Windows Update

Today I was performing Windows update it said that it needs to get two mandatory update I clicked on Okay and I was watching my SNORT IDS.  I saw two " FILE-IDENTIFY Portable Executable binary file magic detection" alerts in them what scared me was that they were from my ISP :-0. I know that we don't have any Micros0ft office in an around my place.

So I went to my windows machine and typed in netstat -aon sure enough I can see two established connection to the IP 122.165.249.90

ID	< Signature >	< Timestamp >	< Source Address >	< Dest. Address >	< Layer 4 Proto >
	#0-(5-49658)	[snort] DNS SPOOF query response with TTL of 1 min. and no authority	2012-02-24 05:38:37	192.168.1.1:53	192.168.56.200:57649	UDP
	#1-(5-49659)	[snort] FILE-IDENTIFY Portable Executable binary file magic detection	2012-02-24 05:39:33	122.165.249.90:80	192.168.56.200:49160	TCP
	#2-(5-49660)	[snort] FILE-IDENTIFY Portable Executable binary file magic detection	2012-02-24 05:39:34	122.165.249.90:80	192.168.56.200:49161	TCP

Next I clicked on the first IDS alert and found that it was trying to resolve dns.msftncsi.com and it resolves to the IP Address: 131.107.255.255. This increased my doubt, however drilling further down.  I started running PCAP and restarted my Windows machine.  I found that a second DNS query went out to download.windowsupdate.com which has a CNAME as shown below and my system at last ended up downloading from 122.165.xxx.xxx :-)

bala@bala-laptop:~$ nslookup download.windowsupdate.com
Server:        192.168.1.1
Address:    192.168.1.1#53

Non-authoritative answer:
download.windowsupdate.com    canonical name = download.windowsupdate.nsatc.net.
download.windowsupdate.nsatc.net    canonical name = main.dl.wu.akadns.net.
main.dl.wu.akadns.net    canonical name = intl.dl.wu.akadns.net.
intl.dl.wu.akadns.net    canonical name = dl.wu.ms.geo.akadns.net.
dl.wu.ms.geo.akadns.net    canonical name = a26.ms.akamai.net.
Name:    a26.ms.akamai.net
Address: 122.165.249.90
Name:    a26.ms.akamai.net
Address: 122.165.249.91

TDSS removal.

http://support.kaspersky.com/faq/?qid=208280684

McAfee's Free Tools

http://www.mcafee.com/us/downloads/free-tools/index.aspx

http://www.mcafee.com/us/downloads/free-tools/stinger.aspx

Get Suspected files
https://kc.mcafee.com/corporate/index?page=content&id=KB69385

Disable Registry & Taskmgr

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableRegistryTools = 0x00000001
• DisableTaskMgr = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)
to prevent users from starting Task Manager (Taskmgr.exe)
 
 
http://www.threatexpert.com/report.aspx?md5=8baf88111af782aaef0a0581b47ced68

Tasklist & taskkill

c:\Temp>tasklist /FI "IMAGENAME eq USBDeview.exe"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
USBDeview.exe                 9860 Services                   0      5,308 K

c:\Temp>taskkill /FI "IMAGENAME eq USBDeview.exe"
ERROR: The process with PID 9860 could not be terminated.
Reason: This process can only be terminated forcefully (with /F option).

c:\Temp>taskkill /F /FI "IMAGENAME eq USBDeview.exe"
SUCCESS: The process with PID 9860 has been terminated.

c:\Temp>del /F USBDeview.exe

c:\Temp>del /F usb.html

Using dd to aquire Memory or host drive

Acquire Memory:

C:\Tools>dd.exe if=\\.\PhysicalMemory of="E:\images\host1-memoryimage-20110807.dd"
conv=sync,noerror --md5sum --verifymd5 --md5out="E:\images\host1-memoryimage-20110807.dd.md5" --log="E:\images\host1-memoryimage-20110807.dd_audit.log"

Acquire Harddisk

C:\Tools>dd.exe if=\\.\PhysicalDrive0 of="E:\images\host1-diskimage-20110807.dd"
conv=sync,noerror --md5sum --verifymd5 --md5out="E:\images\host1-diskimage-20110807.dd.md5" --log="E:\images\host1-diskimage-20110807.dd_audit.log"

Collecting Contents from Clipboard

We can see what is there in the system Memory with the help of this tool

http://www.nirsoft.net/utils/inside_clipboard.html

Scheduled Tasks

We can use the inbuilt at command.

c:\Tools>at
Status ID   Day                     Time          Command Line
----------------------------------------------------------------------------
        1   Today                   14:05         cmd.exe
        2   Today                   14:05         calc.exe

c:\Tools>tasklist | find "calc"
calc.exe                      1308 Services                   0      3,276 K


We can also use the inbuilt schtasks command.

c:\Tools>schtasks /Query /FO LIST /V

Folder: \
HostName:                             BALA-PC
TaskName:                             \At1
Next Run Time:                        N/A
Status:                               Running
Logon Mode:                           Interactive/Background
Last Run Time:                        07-08-2011 14:05:00
Last Result:                          267009
Author:                               N/A
Task To Run:                          cmd.exe
Start In:                             N/A
Comment:                              N/A
Scheduled Task State:                 Enabled
Idle Time:                            Disabled
Power Management:                     Stop On Battery Mode, No Start On Batteries
Run As User:                          AtServiceAccount
Delete Task If Not Rescheduled:       Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule:                             Scheduling data is not available in this format.
Schedule Type:                        One Time Only
Start Time:                           14:05:00
Start Date:                           07-08-2011
End Date:                             N/A
Days:                                 N/A
Months:                               N/A
Repeat: Every:                        Disabled
Repeat: Until: Time:                  Disabled
Repeat: Until: Duration:              Disabled
Repeat: Stop If Still Running:        Disabled

HostName:                             BALA-PC
TaskName:                             \At2
Next Run Time:                        N/A
Status:                               Running
Logon Mode:                           Interactive/Background
Last Run Time:                        07-08-2011 14:05:00
Last Result:                          267009
Author:                               N/A
Task To Run:                          calc.exe
Start In:                             N/A
Comment:                              N/A
Scheduled Task State:                 Enabled
Idle Time:                            Disabled
Power Management:                     Stop On Battery Mode, No Start On Batteries
Run As User:                          AtServiceAccount
Delete Task If Not Rescheduled:       Enabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule:                             Scheduling data is not available in this format.
Schedule Type:                        One Time Only
Start Time:                           14:05:00
Start Date:                           07-08-2011
End Date:                             N/A
Days:                                 N/A
Months:                               N/A
Repeat: Every:                        Disabled
Repeat: Until: Time:                  Disabled
Repeat: Until: Duration:              Disabled
Repeat: Stop If Still Running:        Disabled

Determining Open Files

We can see what are all the files which are locally open with the link http://www.nirsoft.net/utils/opened_files_view.html

We can see what are all the files which are remotely open with the link


c:\Tools>net file

ID         Path                                    User name            # Locks

-------------------------------------------------------------------------------
12         C:\\                                    Bala                  0
230        C:\\                                    Bala                  0
233        C:\\Tools                               Bala                  0
689        C:\\Tools                               Bala                  0
The command completed successfully.

http://technet.microsoft.com/en-us/sysinternals/bb897552.aspx

c:\Tools>Psfile.exe

psfile v1.02 - psfile
Copyright ⌐ 2001 Mark Russinovich
Sysinternals

Files opened remotely on BALA-PC:

[12] C:\\
    User:   Bala
    Locks:  0
    Access: Read
[230] C:\\
    User:   Bala
    Locks:  0
    Access: Read
[233] C:\\Tools
    User:   Bala
    Locks:  0
    Access: Read
[689] C:\\Tools
    User:   Bala
    Locks:  0
    Access:

c:\Tools>

We can see all the recently accessed Documentation and Pictures with this command

http://www.nirsoft.net/utils/recent_files_view.html

Collecting Command Prompt History

We can see all the recently entered command in cmd prompt with the following command or F7.

c:\Tools>doskey /history
cls
serviwin.exe
net native start
net start
cls
svcutil.exe
svcutil.exe stop
svcutil.exe STOP

Identify Shares on the infected system
  
c:\Tools>net share

Share name   Resource                        Remark
-----------------------------------------------------------------------------
C$                  C:\                                     Default share
IPC$                                                        Remote IPC
ADMIN$         C:\Windows                      Remote Admin
The command completed successfully.

Finding the Services and Drivers

Often Malware makes itself as a service on the running system.

