ファイルベースのサンドボックスの回避



Similar documents
さぬきの安全2016-cs5-出力.indd

看護学科案内'16/表紙

2016東奥義塾高等学校スクールガイド

01.P28-01

美唄市広報メロディー2014年1月号

2011上宮太子_高校_学校案内

データシート / FireEye Network Security


オンラインによる 「電子申告・納税等開始(変更等)届出書」 提出方法


- 2 Copyright (C) All Rights Reserved.

Adobe Acrobat DC 製品比較表

KASPERSKY ENDPOINT SECURITY FOR BUSINESS IT IT IT IT IT Kaspersky Endpoint Security for Business IT IT IT IT 2013 NAC Advanced 2013 Select Select Work

PX-1004

LAPLINK ヘルプデスク 導入ガイド

Mac OS X Windows...15 Mac OS X...16 Windows /...24 /...24 / Windows...2

- 2 Copyright (C) All Rights Reserved.

FileMaker Pro Tutorial

2

82801pdf.pqxp


FileMaker Server Getting Started Guide

Flash Player ローカル設定マネージャー

PX-504A

how-to-decide-a-title

Adobe AIR のセキュリティ

FileMaker Server Getting Started Guide

Security Solution 2008.pptx

FileMaker Pro Advanced Development Guide

Microsoft PowerPointの利用 V 1,1 暫定版

ES-D400/ES-D350

Hitachi Solutions, Ltd All rights reserved. 1

EPSON PX-503A ユーザーズガイド

PscanServシリーズ クイックリファレンス

Adobe Bridge Bridge Bridge Bridge P10 Bridge Finder 2

Installation and New Features Guide for FileMaker Pro and FileMaker Pro Advanced

相続支払い対策ポイント

150423HC相続資産圧縮対策のポイント

2


ハピタス のコピー.pages

Copyright 2008 All Rights Reserved 2

EPSON ES-D200 パソコンでのスキャンガイド

PX-434A/PX-404A

FileMaker Instant Web Publishing Guide

山梨県ホームページ作成ガイドライン

PX-403A

FileMaker Server 9 Getting Started Guide

HTML5無料セミナ.key

FileMaker Pro 15 および FileMaker Pro 15 Advanced インストールおよび新機能ガイド

インテル® VTune™ パフォーマンス・アナライザー 9.1 Windows* 版

FileMaker Pro 9 Advanced Development Guide

#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma

EP-704A

PI_7„”“ƒ_P080~081fid”q‘‚’Ð

1000 Copyright(C)2009 All Rights Reserved - 2 -

名刺ファイリングOCR ユーザーズガイド

PX-B750F

FileMaker Pro 9 Tutorial

SonicWALL SSL-VPN 4000 導入ガイド

29 jjencode JavaScript

untitled

Copyright 2009, SofTek Systems, Inc. All rights reserved.

PX-K100

FileMaker Instant Web Publishing Guide

Transcription:

2 3 3 5 11 VMware 14 17 17 FireEye 18 1

FireEye? API iframe DLL VMware VMware VMX 2

1 C&C FireEye 2012 12 UpClicker 1 2 3 UpClicker C&C APT Advanced Persistent Threat RAT Poison Ivy 4 1 UpClicker 0Eh SetWinodwsHookExA Windows WH_MOUSE_LL 5 1 Gartner. Best Practices for Mitigating Advanced Persistent Threats. January 2012. 2 FireEye. Don t Click the Left Mouse Button: Introducing Trojan UpClicker. December 2012. 3 Symantec. Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems. October 2012. 4 ZDNet. Nitro targeted malware attacks hit chemical companies. November 2011. 5 Microsoft. SetWindowsHookEx function. June 2013. 3

1 fn 1 fn 2 2 fn UnhookWindowsHookEx () sub_401170 () UpClicker 6 APT BaneChant 3 6 6 FireEye. Trojan.APT.BaneChant: In-Memory Trojan That Observes for Multiple Mouse Clicks. April 2013. 4

Windows API MessageBox MessageBoxEx EXE DLL Adobe Acrobat PDF JavaScript for Acrobat API app.alert() 3 OK app.launchurl() URL 3 Web JavaScript Web URL API API 2013 2 Nap 7 Nap Microsoft Kaspersky 2011 Kelihos 8 7 FireEye. An Encounter with Trojan Nap. February 2013. 8 Microsoft. Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case. September 2011. 5

