- Prison Code Breaker Diary -

We need some monitoring tools loading up before tracking the malware. In this case, I open ProcessXP, ProcMon and TCPView.




The malware I use this time to monitoring is Trojan.Win32.DesktopPuzzle
Now, activate virus to see what happen next...(s.c.a.r.y... :D)

A dialog appears with some note, like a joke
Don't click OK yet, switch to ProcessXP to check its info



It's like the author intentionally leaving his name there.
The PID is 1424 (it is different from your system), then we switch to ProcMon to filter.
Press CTRL+L or menu Filter->Filter then choose PID, input the malware process id, click Add, Apply, then OK, you will have this result similarly:


Ok! Now it's time to click the OK button of the "Joke Dialog".

This is the funny result after clicking it ...

Yea...it's frikkin' weird..

Now press Ctrl+Alt+Del, the task manager will show up, just kill the malware process and everything comes back to normal.

Check again on ProcessXP, we can see that it stopped and nothing else spawns, which means there is no weird thing running and system is just fine by now.

View on the event log in ProcMon, we can easily see that it doesn't do anything harm to the system. It just creates several files unharmed and access some DLL to create viewport of desktop, which makes desktop like a puzzle.
Since this is just a simple sample of malware, so it's a good practice to start with.
Simple but require lots of skills, you may find a hard one later on.
You can find lots of malware out of Internet and try yourselves.

The one that I use here is called "Joke Slider" - unwanted program :))

Have fun!

This step is very simple, we need an anti-virus scanner to identify what the heck is `that thing`.
You might already have installed an anti-virus for your system like Kaspersky Internet Security, Panda Antivirus, ClamAV, AVG, NOD-32....whatever :D
I also use online virus scanners to detect virus.
Here the list of online scanners:

• VirusTotal: http://www.virustotal.com/
• BitDefender Online Scanner: http://www.bitdefender.com/scanner/online/free.html
• Kaspersky Lab: http://www.kaspersky.com/virusscanner/
• TrendMicro - Housecall: http://housecall.trendmicro.com/
• F-Secure Online Virus Scanner: http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/online-scanner/
• Panda Active Scan: http://www.pandasecurity.com/homeusers/solutions/activescan/

They're all good scanners; however, VirusTotal is the best one, awesome I think, because it uses most of popular scanners to trace the result and make a list. Additionally, it does query virus file information like import/export, API, function call....pretty convenient!!!

Let's start our journey!

First, we need a malware, I pick a Trojan, Trojan.Win32.VirtualRoot (or CodeRed).
Click here to download Trojan.Win32.VirtualRoot

Then, extract the file, don't double click on it or you're dead. Assuming that you are under virtual machine, ok? Don't do this on your main system.

Access VirusTotal homepage and upload the file (extracted one ...), here the result:

Interesting, huh? As you can see most of scanners identify it as VirtualRoor or CodeRed.
Also, there are something interesting below:


It let us know its MD5 and SHA1 hash, PE information, entry point address, library import/export (kernel32.dll, advapi32.dll) and all API called if it is activated (double-click :D).
Wow, they're valuable information for us in order to monitor and tracking events. Especially, it's very helpful for dissassemly.

Remember, whether you can identify the malware or not, we still need to test it in reality in order to confirm the malware. It's great to write an analysis about the one not being reported yet, isn't it?

Let's stop here!

Have fun!

There are some terminology that you need to know.

1. Malware
2. Virtual Machine
3. Snapshot
4. Disassembler
5. Portable Executable

If there is any more term related, I will post it here.

Have fun!

Before starting to work with malware, you probably need some basic knowledge as requirements. Of course, it's great if you have high experiences in this area.
Here is something I recommend you to know before moving to next step.

1. You must be very familiar with Windows and can use it well. What does that mean? Well, it's simple; you can fix when something goes wrong, you know and can use Windows utilities to fix problems ( msconfig-MS Configuration Utility, regedit-Registry Editor... )...
2. Already have experiences dealing with virus, worm, trojan...
3. Know how to use VMWare or any virtual machine effectively, being able to control Snapshots.
4. Understand assembly code and how it works because we're gonna spend time on disassembling and debugging.
5. Know how to how OllyDbg and IDA.

That's all I guess. It takes your patience and learning ability.

Have fun!

Virus, worms, trojans, mal-application .... or whatever, malware is growing days by days.
I myself have a little interest in this, and am trying my best to practice and analyze them.
Just beginning but hope it will help somebody.

I. Preparation:
1. Creating a controlled environment.
2. Setting up tools and utilities.
3. Basic knowledge and understandings.
4. Terminology.

II. Analysis:
1. Identifying the malware.
2. Monitoring events.
3. Debugging / Disassembling the malware.
4. Verifying and conducting the malware.

II. Conclusion:
1. Summarizing the malware.
2. Special notes or references.

Every section and steps will be written soon and linked to the notes on my blog.
Take your time and gimme any suggestion to improve or correct mistakes.

Have fun!