蓝队技术 | 使用Sysmon日志识别和分析Windows恶意活动

要解决的问题

在开始本文的内容之前，我们需要先在脑海里记住以下几个问题，并带着这些问题来阅读本文：

希望大家阅读完本文之后，能够解决上述的这八个问题。

Sysmon

背景

Sysmon日志是由Microsoft系统监视器（Sysmon）生成的事件日志，它们提供有关Windows上的系统级操作的详细信息，并记录进程启动、网络连接、文件和注册表修改、驱动程序和服务活动以及WMI操作等活动，通过分析Sysmon日志，安全专家可以检测潜在风险、发现异常并响应安全事件，以增强整体系统监控和安全性。在不断变化的网络安全环境中，提前防范威胁非常重要。

Sysmon日志在这项工作中发挥着至关重要的作用，它提供了有价值的见解，并使组织能够加强其安全态势。Windows是企业环境中的主要操作系统，全面了解Windows事件日志、其独特特征和局限性以及通过Sysmon进行增强的潜力至关重要。

Event ID

Sysmon日志中所使用的全部Event ID都已经在微软的Sysmon页面上进行了介绍，其中包括：

工具

本文所进行的安全分析都将在一台Windows VM虚拟机中执行，并配置好Linux Bash Shell的Windows子系统。由于分析过程中会遇到大量的JSON数据，因此本文选择使用jq工具，该工具可以使用choco包管理器安装，安装命令如下：

代码语言：javascript代码运行次数：0运行复制

choco install jq

数据

概览

下载的zip压缩文件中只有一个文件：

代码语言：javascript代码运行次数：0运行复制

oxdf@hacky$ unzip -l unit42.zipArchive:  unit42.zipLength      Date    Time    Name---------  ---------- -----   ----1118208  2024-02-14 08:43   Microsoft-Windows-Sysmon-Operational.evtx---------                     -------1118208                     1 file

这些就是来源于目标系统的Sysmon日志，解压之后，我们会看到一个大小为1.1MB的Windows事件日志：

代码语言：javascript代码运行次数：0运行复制

oxdf@hacky$ file Microsoft-Windows-Sysmon-Operational.evtxMicrosoft-Windows-Sysmon-Operational.evtx: MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 170oxdf@hacky$ ls -lh Microsoft-Windows-Sysmon-Operational.evtx-rwxrwx--- 1 root vboxsf 1.1M Feb 13 22:43 Microsoft-Windows-Sysmon-Operational.evtx

进程日志

笔者认为，用于将Windows事件日志格式转换为JSON的最佳处理工具就是Eric Zimmerman开发的EvtxeCmd.exe。接下来运行该工具，并将日志文件提供给EvtxeCmd.exe，并使用–json [file]参数运行：

代码语言：javascript代码运行次数：0运行复制

PS > EvtxECmd.exe -f .Microsoft-Windows-Sysmon-Operational.evtx --json .EvtxECmd version 1.5.0.0Author: Eric Zimmerman (saericzimmerman@gmail.com)Command line: -f .Microsoft-Windows-Sysmon-Operational.evtx --json .json output will be saved to .�40408132435_EvtxECmd_Output.jsonMaps loaded: 438Processing Microsoft-Windows-Sysmon-Operational.evtx...Chunk count: 3, Iterating records...Record # 4 (Event Record Id: 118750): In map for event 26, Property /Event/EventData/Data[@Name="Archived"] not found! Replacing with empty stringRecord # 27 (Event Record Id: 118773): In map for event 10, Property /Event/EventData/Data[@Name="SourceProcessGuid"] not found! Replacing with empty stringRecord # 27 (Event Record Id: 118773): In map for event 10, Property /Event/EventData/Data[@Name="TargetProcessGuid"] not found! Replacing with empty stringRecord # 46 (Event Record Id: 118792): In map for event 26, Property /Event/EventData/Data[@Name="Archived"] not found! Replacing with empty stringEvent log detailsFlags: NoneChunk count: 3Stored/Calculated CRC: 9B75E006/9B75E006Earliest timestamp: 2024-02-14 03:41:26.4441194Latest timestamp:   2024-02-14 03:43:26.8870662Total event log records found: 169Records included: 169 Errors: 0 Events dropped: 0Metrics (including dropped events)Event ID        Count1               62               163               15               17               1510              111              5612              1413              1915              217              722              323              2626              2Processed 1 file in 0.6669 secondsFLARE-VM 04/08/2024 09:24:35

在输出数据的底部，给出了识别到的日志类型，其中有56条日志与Event ID 11有关。

数据格式

生成的JSON数据是一系列日志记录，JSON中的每一行代表一条日志记录：

代码语言：javascript代码运行次数：0运行复制

PS > cat .�40408132435_EvtxECmd_Output.json | select -first 1{"PayloadData1":"ProcessID: 4292, ProcessGUID: 817bddf3-3514-65cc-0802-000000001900","PayloadData2":"RuleName: -","PayloadData3":"Image: C:Program FilesMozilla Firefoxfirefox.exe","PayloadData4":"QueryName: uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com","PayloadData5":"QueryStatus: 0","PayloadData6":"QueryResults: type:  5 edge-block-www-env.dropbox-dns.com;::ffff:162.125.81.15;198.51.44.6;2620:4d:4000:6259:7:6:0:1;198.51.45.6;2a00:edc0:6259:7:6::2;198.51.44.70;2620:4d:4000:6259:7:6:0:3;198.51.45.70;2a00:edc0:6259:7:6::4;","UserName":"DESKTOP-887GK2LCyberJunkie","MapDescription":"DNSEvent (DNS query)","ChunkNumber":0,"Computer":"DESKTOP-887GK2L","Payload":"{"EventData":{"Data":[{"@Name":"RuleName","#text":"-"},{"@Name":"UtcTime","#text":"2024-02-14 03:41:25.269"},{"@Name":"ProcessGuid","#text":"817bddf3-3514-65cc-0802-000000001900"},{"@Name":"ProcessId","#text":"4292"},{"@Name":"QueryName","#text":"uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com"},{"@Name":"QueryStatus","#text":"0"},{"@Name":"QueryResults","#text":"type:  5 edge-block-www-env.dropbox-dns.com;::ffff:162.125.81.15;198.51.44.6;2620:4d:4000:6259:7:6:0:1;198.51.45.6;2a00:edc0:6259:7:6::2;198.51.44.70;2620:4d:4000:6259:7:6:0:3;198.51.45.70;2a00:edc0:6259:7:6::4;"},{"@Name":"Image","#text":"C:\Program Files\Mozilla Firefox\firefox.exe"},{"@Name":"User","#text":"DESKTOP-887GK2L\CyberJunkie"}]}}","UserId":"S-1-5-18","Channel":"Microsoft-Windows-Sysmon/Operational","Provider":"Microsoft-Windows-Sysmon","EventId":22,"EventRecordId":"118747","ProcessId":3028,"ThreadId":4452,"Level":"Info","Keywords":"Classic","SourceFile":"Z:hackthebox-sherlocksunit42Microsoft-Windows-Sysmon-Operational.evtx","ExtraDataOffset":0,"HiddenRecord":false,"TimeCreated":"2024-02-14T03:41:26.4441194+00:00","RecordNumber":1}我们还可以使用jq对结果JSON数据进行处理，并获取到记录进程的Event ID统计信息：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -sc 'group_by(.EventId) | map({EventId: .[0].EventId, count: length}) |.[]'{"EventId":1,"count":6}{"EventId":2,"count":16}{"EventId":3,"count":1}{"EventId":5,"count":1}{"EventId":7,"count":15}{"EventId":10,"count":1}{"EventId":11,"count":56}{"EventId":12,"count":14}{"EventId":13,"count":19}{"EventId":15,"count":2}{"EventId":17,"count":7}{"EventId":22,"count":3}{"EventId":23,"count":26}{"EventId":26,"count":2}

代码语言：javascript代码运行次数：0运行复制

进程

了解数据

首先，我们要先查看进程事件，以了解目标设备上正在运行哪些程序，然后将这些事件信息保存到一个文件中（过滤出Event ID为1的事件并保存）：

代码语言：javascript代码运行次数：0运行复制

PS > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 1)' > eventid1.json现在，我们就可以查看保存好的日志文件并了解日志中的字段信息了：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .eventid1.json | jq -s '.[0]'{"PayloadData1": "ProcessID: 5584, ProcessGUID: 817bddf3-3679-65cc-2902-000000001900","PayloadData2": "RuleName: technique_id=T1027,technique_name=Obfuscated Files or Information","PayloadData3": "SHA1=282F855BEB4FACF0726E13ECCADB7D3411B30B85,MD5=A1F5FF25E3D0F160BC7CE7CA57349D83,SHA256=B412C45DE423534D85F121ABC348FB38020FDA804EA0A972708B7447B0E7325D,IMPHASH=F84029681F81FED23E3E067364DA1699","PayloadData4": "ParentProcess: C:Program FilesMozilla Firefoxfirefox.exe","PayloadData5": "ParentProcessID: 4292, ParentProcessGUID: 817bddf3-3514-65cc-0802-000000001900","PayloadData6": "ParentCommandLine: "C:Program FilesMozilla Firefoxfirefox.exe"","UserName": "DESKTOP-887GK2LCyberJunkie","ExecutableInfo": ""C:Program FilesMozilla Firefoxpingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/cb88145b-129d-471c-b605-4fdf09fec680/event/Firefox/122.0.1/release/20240205133611?v=4 C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releasesaved-telemetry-pingscb88145b-129d-471c-b605-4fdf09fec680 https://incoming.telemetry.mozilla.org/submit/telemetry/6fcd92a2-cc60-4df6-b6fb-66356dd011c1/main/Firefox/122.0.1/release/20240205133611?v=4 C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releasesaved-telemetry-pings6fcd92a2-cc60-4df6-b6fb-66356dd011c1","MapDescription": "Process creation","ChunkNumber": 0,"Computer": "DESKTOP-887GK2L","Payload": "{"EventData":{"Data":[{"@Name":"RuleName","#text":"technique_id=T1027,technique_name=Obfuscated Files or Information"},{"@Name":"UtcTime","#text":"2024-02-14 03:41:45.304"},{"@Name":"ProcessGuid","#text":"817bddf3-3679-65cc-2902-000000001900"},{"@Name":"ProcessId","#text":"5584"},{"@Name":"Image","#text":"C:\Program Files\Mozilla Firefox\pingsender.exe"},{"@Name":"FileVersion","#text":"122.0.1"},{"@Name":"Description","#text":"-"},{"@Name":"Product","#text":"Firefox"},{"@Name":"Company","#text":"Mozilla Foundation"},{"@Name":"OriginalFileName","#text":"pingsender.exe"},{"@Name":"CommandLine","#text":""C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/cb88145b-129d-471c-b605-4fdf09fec680/event/Firefox/122.0.1/release/20240205133611?v=4 C:\Users\CyberJunkie\AppData\Roaming\Mozilla\Firefox\Profiles\avsa4d81.default-release\saved-telemetry-pings\cb88145b-129d-471c-b605-4fdf09fec680 https://incoming.telemetry.mozilla.org/submit/telemetry/6fcd92a2-cc60-4df6-b6fb-66356dd011c1/main/Firefox/122.0.1/release/20240205133611?v=4 C:\Users\CyberJunkie\AppData\Roaming\Mozilla\Firefox\Profiles\avsa4d81.default-release\saved-telemetry-pings\6fcd92a2-cc60-4df6-b6fb-66356dd011c1"},{"@Name":"CurrentDirectory","#text":"C:\Program Files\Mozilla Firefox\"},{"@Name":"User","#text":"DESKTOP-887GK2L\CyberJunkie"},{"@Name":"LogonGuid","#text":"817bddf3-311e-65cc-a7ae-1b0000000000"},{"@Name":"LogonId","#text":"0x1BAEA7"},{"@Name":"TerminalSessionId","#text":"1"},{"@Name":"IntegrityLevel","#text":"Medium"},{"@Name":"Hashes","#text":"SHA1=282F855BEB4FACF0726E13ECCADB7D3411B30B85,MD5=A1F5FF25E3D0F160BC7CE7CA57349D83,SHA256=B412C45DE423534D85F121ABC348FB38020FDA804EA0A972708B7447B0E7325D,IMPHASH=F84029681F81FED23E3E067364DA1699"},{"@Name":"ParentProcessGuid","#text":"817bddf3-3514-65cc-0802-000000001900"},{"@Name":"ParentProcessId","#text":"4292"},{"@Name":"ParentImage","#text":"C:\Program Files\Mozilla Firefox\firefox.exe"},{"@Name":"ParentCommandLine","#text":""C:\Program Files\Mozilla Firefox\firefox.exe""},{"@Name":"ParentUser","#text":"DESKTOP-887GK2L\CyberJunkie"}]}}","UserId": "S-1-5-18","Channel": "Microsoft-Windows-Sysmon/Operational","Provider": "Microsoft-Windows-Sysmon","EventId": 1,"EventRecordId": "118772","ProcessId": 3028,"ThreadId": 4412,"Level": "Info","Keywords": "Classic","SourceFile": "Z:hackthebox-sherlocksunit42Microsoft-Windows-Sysmon-Operational.evtx","ExtraDataOffset": 0,"HiddenRecord": false,"TimeCreated": "2024-02-14T03:41:45.3058822+00:00","RecordNumber": 26}