4 Nap Nap wowrizep.ru newbos2.exe HTTP 4 5 SleepEx() 60 10 0x0927C0 10 alterable false 10 5 SleepEx Nap 6

1 API NtDelayExecution() PDF JavaScript for Acrobat API app.settimeout() PDF 6 mystr() 100 16 6 app.settimeout() mystr() 100 JavaScript for Acrobat API 2013 3 Hastati 9 Hastati Windows SystemTime API GetLocalTime() 7 SystemTime 16 07 DD wyear 2013 00 06 wmonth 6 00 01 wdayofweek 00 11 wday 17 9 Vinay Pidathala, Yasir Khalid, et al. More Insights on the Recent Korean Cyber Attacks (Trojan.Hastati). March 2013. 7

7 Hastati GetLocalTime() 2013 6 17 2013 3 20 2 Sleep() 0EA60 6 8 6 Sleep() 8 Sleep() 8

Microsoft PsSetCreateProcessNotifyRoutine Windows Windows PsSetCreateProcessNotifyRoutine Windows XP SP2 8 6 Pushdo Pushdo 10 Pushdo PsCreateProcessNotifyRoutine PsSetCreateProcessNotifyRoutine 9 IDA Windows ntoskrnl.exe PsSetCreateProcessNotifyRoutine x86 9 ntoskrnl.exe PsSetCreateProcessNotifyRoutine 10 Gunter Ollmann (Security Dark Reading). Much Ado About PushDo. May 2013. 9

Pushdo 10 Pushdo 1. NtBuildNumber Windows Windows XP 32 2600 64 3790 2. PsSetCreateProcessNotifyRoutine 11 jmp_pssetcreateprocessnotifyroutine PsSetCreateProcessNotifyRoutine jmp jmp 2 PsSetCreateProcessNotifyRoutine jmp PsSetCreateProcessNotifyRoutine + 2 3. 5 0x57 0xBF 0xBF PspCreateProcessNotifyRoutine 4. PsCreateProcessNotifyRoutine Windows XP 0xBF mov edi 0x57 push edi 10 PsCreateProcessNotifyRoutine 11 jmp PsSetCreateProcessNotifyRoutine 10

Flash 12 Flash ActionScript Flash Player geturl() v GET Flash f.swf 12 Flash Flash Flash 11

PDF 13 JavaScript Acrobat Reader API app. viewerversion() 6.0 13 Acrobat JavaScript GIF Flash iframe GIF Acrobat Flash HTML iframe GIF Flash 12

GIF GIF 1 GIF 0x3B GIF iframe 14 14 GIF iframe Flash GIF Flash Web iframe 15 iframe Flash Flash HTML Flash iframe GIF 15 Flash iframe 13

DLL DLL run32dll.exe DLL DLL DLL 16 16 VMware APT FireEye 11 VMware VMware VMware VMware vmicheatbeat vmci vmdebug vmmouse vmscis VMTools vmware vmx86 vmhgfs vmxnet 11 Virus Bulletin. Techniques for Evading Automated Analysis. February 2013. 14

17 RegOpenKeyExA() VMware RegOpenKeyExA() 17 RegOpenKeyExA() VMware VMware VMware 1 VMware 18 GetFileAttributeA() VMware 18 GetFileAttributeA() VMware GetFileAttributeA() cmp eax 0FFFFFFFh -1 vmmouse.sys VMware 15

VMX VMware VMX VMware 19 19 I/O VMware 1. move eax, 'VMXh' 0x564D5868 EAX 2. EBX 3. ECX 0Ah VMware 4. DX VX VMware 5. in eax, dx EAX VMware 16

1 3 iframe FireEye Multi-Vector Virtual ExecutionTM MVX Flash/JPG iframe API VMware 1 2 3 1 3 1 1 FireEye MVX http://www.fireeye.co.jp/products-and-solutions/virtual-execution-engine.html 17

FireEye FireEye FireEye IPS FireEye FireEye Web 3 FireEye 2012 12 31 40 900 Fortune 500 100 http://www.fireeye.co.jp 2013 FireEye, Inc. All rights reserved. FireEye FireEye, Inc. RPT.HKTB.JA.082013 101-0054 1-1 6 TEL: 03-4577-4401 japan@fireeye.com www.fireeye.co.jp