In this episode, we're going to talk about file analysis and how to go through the process of identifying
malware and appropriately responding.
We're going to take a look at both dynamic and static analysis and the differences between them.
We're also going to talk about file integrity and how to use hash values to ensure the integrity of
our files, both at the operating system structure as well as from an application structure.
We're also finally going to look at strings and how strings are utilized to go through our systems and
really go through and search different aspects of our operating system or our file structure to identify
different malicious activity that may be ongoing throughout this episode.
What you really need to take away from it is that Cisa expects you to have not only a theoretical concept
of it, but a practical standpoint.
This is divergent from what you may have seen in Security+.
As we go through these, take into account that we're only covering the theory right now.
In the next episode, we're going to get our hands dirty and actually look at it from a perspective
of practical standpoint.
Final analysis is the examination of the file to understand the behavior, the purpose, and the potential
impact of the system.
More often than not, when we do final analysis, we perceive that there may be an issue within the
file structure.
This could be because of a bug.
It could be because of another application interfering with the file structure.
Or if all things go bad, it could be because a malicious actor got in there and is messing with that
file structure.
File analysis is done in really two points, either a static analysis or a dynamic analysis.
We're going to talk about both those.
One way to identify static analysis is through signature analysis.
Every file on your system has a specific signature through the file header, or what's commonly known
as the magic number.
This signature provides information about the file type and can help determine if it matches the expected
format, whether it's NTFS or a Fat format this signature really provides us a clear viewpoint of if
the file has changed or not.
The next analysis type is considered metadata and a metadata analysis.
We're extracting the and analyzing the information embedded in the file.
When we look at pictures, we often identify the metadata in terms of if there's a GPS coordinate,
what type of pixelation is occurring, so on and so forth.
But in files we're looking at the actual data, as in what's the author's name.
When was the file created?
Has it been revised or changed recently?
All that metadata can lead us to whether or not the file has changed and if so, how it has changed.
The third type is a file structure analysis and a file structure analysis.
We're looking at the internal components such as headers or sections.
We're looking at data segments to identify.
Have there been changes to that and any abnormalities that may exist.
When we're looking at a file structure analysis, we're more looking to see if the data has moved or
changed in such a way.
That doesn't make sense for the actual file.
The last type of static analysis is considered entropy static analysis.
And this type we're looking at the randomness of the data.
If I see a data that hasn't have a lot of randomness to it, or it's very set up and repetitive, that's
indicative of a malicious content within that file structure.
If it has a lot of randomness, that means that the file is most likely sincere and doesn't have that
malicious content attributed to it.
Remember, when we see a lot of repetitive numbers or repetitive information within an entropy analysis
that leads to be indicative of a malicious content associated with that specific file?
The second type of analysis is called dynamic analysis.
When we sandbox something, we're really taking the file structure, and we're protecting our other
systems or other network features from that environment and a sandbox environment, we're closing it
off.
It doesn't have internet access.
It's usually set up in a virtual capacity to where if something happens in that environment, we can
just delete the entire thing, and it doesn't have any harm to our other systems.
In a dynamic analysis, we're going to actually start the file.
We're going to open it up and let the program run the way that it would normally run.
We're going to identify what happened.
Did it involve other applications?
Is it affecting the operating system?
Is it doing a lot of things that it shouldn't be doing, or is it working the way it should work?
And a file structure.
We're looking at the same perceptions that we would normally look in a static or a dynamic code analysis.
They're very similar in that we're looking to see what happens when we open or run that file in that
environment.
The other aspect is behavioral analysis.
Much like the sandboxing environment where we're going through and we're securing the system and a behavioral
analysis, we're looking at how it behaves in the environment that it's operating currently in.
This means that I can run the file structure and I can identify.
Did it touch other applications.
These are very similar in their degree.
But remember in a sandbox environment we're shutting it off from the rest of our network.
We can still run the behavioral analysis in that sandboxing environment which we described.
But we can also don't have to necessarily sandbox it.
Sometimes we don't perceive the threat to be that great, and we can run the behavioral analysis through
our indicative machine, meaning that the file is there and we're just going to run it and see what
happens.
I don't recommend this structure.
Usually when I move it to a sandbox environment after isolating that machine.
But sometimes we may perceive that the value based off of that machine and its capacity to do information
doesn't make sense.
We'll just isolate the machine and then run the file directly from it.
File integrity is where we go into play and we're measuring different files.
Remember, if I update a machine or it update to the latest operating system or even update the latest
software, the file structure could change.
We could be adding more information to that file.
We could be deleting old versions of that file.
In any case, it could change.
But what about my operating system?
Or what about a file structure that I didn't give permission for it to change?
If we're not writing new data to it, and it's a core portion of the operating system or the application
I'm running, the file structure should remain unchanged and the file should remain unchanged.
This is where we talk about file integrity.
The integrity of the file should not change unless I give it to patch or I'm updating the software,
or something is happening within my system that makes it change.
In this aspect, we can actually go through and measure.
If something changed, it should report to our system because the integrity of that file changes and
we track that through hashing mechanisms.
Through hashing, I take an individual file or multiple files, and I hash each individual file separately.
That gives me a hash value.
If that value changes, I know that something within that file has also changed.
This is where file integrity checks take place.
Now, we haven't talked about hashing yet, so let's show what it really looks like on Kali.
I'm just going to show you real quickly what a hash looks like.
And what happens if we change a file within our system and run a new hash.
Let's take a look at that now.
So here I am on my Kali box.
I'm going to go ahead and open up a terminal real quick.
And let me blow this up so you can actually read it.
The first thing that we need to do is actually create a file or a document in which to hash.
I'm going to create one.
Right now I'm just going to use a program called Leafpad.
It's much like notepad that you might see on a Microsoft windows machine.
It does the same thing.
So I'm going to name my file and I'm just going to name mine total SEM.
Just like that I've created my file.
It opens up right here.
And here you can see that I can type whatever I want in.
I'm going to put I'm going to pass my c y s A+ exam with flying colors.
Thanks doctor.
Kay.
Exclamation marks, four of them.
Just to be safe, we're going to save this right here.
And I'm going to go ahead and close it.
Now if I do an LZ I can see this right here.
My total SEM document.
And I'm going to run a hash on that.
I'm going to run a basic MD5 hash by typing MD5 sum.
And then the file I want to hash I press enter.
And you can see here that it gives me a hash value for MD5.
Now I could do this on a Sha as well.
I could do a Sha 256 sum and again I could run it on the file.
Total seminars.
Oops.
Total.
Let's do that tab key just like that.
And again you can see here that the Shah is actually quite a substantially larger than our MD5.
Now let's go back into that same file.
I'm going to go leafpad total Cem.
It's going to open it back up.
And I'm only going to change one thing.
I'm just going to delete this one exclamation mark.
That's all I'm going to do.
I'm going to resave it.
And again it's resaved.
Let's rerun that sha256sum for that hash value.
I want to point out that all I did was erase one exclamation mark and look the Sha value.
The hash value has changed.
If we were identifying this through automated means, we would know that something changed right off
the bat, because this was our baseline hash for that file, and it now has changed.
When we reran the hash value.
Now we can set up our system to rerun hashes on an hourly basis every ten minutes.
It doesn't really matter how often we do it, we just want to do it at least 24 hours every 24 hours
to prove the integrity of our file system.
Let's go back and change the file to its original content.
I'm going to open up again that leafpad total.
I'm going to go in there and again, I'm going to go back to the very end and re-add that one exclamation
mark.
Let me go back there and save it again.
There we go.
And I'm going to run that 256 to total sum.
And look at that.
Our hash value is back to the original hash value that we had, because the value has changed back to
the original point.
This is where hashing comes into play, where it provides us a good signature of the files, and if
the integrity changes, it will notify us.
I want to go into strings and talk a little bit about what they are and how they're utilized.
Strings are a utility that we utilize to analyze binary and executable files within our core structure.
This provides us a good segue into understanding what's going on in terms of search capability.
This means that I can go through and actually look at registry Keys and find out if malware has inadvertently
changed our registry keys from our original operating system.
Now, it doesn't sound like much, but this could be an invaluable tool if I'm trying to define or identify
potential malware within my core operating system, we're going to go through registry strings from
a hands on perspective later within this course.
If I have file names on my system, I need to be able to search and make sure that those file names
correspond directly to the program that it's associated with.
I want you to imagine that you're programming a big game, and you've got a lot of files on your computer
system that are pulling into this program to allow your character to move from point A to point B,
if that file name suddenly changes, you've ruined the entire program.
That's a problem with file names changing.
If we have a file name that we want to make sure that it doesn't change, then our pathway of strings
will allow us to go through and search for those individual file names.
It could also lead us to other malware.
If I take a file name and I input it, or I change it very slightly, let's say that I have a file name
called operating system.
I have this original file.
It's for the original operating system, and it has all kinds of configuration and required files injected
within it.
If I'm a malicious user, I could rename that file name to File names dot.
Just it just file names with a period at the end.
I then create a new folder that it's called file names.
This poses a problem within our security infrastructure.
That malicious actor can then inject that file names folder with all kinds of malicious activity, and
change the code that was originally perceived within it.
They didn't delete the file names folder, they just changed it, and they substitute it with their
version of that file names folder.
This poses problems.
The next portion is pass.
If I have a path that's attributed to a specific file name and that path changes, it again could ruin
the program.
But what if I divert that same path over to a different file that has malicious code injected within
it?
You see the problem?
These strings really provide us a gateway into understanding where things are and how to get to them.
Host names are no different.
If I go into a hostname and I change the hostname from what it was originally, i.e. Chet's computer,
over to Dave's computer, I've changed the name.
This could pose problems when we're intersecting across our network IP addresses and of course URLs
encryption keys.
These all have a similar function.
Let's get to encryption keys because I want to kind of touch on this one a little bit.
Encryption keys make up a key fundamental portion of any system within our network.
Communicating with another system in a secure environment.
If a malware gets into or a malicious user gets into our encryption keys and we're using a PKI structure,
they might now have access to our private key.
That means that all that communication that was embedded within our systems that we perceive to be very
secure is no longer secure.
They can now intercept that information that we deem to be encrypted and decrypt it without even actually
being on the machine.
If you remember your days from Security+, your public private key infrastructure plays a major role
in our secure transmission of encrypted information from one system to another by having that private
key be exploited or taken advantage of or grabbed or stolen, we have a major problem.
They don't actually have to read that encrypted messages on that system.
Once they have that private key, they can grab that information through a man in the middle attack
and then be able to read it, remove it, and even change it at will because they have that private
key.
In this episode, we talked about file analysis and how the differences between static versus dynamic
analysis.
We talked about the importance of static analysis and how it really provides us not only with metadata,
but signature analysis and those different analysis types to ensure that malware or malicious users
don't take advantage of our file structures.
We talked about dynamic analysis and the use of sandboxing, and how we can utilize behavior analysis
to identify if something is occurring from a malicious user or malware to intercept or change that file
structure.
We also touched on file integrity and how file integrity can be utilized through hashing values to ensure
that files don't change from their regular or authorized viewpoint without patching or software upgrades.
Finally, we talked about strings and how strings can be utilized to search functions across our systems,
and how malicious actors can change file names and change paths to provide access to their own malware
without actually deleting anything off our core system.
This provides them a different pathway to avoid integrity checks.
We've identified how encryption keys are utilized on our file structure, and how those encryption keys
can be utilized by malicious actors.
Within your size.
A+ exam, you need to remember that all the things that we covered throughout this episode are potentially
part of your exam, and the questions that you may face, however they're going to be scenario based.
You should expect to see differences between static and dynamic analysis.
You should also expect to see questions on file integrity and the usage of hash files, to ensure that
file integrity hasn't changed.
Finally, you should probably expect to see some questions very roughly or very high level on strings
and how to utilize those strings.
Don't worry, we're going to go into strings in a much more in depth level further along within this
course.