概览

我们先分析父进程PayloadData4、进程ExecutableInfo、ID为PayloadData1和PayloadData5的进程和时间戳：

代码语言：javascript代码运行次数：0运行复制

PS > cat .eventid1.json | jq -s '.[] | [.TimeCreated, .PayloadData4, .ExecutableInfo, .PayloadData1, .PayloadData5]'["2024-02-14T03:41:45.3058822+00:00","ParentProcess: C:Program FilesMozilla Firefoxfirefox.exe",""C:Program FilesMozilla Firefoxpingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/cb88145b-129d-471c-b605-4fdf09fec680/event/Firefox/122.0.1/release/20240205133611?v=4 C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releasesaved-telemetry-pingscb88145b-129d-471c-b605-4fdf09fec680 https://incoming.telemetry.mozilla.org/submit/telemetry/6fcd92a2-cc60-4df6-b6fb-66356dd011c1/main/Firefox/122.0.1/release/20240205133611?v=4 C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releasesaved-telemetry-pings6fcd92a2-cc60-4df6-b6fb-66356dd011c1","ProcessID: 5584, ProcessGUID: 817bddf3-3679-65cc-2902-000000001900","ParentProcessID: 4292, ParentProcessGUID: 817bddf3-3514-65cc-0802-000000001900"]["2024-02-14T03:41:56.5596188+00:00","ParentProcess: C:Windowsexplorer.exe",""C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe" ","ProcessID: 10672, ProcessGUID: 817bddf3-3684-65cc-2d02-000000001900","ParentProcessID: 1116, ParentProcessGUID: 817bddf3-311f-65cc-0a01-000000001900"]["2024-02-14T03:41:57.6052379+00:00","ParentProcess: C:WindowsSystem32services.exe","C:Windowssystem32msiexec.exe /V","ProcessID: 10220, ProcessGUID: 817bddf3-3685-65cc-2e02-000000001900","ParentProcessID: 740, ParentProcessGUID: 817bddf3-307b-65cc-0b00-000000001900"]["2024-02-14T03:41:57.7881524+00:00","ParentProcess: C:WindowsSystem32msiexec.exe","C:Windowssyswow64MsiExec.exe -Embedding 5364C761FA9A55D636271A1CE8A6742D C","ProcessID: 6996, ProcessGUID: 817bddf3-3685-65cc-2f02-000000001900","ParentProcessID: 10220, ParentProcessGUID: 817bddf3-3685-65cc-2e02-000000001900"]["2024-02-14T03:41:57.9059712+00:00","ParentProcess: C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe",""C:Windowssystem32msiexec.exe" /i "C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891Cmain1.msi" AI_SETUPEXEPATH=C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe SETUPEXEDIR=C:UsersCyberJunkieDownloads EXE_CMD_LINE="/exenoupdates  /forcecleanup  /wintime 1707880560  " AI_EUIMSI=""","ProcessID: 10324, ProcessGUID: 817bddf3-3685-65cc-3002-000000001900","ParentProcessID: 10672, ParentProcessGUID: 817bddf3-3684-65cc-2d02-000000001900"]["2024-02-14T03:41:58.1794583+00:00","ParentProcess: C:WindowsSystem32msiexec.exe","C:Windowssyswow64MsiExec.exe -Embedding 5250A3DB12224F77D2A18B4EB99AC5EB","ProcessID: 10280, ProcessGUID: 817bddf3-3686-65cc-3102-000000001900","ParentProcessID: 10220, ParentProcessGUID: 817bddf3-3685-65cc-2e02-000000001900"]

