Hello and welcome back to a new section in this section, we are going to take a look at windows in
tunnels, malware misuses and manipulate its operating system functionalities and feature.
A man with endless needs to be aware of all of it.
Operating systems and windows in tunnels, big subjects.
But we do not know everything about it.
We only need to know those common windows in tunnels.
Necessary for another analysts.
So let's get started.
The first topic is an understanding of how we did it to API.
API stands for application programming interface.
It is just another technical name for functions.
Collection functions.
Win32 gives you entry to get those details provided by Microsoft Windows, they are found in this directory
called C Windows System to be to an example of such an API or function is known as cardinality to DRM,
connected to the contains many functions that are commonly used by application programmers.
And even Melvin.
Novartis that is trying to open community to the NFL in CFF Explorer.
Open up the flag folder.
Then when the utilities for the.
And then launch CFF Explorer.
Click on.
The open for the open fire and navigate to this territory, see Windows System three to.
Scroll down and look for Col to the to the D.A..
Once they find founded Discon.
Now let's go and look and export.
Directory.
For these DRL.
At the bottom, you will see the list, all the functions that exported by the country to the.
Klaus Hendel, for example.
Contestants.
Copy file.
Create directory.
And many, many more.
Other details provided by giving those examples are indeed around the country to which we have just
seen Colonel based Daniel Guidetti to the D.A., used to lead to the yellow community outreach to the
head repeatedly to the Hill yesterday to try to.
There are also details provided by officials to you as the UK runtime examples are MACV Shakira.
Yeah, I massive even six zero ducktail and also a collection of v.C runtime yellow SHC refers to the
version of the SDK and there is also the dominant framework's which is needed by C shopping with MediaNet
to run.
Next, we look at studying Win32 API from MSDS documents.
One of the essential skills of a member analyst is to be able to search for Win32 API documentation.
We use Google for searching the Internet for the API and EMCDDA and.
Try Googling, create file MSDS and see what you get.
Can you find this thing?
And you will see a few results.
This is the one, the one.
Here you see a description of a function.
And here is the barometer, at least.
And below explanation of each of the parameters.
Can use the medium to understand what particular API does.
Create value not just for creating funds, you can also read funds, it all depends on the parameters
passed to the function.
API parameters, govern functionality, create a set seven parameters.
They did create this position for me to decide if it is for creating file or reading a file.
This is someone.
Great position.
There are also pesky Unicode versions of APIs.
Create a husky version of the stream, great for W accents, Unicode.
Many other Abbi's also coming to Washington just like this.
California is shown on the left of the U.S. is right.
In California, the first parameter is LPC, SD her.
In Korea, for the first Baramidze LPC, w the W stands for white meaning unico.
They're also knee deep in diversions of APIs.
For example, create a and create fun w I provided by country to the hotel, as we have seen earlier,
another version is A. Create Fun, which is provided by the.
It is much lower level because it is closer to the canal, both A and B, the and create a file internally.
And Gail then uses system calls Sisco's to execute the task.
Sisco's colonel level functions.
Colonel, formations are the heart of the operating system.
Contrast this with user functions also known as APIs, which makes use of kernel level functions.
Extended version of an EPA, some EPA eyes have an extended version, for example, what at X is the
extended version of what you ELAC.
They are used to allocate virtual memory.
Which allocates virtual memory for the current running process.
On the other hand, virtual eggs and virtual memory for other running processes.
Malware frequently makes use both of them.
And also make Hueso, which along unpegging isa.
The also undocumented APIs.
For example, and Abbi's in India, not officially documented by Microsoft, but hackers and reverse
engineer it and put up unofficial documents.
Check out this link here.
You can search by contents.
By next hour, kin, a search for an API, which you want to investigate.
Take an example of an undocumented in the create section and deaccessioning is an undocumented API,
commonly used by malware for a technique called process following.
So if you want, you can read about this and A.S. session by going to the undocumented API here and
clicking on search.
And
create section.
Click on the result and you can read all about it and create section.
What is process hallowing process Hallowes technique used by some way in which a legitimate process
is loaded on the system solely to act as a container for Starkel?
At lunchtime, the legitimate court is located and replaced with malicious.
The advantage is that this helps the process higher amongst normal processes.
It is also good to be home APIs that are commonly used by malware, for example, APIs that perform
foreign operations create far right file Retha set for pointer for clues for APIs to perform registry
operations.
Create key, right, the key set value appetite for ritual memory, virtual ALAC, virtual protect and
create section right process memory.
And a.m. U.S..
On processes and treach, create process, exit process.
Create a remote track, create track, get context, set context, Terminix process.
And create process, internal
APIs deals, library, get address.
APIs on Windows Services Open as sea manager creates service when service to service, config to w start
service.
Epizyme, new taxes create new tax on mutex.
Knowledge of these common APIs who have you great in trying to identify malicious behavior.
Next, we will take a look at behavior identification APIs.
Behaviour identification, if you say show episcopacy is not necessarily malicious.
You need to analyze and one context and with two parameters, supply to happiness and number three,
sets of APIs used in sequence.
Let us take the case process hollowing.
Example, one process loading process hollowing is a popular technique used by analogy, it uses create
process API to create a brand new process in suspended mode.
To do that, he sets the W creation plan to create suspended normal programs do not do that.
This is an example of the creative process API.
So he says this these are Ukrainian flights to the value of suspended.
Example to reprocess memory, this Ippei, right into the memory of another process, debuggers used
this, so by itself it is not malicious, but either process, in addition to reprocess memory, also
uses virtual eggs and create remote trap.
Then it is highly malicious.
Therefore, the set of APIs used secrets is what makes it suspicious.
Using Hendel to identify sequences, Hendo is a reference to philes, registry, memory and processes.
Prosthesis makes use of handles to perform operations on the object, he refers these handles parameters
which are passed to prosthesis.
Tracking or tracing these handles can help us to identify the sequence of APIs for any running process,
and these sequences help us to confirm whether a process is indeed a malware.
Let us take an example of the create file API
examples of using handle's create far.
And here are examples of four functions.
The first one is created for.
Taking as the barometer here, this tax Philco test, one of the.
For putting it for writing.
And after opening this fire or creating this fire, if he does not exist, if we return a full handle
and safety in this variable called Haifaa one.
In the mid to.
He does the same thing, but this time he opens another file tax to the Tastee also for writing, and
if this doesn't exist, it will create new fire.
And he also returns a file handle and sees it in another reference call.
He filed two, so we have to file handles here for one, and he can't, you know, can you identify
the sequences?
To trace the Henders.
So first, you take a look at his file, one Hendel.
When you look down here, you will notice how far Iran is also in and far right, far right fall.
See this perimeter here?
One so rifle uses fire, one to write to.
And the funding is being written to East Texas one because Texas one.
References Hitcher Fireline.
So.
Sequence number one four belong to the same process.
Another example is Hitchcock to Hitchcock to is use here number three.
So in number three, he also writes to the father, thanks to.
Using his profile to handle so number two and number three from another sequence, so this is what he
means by identifying sequences.
By using the handles, this is a useless cuth who had been trying to identify malicious behavior.
So that is all for this Essid.
Thank you for watching and I'll see you next time.