsXPVM1Snap01" --pause

And these are the commands we can use to restore the snapshot.

 $ vboxmanage controlvm "WindowsXPVM1" poweroff  
 $ vboxmanage snapshot "WindowsXPVM1" restorecurrent  
 $ vboxheadless --startvm "WindowsXPVM1"

8.- Starting Cuckoo sandbox

Before starting Cuckoo for the first time, we need to configure Cuckoo VirtualBox settings to specify the virtual machine the system will use to analyze a malware sample. To do it we edit cuckoo/conf/virtualbox.conf file and set the following variables.

  [virtualbox]  
  # Specify which VirtualBox mode you want to run your machines on.  
  # Can be "gui", "sdl" or "headless". Refer to VirtualBox's official  
  # documentation to understand the differences.  
  mode = headless  
  # Path to the local installation of the VBoxManage utility.  
  path = /usr/bin/VBoxManage  
  # Specify a comma-separated list of available machines to be used. For each  
  # specified ID you have to define a dedicated section containing the details  
  # on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)  
  machines = WindowsXPVM1  
  [WindowsXPVM1]  
  # Specify the label name of the current machine as specified in your  
  # VirtualBox configuration.  
  label = WindowsXPVM1  
  # Specify the operating system platform used by current machine  
  # [windows/darwin/linux].  
  platform = windows  
  # Specify the IP address of the current machine. Make sure that the IP address  
  # is valid and that the host machine is able to reach it. If not, the analysis  
  # will fail.  
  ip = 192.168.56.101

Finally we can start our freshly installed Cuckoo sandbox.

  root@donkey:/home/santiago/cuckoo/cuckoo# python cuckoo.py
 
                                 _|                            
     _|_|_|  _|    _|    _|_|_|  _|  _|      _|_|      _|_|    
   _|        _|    _|  _|        _|_|      _|    _|  _|    _|  
   _|        _|    _|  _|        _|  _|    _|    _|  _|    _|  
     _|_|_|    _|_|_|    _|_|_|  _|    _|    _|_|      _|_|

  Cuckoo Sandbox 0.5  
  www.cuckoosandbox.org  
  Copyright (c) 2010-2012  
  Checking for updates...  
  Good! You have the latest version available.  
 2013-01-26 23:25:33,216 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" machine manager  
 2013-01-26 23:25:33,290 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s  
 2013-01-26 23:25:33,290 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks...

9.- Analyzing a malware sample

I decided to analyze the following malware sample: efeb717fdbb98d8043eb4c51254d9b74 You can find virustotal description here. We can use submit.py util for it.

 root@donkey:/home/santiago/cuckoo/cuckoo/utils# python submit.py /home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74  
 Success: File "/home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74" added as task with ID 4

And these are Cuckoo logs while performing the malware analysis.

 2013-01-26 23:34:00,275 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE "/home/santiago/binaries/efeb717fdbb98d8043eb4c51254d9b74" (task=4)  
 2013-01-26 23:34:00,286 [lib.cuckoo.core.scheduler] INFO: File already exists at "/home/santiago/cuckoo/cuckoo/storage/binaries/8dafb21e7d106a6c98f745f30c2577ee7b0984ec7ba2c4107f7ddcd0d127baf6"  
 2013-01-26 23:34:00,304 [lib.cuckoo.core.scheduler] INFO: Task #4: acquired machine WindowsXPVM1 (label=WindowsXPVM1)  
 2013-01-26 23:34:00,312 [lib.cuckoo.core.sniffer] INFO: Started sniffer (interface=vboxnet0, host=192.168.56.101, dump path=/home/santiago/cuckoo/cuckoo/storage/analyses/4/dump.pcap)  
 2013-01-26 23:34:02,063 [lib.cuckoo.core.scheduler] INFO: Task #4: analysis procedure completed

Then we can web.py Cuckoo tool to view the output of the analysis.

 root@donkey:/home/santiago/cuckoo/cuckoo/utils# python web.py   
 Bottle server starting up (using WSGIRefServer())...  
 Listening on http://0.0.0.0:8080/  
 Hit Ctrl-C to quit.

And at this point we can connect to our host through the web http://192.168.0.200:8080 and see our analysis report.

References

http://www.cuckoosandbox.org/
http://www.virtualbox.org/
http://www.virustotal.com/
http://blog.michaelboman.org/

Sunday, October 5, 2014

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Tuesday, September 23, 2014

OSSEC CON 2014 - Malware Detection with OSSEC

Sunday, January 27, 2013

Installing Cuckoo Sandbox on VirtualBox Ubuntu Server LTS