从中我们可以了解到下列内容：

很明显，2和5是相关的，然后3、4、6是相关的。

Preventivo24.02.14.exe.exe

在搜索引擎中搜索「Preventivo24.02.14.exe.exe」、「Preventivo24.02.14」和「Preventivo.exe」之后，我了解到了一些看似可疑的东西：

日志中还提供了源代码的哈希：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .eventid1.json | jq -s '.[1]'{"PayloadData1": "ProcessID: 10672, ProcessGUID: 817bddf3-3684-65cc-2d02-000000001900","PayloadData2": "RuleName: technique_id=T1204,technique_name=User Execution","PayloadData3": "SHA1=18A24AA0AC052D31FC5B56F5C0187041174FFC61,MD5=32F35B78A3DC5949CE3C99F2981DEF6B,SHA256=0CB44C4F8273750FA40497FCA81E850F73927E70B13C8F80CDCFEE9D1478E6F3,IMPHASH=36ACA8EDDDB161C588FCF5AFDC1AD9FA","PayloadData4": "ParentProcess: C:Windowsexplorer.exe","PayloadData5": "ParentProcessID: 1116, ParentProcessGUID: 817bddf3-311f-65cc-0a01-000000001900","PayloadData6": "ParentCommandLine: C:WindowsExplorer.EXE","UserName": "DESKTOP-887GK2LCyberJunkie","ExecutableInfo": ""C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe" ","MapDescription": "Process creation","ChunkNumber": 0,"Computer": "DESKTOP-887GK2L","Payload": "{"EventData":{"Data":[{"@Name":"RuleName","#text":"technique_id=T1204,technique_name=User Execution"},{"@Name":"UtcTime","#text":"2024-02-14 03:41:56.538"},{"@Name":"ProcessGuid","#text":"817bddf3-3684-65cc-2d02-000000001900"},{"@Name":"ProcessId","#text":"10672"},{"@Name":"Image","#text":"C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe"},{"@Name":"FileVersion","#text":"1.1.2"},{"@Name":"Description","#text":"Photo and vn Installer"},{"@Name":"Product","#text":"Photo and vn"},{"@Name":"Company","#text":"Photo and Fax Vn"},{"@Name":"OriginalFileName","#text":"Fattura 2 2024.exe"},{"@Name":"CommandLine","#text":""C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe" "},{"@Name":"CurrentDirectory","#text":"C:\Users\CyberJunkie\Downloads\"},{"@Name":"User","#text":"DESKTOP-887GK2L\CyberJunkie"},{"@Name":"LogonGuid","#text":"817bddf3-311e-65cc-a7ae-1b0000000000"},{"@Name":"LogonId","#text":"0x1BAEA7"},{"@Name":"TerminalSessionId","#text":"1"},{"@Name":"IntegrityLevel","#text":"Medium"},{"@Name":"Hashes","#text":"SHA1=18A24AA0AC052D31FC5B56F5C0187041174FFC61,MD5=32F35B78A3DC5949CE3C99F2981DEF6B,SHA256=0CB44C4F8273750FA40497FCA81E850F73927E70B13C8F80CDCFEE9D1478E6F3,IMPHASH=36ACA8EDDDB161C588FCF5AFDC1AD9FA"},{"@Name":"ParentProcessGuid","#text":"817bddf3-311f-65cc-0a01-000000001900"},{"@Name":"ParentProcessId","#text":"1116"},{"@Name":"ParentImage","#text":"C:\Windows\explorer.exe"},{"@Name":"ParentCommandLine","#text":"C:\Windows\Explorer.EXE"},{"@Name":"ParentUser","#text":"DESKTOP-887GK2L\CyberJunkie"}]}}","UserId": "S-1-5-18","Channel": "Microsoft-Windows-Sysmon/Operational","Provider": "Microsoft-Windows-Sysmon","EventId": 1,"EventRecordId": "118793","ProcessId": 3028,"ThreadId": 4412,"Level": "Info","Keywords": "Classic","SourceFile": "Z:hackthebox-sherlocksunit42Microsoft-Windows-Sysmon-Operational.evtx","ExtraDataOffset": 0,"HiddenRecord": false,"TimeCreated": "2024-02-14T03:41:56.5596188+00:00","RecordNumber": 47}

