Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMP47380_MalwareAdvanced > 01 - Windows OS > Flashcards

01 - Windows OS Flashcards

1
Q

What are the three main types of Windows Applications? Explain those.

A
  • *EXE** (Executables),
  • *DLL** (Dynamic Link Library, exports code by a function name or ordinal (numerical value) to be used by multiple other applications),
  • *SYS** (device drivers, allows higher level programs to interact with hardware).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can a DLL be loaded? What are the three main steps?

A

Can be loaded during load time (first execution of program) or runtime (during run of application)

  1. Call the LoadLibrary API with the name of the DLL.
  2. Get access to function via GetProcAddress function.
  3. Call function.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a process and what does it have?

A

Program running in memory. All processes have:

  • Unique process ID
  • Private virtual address space (4GB on 32bit system)
  • Executable program code mapped into memory
  • 1+ execution threads (part of execution of a program)
  • Unique Security Access token
  • List of open handles to OS resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a thread and what does it have?

A

Execution path within a program, scheduled for execution by CPU. A program can have multiple threads (one for updates, one for error signals, etc). All threads have:

  • A unique thread ID
  • Unique Access token
  • CPU state
  • Kernel mode and user mode stacks (areas of memory to hold temporary variables)
  • Thread Local Storage (TLS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are Access Tokens and what do they have?

A

Contains:

  • Security Identifier (SID) for the user’s account
  • Owner and Group SIDs
  • Discretionary Access Control List (DACL)
  • Privilege
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are VAD & handle table?

A

Handle table: Keeps track of all the objects (files, registry, ports, etc) that it has open.

Virtual address descriptor (VAD): Keeps track of all allocated virtual memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How does process creation works?

A

[1] Image file opened => [2] Process Object Created => [3] Initial Thread Created => [4] OS subsystem notified => [5] OS executes initial thread => [6] Thread initialises Process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Explain TEB / PEB?

A

Thread Environment Block (TEB): data structure containing information and system variables in User-mode memory

Process Environment Block (PEB):

  • One per process
  • Info about DLLs, OS, etc
  • TEB has a pointer to PEB

When analysis, following info can be found:

  • Is debugger present?
  • Installing an Exception Handler
  • When a dll is loaded via LoadLibrary into a Process a new entry in the PEB.Ldr.InMemoryOrderModuleList is created

Also allows an attacker to bypass certain API calls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain important Windows processes?

A
  • smss.exe
  • csrss.exe
  • winlogon.exe
  • services.exe
  • svchost.exe
  • lsass.exe
  • userinit.exe
  • explorer.exe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is virtual memory?

A

It’s logical view of memory. Every process has a virtual memory of 4 GB. Physical memory will only be assigned until first accessed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the Windows Memory Manager?

A
  • Mapping accesses to virtual memory into physical memory.
  • When physical memory runs out, swaps pages of memory to disk.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the main three file systems?

A

FAT32, UDF, NTFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does NTFS supports?

A
  • Supports ACL
  • Unicode Naming
  • LZ77 Compression
  • Alternate Data Streams (ADS)
  • Encrypted File System (EFS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Explain the Windows Architecture?

A

Draw picture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

For what is Win32 API?

A

Whenever a process likes to access a device or win function, it uses Win32 API. Has three DLLs: kernel32.dll, user32.dll, gdi32.dll.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Ntdll.dll

A

Takes API calls and passing it through to the kernel; some Windows built processes can access ntdll.dll directly. (ntdll.dll is undocumented).

17
Q

What does the System Service Dispatcher?

A

Responsible for taking all API requests from user mode via ntdll.dll and passing it to the relevant part of the kernel and passes results back up to user-mode. Passing control from User mode to Kernel Mode is handled by the system service dispatcher. Intel Processors actually allow 4 privilege levels or rings

18
Q

Explain segment descriptor?

A

Every code segment in memory has a segment descriptor, which lists:
Start of code segment, Length of code segment, Privilege level of code segment (Kernel mode = ring 0; User mode = ring 3)

19
Q

Name the two tables and registers for the segment descriptor?

A

Tables:

  • Global Descriptor Table (for shared / kernel memory, tells you for every page in memory what level its at)
  • Local Descriptor Table (one per process)

Registers:

  • Global Descriptor Table Register (GDTR)
  • Local Descriptor Table Register (LDTR) / This will be swapped by OS when swapping processes
20
Q

Explain what happes when Ntdll.dll causes a system interrupt.

A

First KiSystemService (the System Service Dispatcher) checks which call was requested and picks the relevant Kernel routine.

It does this by looking up the supplied System Service Number in the SSDT (System Service Descriptor Table). This in turn points to the actual code for the function in Ntoskrnl.exe.

21
Q

What is the registry?

A

The Windows Registry is a Hierarchical database that contains settings for OS + other software. Think of it as a huge settings file / ini file. It also contains in memory volatile data such as current Hardware setup. It has a tree architecture: Hives, Keys, Values.

22
Q

Name the six registry hives?

A

HKLM, HKU, HKCU, HKCR, HKCC, HKPD

23
Q

What are Windows Services? Name the three type of Services?

A

Windows Services are background executables that performs specific functions and which are designed not to require user intervention. Separate Process, Shared Process, Kernel Drivers.

24
Q

What are the new Windows protection mechanisms?

A

Kernel Patch Protection (PatchGuard) and digital signature of 64 bit drivers

25
Q

What is the I/O subsystem for?

A

The Windows I/O system is responsible for all Input and Output from the Windows OS. Made up of several Kernel components: I/O Manager, Plug and Play Manager, Power Manager.

26
Q

Name the three important components of Device Drivers?

A

DriverEntry, Add-Device Routine, Dispatch Routines.

27
Q

Explain Layered Driver Model and Filter Drivers?

A

The first step goes through NTDLL => System Service Dispatcher

(1) I/O manager send File Offset to File System Driver, and gets back volume offset to the place on disk that the file is located.
(2) This is passed to Disk Driver, which talks to actual HDD. It in turn reads the disk and passes the data via the I/O manager to the user.

Filter Driver is a driver which will be inserted into the chain of drivers called for a certain piece of hardware. E.g. AV.

28
Q

Name the most common APIs for analyzing malware?

A

Files/Registry, Process / Threads, Memory, Services, Extras

29
Q

Name the three ways of Fileless attacks?

A

Executing code directly in memory, Registry Scripts, Powershell Scripts

COMP47380_MalwareAdvanced (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions