Demystifying Windows Malware Investigations w/ Patterson Cake

🛝 🔗 Webcast Slides –

From multiplate layers of obfuscation to conditional behavior to sandbox avoidance, malware can indeed be complicated.

But ultimately, when a Windows malware event occurs, the most important questions are “if” and “how” it impacted your environment!

In this free one-hour Black Hills Information Security (BHIS) webcast, Patterson Cake - Incident Responder, will discuss a simplified approach and tactical tips for answering those questions when investigating malware events on your Windows endpoints.

///Chapters
0:00 Introduction
3:55 Agenda and schedule
5:12 Win-Mal Investigations
7:32 Malware analysis
11:20 Malware commonalities
12:40 Most common threats (recent)
18:13 Technical possibilities
20:24 Windows malware investigation - artifacts
22:19 Network communications (C2)*
25:01 Disk (“Writable”)*
26:59 Running process (memory)
27:35 Services
28:25 Scheduled tasks
29:05 Running processes [DIFF]
32:34 Windows malware investigation collection
36:04 Win-Mal Investigation - WORKFLOW
46:30 Sandbox Analysis [FINDINGS]
48:08 Win-Mal Investigations [FINDINGS]
49:33 WinMal Technical Possibilities…
53:32 Q&A

[davidperez]

Patterson's presentations are always top notch!

[levireuss]

Thanks for sharing I have never thought about using a comparison like this between a good machine and infected machine!

[TheDavidlloydjones]

I used to be astonished that Patterson cared so little about knowing, or perhaps his own not knowing, assembler or perhaps even raw machine code. Coming to terms with this error of mine taught me a bit about one of my weaknesses.
What Patterson's position represents, very sensibly and profitably, is that not many bad guys actually operate in assembler or close to the metal. A very great deal of stupidity, harm, and even conscious criminality, is carried out in unsophisticated ways. It could be the drunk just picking up something that's not nailed down on the way home after the bars close. It could be the guy (usually) operating at the level of the kid who gets passed up to the next grade with scores of 40 because the teacher says What the hell else are we to do with the poor dope? There are so many of these unsophisticates, causing so much total harm in all their dopey ways, that even the unsophisticated good guy can catch a lot of them, or prevent a lot of harm by taking precautions, or scare a lot of these mopes straight, that simple honesty is worthwhile even without brilliant tools in its hands.
My not having understood this is one of the errors of perfectionism, to be charitable, or of absolutism to not be. This is not to say that there is no good role for _some_ perfectionism, or even absolutism, in a good society operating well. We don't mind is a jeweller or a graphic artist is a perfectionist. There must be other examples -- but life is short and the Sun wiould die out before I finished typing.
For most of us it is best not to be that perfect jeweller. We'd starve. And the world would be a better place if no young boy spent more than a few months infatuated with Ayn Rand. Damn, but that's something to try to bring about. Most ex-Ayn-Randers are doing a reasonable job on this problem. One of the reasons we survive...
Last quick note: I admire you folks a good deal, respect you a whole lot, and Oh, my goodness, but I am grateful for what you do!

[EasyMac]

On the topic of aggrandizing your adversary, the reality is that we don't strictly *know* our adversaries' capabilities, so assuming the worst case scenario and then working within your business constraints is a solid approach.