搜索这些哈希之后，我们发现目标代码已经被上传到了很多恶意软件沙箱，例如Malware Bazaar、AnyRun、JoeSandbox和VirusTotal，这些平台都已经将其标记为了恶意代码：

蓝心千询

蓝心千询是vivo推出的一个多功能AI智能助手

34 查看详情

从事件日志中还可以看到，恶意代码的完整路径为「C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe」，进程的PID为10672。

恶意软件源

文件创建

如果在恶意软件被下载的时候，Sysmon已经在运行了，那么它就会生成事件ID为11的事件。我们可以使用「jq -c」来选择这些事件，并按行输出。此时，还可以使用findstr（类似于Linux中的grep）来获取包含4292的日志条目，而4292则是之前进程分析中Firefox的进程ID。然后，读取结果数据并打印文件时间戳：

代码语言：javascript代码运行次数：0运行复制

PS > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 11)' | findstr 4292 | jq -s '.[] | [.TimeCreated, .PayloadData4]'["2024-02-14T03:41:26.4630328+00:00","TargetFilename: C:UsersCYBERJ~1AppDataLocalTempskZdsnwf.exe"]["2024-02-14T03:41:26.4635006+00:00","TargetFilename: C:UsersCyberJunkieDownloadsskZdsnwf.exe.part"]["2024-02-14T03:41:26.4639993+00:00","TargetFilename: C:UsersCyberJunkieDownloadsskZdsnwf.exe.part"]["2024-02-14T03:41:26.4644853+00:00","TargetFilename: C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe"]["2024-02-14T03:41:30.4745302+00:00","TargetFilename: C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe:Zone.Identifier"]["2024-02-14T03:41:45.2125243+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releaseprefs-1.js"]["2024-02-14T03:41:45.2136161+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingMozillaFirefoxProfilesavsa4d81.default-releaseprefs-1.js"]

我们可以看到，03:41:26时它开始下载一个temp临时文件，之后便被重命名为了Preventivo24.02.14.exe.exe（同一秒）。4秒钟之后，另一个数据流将该文件标记为了「从互联网下载」，我们也可以说它是从Firefox下载的。此时，其他进程看起来就不是很重要了。

DNS

那么，Firefox到底是从哪里下载它的？于是我们打算从DNS记录入手，即Event ID 22，要使用的命令结构和之前类似：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 22)' | findstr 4292 | jq -s '.[] | [.TimeCreated, .PayloadData4, .PayloadData3]'["2024-02-14T03:41:26.4441194+00:00","QueryName: uc2f030016253ec53f4953980a4e.dl.dropboxusercontent.com","Image: C:Program FilesMozilla Firefoxfirefox.exe"]["2024-02-14T03:41:45.7793186+00:00","QueryName: d.dropbox.com","Image: C:Program FilesMozilla Firefoxfirefox.exe"]

在下载开始之后不到0.1秒便执行了第一次查询，可以判断恶意软件来自于Dropbox。

第二次查询发生在19秒之后，也就是恶意软件启动前的11秒，目前还搞不清楚此时发生了什么，但我们也先标记好。

恶意软件活动

文件创建

现在，我们从恶意进程（PID 10672）入手，通过日志分析，我们可以看到恶意软件在目标设备上创建了六个文件：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 11)' | findstr 10672 | jq -s '.[] | [.TimeCreated, .PayloadData4]'["2024-02-14T03:41:58.4048771+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesc.cmd"]["2024-02-14T03:41:58.4056902+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamescmmc.cmd"]["2024-02-14T03:41:58.4065154+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGameson.cmd"]["2024-02-14T03:41:58.4075055+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesonce.cmd"]["2024-02-14T03:41:58.4104279+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamestaskhost.exe"]["2024-02-14T03:41:58.4225212+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesviewer.exe"]

这些文件全部都在同一时间创建，可以看到once.cmd文件的完整路径为「C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesonce.cmd」。

DNS

这个进程发送的DNS请求如下：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 22)' | findstr 10672 | jq -s '.[] | [.TimeCreated, .PayloadData4, .PayloadData3]'["2024-02-14T03:41:58.7648370+00:00","QueryName: www.example.com","Image: C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe"]

请求的域名为www.example.com，这个域名很明显不是由威胁行为者控制的，而且也不是一个活动域名，也有可能是为了误导分析人员而设置的。

网络

日志中只有一个网络事件（Event ID 3），来自于进程PID 10672：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 3)' | findstr 10672 | jq .{"PayloadData1": "ProcessID: 10672, ProcessGUID: 817bddf3-3684-65cc-2d02-000000001900","PayloadData2": "RuleName: technique_id=T1036,technique_name=Masquerading","PayloadData3": "SourceHostname: -","PayloadData4": "SourceIp: 172.17.79.132","PayloadData5": "DestinationHostname: -","PayloadData6": "DestinationIp: 93.184.216.34","UserName": "DESKTOP-887GK2LCyberJunkie","MapDescription": "Network connection","ChunkNumber": 2,"Computer": "DESKTOP-887GK2L","Payload": "{"EventData":{"Data":[{"@Name":"RuleName","#text":"technique_id=T1036,technique_name=Masquerading"},{"@Name":"UtcTime","#text":"2024-02-14 03:41:57.159"},{"@Name":"ProcessGuid","#text":"817bddf3-3684-65cc-2d02-000000001900"},{"@Name":"ProcessId","#text":"10672"},{"@Name":"Image","#text":"C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe"},{"@Name":"User","#text":"DESKTOP-887GK2L\CyberJunkie"},{"@Name":"Protocol","#text":"tcp"},{"@Name":"Initiated","#text":"True"},{"@Name":"SourceIsIpv6","#text":"False"},{"@Name":"SourceIp","#text":"172.17.79.132"},{"@Name":"SourceHostname","#text":"-"},{"@Name":"SourcePort","#text":"61177"},{"@Name":"SourcePortName","#text":"-"},{"@Name":"DestinationIsIpv6","#text":"False"},{"@Name":"DestinationIp","#text":"93.184.216.34"},{"@Name":"DestinationHostname","#text":"-"},{"@Name":"DestinationPort","#text":"80"},{"@Name":"DestinationPortName","#text":"-"}]}}","UserId": "S-1-5-18","Channel": "Microsoft-Windows-Sysmon/Operational","Provider": "Microsoft-Windows-Sysmon","EventId": 3,"EventRecordId": "118910","ProcessId": 3028,"ThreadId": 4424,"Level": "Info","Keywords": "Classic","SourceFile": "Z:hackthebox-sherlocksunit42Microsoft-Windows-Sysmon-Operational.evtx","ExtraDataOffset": 0,"HiddenRecord": false,"TimeCreated": "2024-02-14T03:41:58.9054838+00:00","RecordNumber": 164}

连接到的IP地址为93.184.216.34。

时间戳

恶意软件修改文件时间戳的行为记录为Event ID2，总共有16个相关的恶意软件进程事件：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 2)' | findstr 10672 | jq -s '.[] | [.TimeCreated, .PayloadData4, .PayloadData5, .PayloadData6]'["2024-02-14T03:41:57.5590448+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891Cmain1.msi","CreationTimeUTC: 2024-01-14 08:14:23.713","PreviousCreationTimeUTC: 2024-02-14 03:41:57.545"]["2024-02-14T03:41:58.4045440+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamespowercfg.msi","CreationTimeUTC: 2024-01-10 18:12:27.357","PreviousCreationTimeUTC: 2024-02-14 03:41:58.389"]["2024-02-14T03:41:58.4053804+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesc.cmd","CreationTimeUTC: 2024-01-10 18:12:26.295","PreviousCreationTimeUTC: 2024-02-14 03:41:58.389"]["2024-02-14T03:41:58.4061207+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamescmmc.cmd","CreationTimeUTC: 2024-01-10 18:12:26.373","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4069465+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGameson.cmd","CreationTimeUTC: 2024-01-10 18:12:26.436","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4078369+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesonce.cmd","CreationTimeUTC: 2024-01-10 18:12:26.458","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4086077+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamescmd.txt","CreationTimeUTC: 2024-01-10 18:12:26.326","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4093822+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesUltraVNC.ini","CreationTimeUTC: 2024-01-10 18:12:26.530","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4101450+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CTempFolder~.pdf","CreationTimeUTC: 2024-01-14 08:10:06.029","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4128728+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamestaskhost.exe","CreationTimeUTC: 2024-01-10 18:12:26.513","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]["2024-02-14T03:41:58.4231673+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesviewer.exe","CreationTimeUTC: 2024-01-10 18:12:26.670","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]["2024-02-14T03:41:58.4258718+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesddengine.dll","CreationTimeUTC: 2024-01-10 18:12:26.406","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]["2024-02-14T03:41:58.4277653+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesUVncVirtualDisplayUVncVirtualDisplay.dll","CreationTimeUTC: 2024-01-10 18:12:26.905","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]["2024-02-14T03:41:58.4288308+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesvnchooks.dll","CreationTimeUTC: 2024-01-10 18:12:26.686","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]["2024-02-14T03:41:58.4299750+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesUVncVirtualDisplayuvncvirtualdisplay.cat","CreationTimeUTC: 2024-01-10 18:12:26.889","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]["2024-02-14T03:41:58.4308868+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CWindowsVolumeGamesUVncVirtualDisplayUVncVirtualDisplay.inf","CreationTimeUTC: 2024-01-10 18:12:27.013","PreviousCreationTimeUTC: 2024-02-14 03:41:58.420"]

有很多文件跟这个事件有关，但其中只有一个是PDF文件：

代码语言：javascript代码运行次数：0运行复制

PS  > cat .�40408132435_EvtxECmd_Output.json | jq -c 'select(.EventId == 2)' | findstr 10672 | findstr pdf | jq -s '.[] | [.TimeCreated, .PayloadData4, .PayloadData5, .PayloadData6]'["2024-02-14T03:41:58.4101450+00:00","TargetFilename: C:UsersCyberJunkieAppDataRoamingPhoto and Fax VnPhoto and vn 1.1.2installF97891CTempFolder~.pdf","CreationTimeUTC: 2024-01-14 08:10:06.029","PreviousCreationTimeUTC: 2024-02-14 03:41:58.404"]

其中，PDF文件的时间戳被修改为了「2024-01-14 08:10:06」。

终止执行

日志记录中只有一条进程终止事件（Event ID 5），该事件属于恶意软件：

代码语言：javascript代码运行次数：0运行复制

PS > cat .�40408132435_EvtxECmd_Output.json | jq 'select(.EventId == 5)'{"PayloadData1": "ProcessID: 10672, ProcessGUID: 817bddf3-3684-65cc-2d02-000000001900","UserName": "DESKTOP-887GK2LCyberJunkie","ExecutableInfo": "C:UsersCyberJunkieDownloadsPreventivo24.02.14.exe.exe","MapDescription": "Process terminated","ChunkNumber": 2,"Computer": "DESKTOP-887GK2L","Payload": "{"EventData":{"Data":[{"@Name":"RuleName","#text":"-"},{"@Name":"UtcTime","#text":"2024-02-14 03:41:58.795"},{"@Name":"ProcessGuid","#text":"817bddf3-3684-65cc-2d02-000000001900"},{"@Name":"ProcessId","#text":"10672"},{"@Name":"Image","#text":"C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe"},{"@Name":"User","#text":"DESKTOP-887GK2L\CyberJunkie"}]}}","UserId": "S-1-5-18","Channel": "Microsoft-Windows-Sysmon/Operational","Provider": "Microsoft-Windows-Sysmon","EventId": 5,"EventRecordId": "118907","ProcessId": 3028,"ThreadId": 4412,"Level": "Info","Keywords": "Classic","SourceFile": "Z:hackthebox-sherlocksunit42Microsoft-Windows-Sysmon-Operational.evtx","ExtraDataOffset": 0,"HiddenRecord": false,"TimeCreated": "2024-02-14T03:41:58.7996518+00:00","RecordNumber": 161}

该事件发生于「2024-02-14 03:41:58」。

分析结果

时间线

问题的答案

以上就是蓝队技术 | 使用Sysmon日志识别和分析Windows恶意活动的详细内容，更多请关注创想鸟其它相关文章！