We can find the services which are running under a process with the command

c:\Tools>tasklist /svc

Image Name                     PID Services
========================= ======== =======
System Idle Process              0 N/A
System                           4 N/A
smss.exe                       380 N/A
csrss.exe                      456 N/A
wininit.exe                    500 N/A
services.exe                   584 N/A
lsass.exe                      600 ProtectedStorage, SamSs
lsm.exe                        608 N/A
svchost.exe                    764 DcomLaunch, PlugPlay
VBoxService.exe                808 VBoxService
svchost.exe                    856 RpcSs
svchost.exe                    892 WinDefend
svchost.exe                   1012 Audiosrv, Dhcp, Eventlog, lmhosts, wscsvc
svchost.exe                   1056 AudioEndpointBuilder, EMDMgmt, Netman,
                                   PcaSvc, SysMain, TabletInputService,
                                   TrkWks, UxSms, WdiSystemHost, WPDBusEnum,
                                   wudfsvc
svchost.exe                   1072 AeLookupSvc, Appinfo, BITS, IKEEXT,
                                   iphlpsvc, LanmanServer, MMCSS, ProfSvc,
                                   RasMan, Schedule, seclogon, SENS,
                                   ShellHWDetection, Themes, Winmgmt, wuauserv
audiodg.exe                   1136 N/A
svchost.exe                   1160 gpsvc
SLsvc.exe                     1180 slsvc
svchost.exe                   1208 EventSystem, FDResPub, LanmanWorkstation,
                                   netprofm, nsi, SLUINotify, SSDPSRV,
                                   SstpSvc, upnphost, W32Time, WebClient
svchost.exe                   1364 CryptSvc, Dnscache, KtmRm, NlaSvc, TapiSrv,
                                   TermService
spoolsv.exe                   1496 Spooler
svchost.exe                   1520 BFE, DPS, MpsSvc
svchost.exe                    280 PolicyAgent
taskeng.exe                    288 N/A
svchost.exe                    648 WerSvc
SearchIndexer.exe             1888 WSearch
csrss.exe                     2500 N/A
winlogon.exe                  2532 N/A
taskeng.exe                   2884 N/A
dwm.exe                       3868 N/A
explorer.exe                  3904 N/A
MSASCui.exe                   3996 N/A
VBoxTray.exe                  4004 N/A
sidebar.exe                   4012 N/A
wuauclt.exe                   3328 N/A
cmd.exe                       3464 N/A
tasklist.exe                  3704 N/A
WmiPrvSE.exe                  2828 N/A

c:\Tools>


We can get a whole list of details from PsService.exe
 http://technet.microsoft.com/en-us/sysinternals/bb897542.aspx
c:\Tools>PsService.exe

PsService v2.24 - Service information and configuration utility
Copyright (C) 2001-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: AeLookupSvc
DISPLAY_NAME: Application Experience
Processes application compatibility cache requests for applications as they are launched
        TYPE              : 20 WIN32_SHARE_PROCESS
        STATE             : 4  RUNNING
                               (STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE   : 0  (0x0)
        SERVICE_EXIT_CODE : 0  (0x0)
        CHECKPOINT        : 0x0
        WAIT_HINT         : 0 ms

SERVICE_NAME: ALG
DISPLAY_NAME: Application Layer Gateway Service
Provides support for 3rd party protocol plug-ins for Internet Connection Sharing
        TYPE              : 10 WIN32_OWN_PROCESS
        STATE             : 1  STOPPED
                               (NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE   : 1077 (0x435)
        SERVICE_EXIT_CODE : 0  (0x0)
        CHECKPOINT        : 0x0
        WAIT_HINT         : 0 ms

We can also use Serviwin from http://www.nirsoft.net/utils/serviwin.html to get all the details about services.

We can also user servicelist from http://www.pathsolutions.com/support/tools.asp

c:\Tools>ServiceList.exe -t \\bala-pc
Service Name    Display Name    State   Win Own Process Win Shared Process      Kernel Device Driver
File System Driver      Desktop Interactive Process     Start   Stop    Pause   Continue        System
 Shutdown
AeLookupSvc     Application Experience  Running         X                               X       X

ALG     Application Layer Gateway Service       Stopped X

Appinfo Application Information Running         X                               X       X


We can also user a native utility such as.

c:\Tools>net start
These Windows services are started:

   Application Experience
   Application Information
   Background Intelligent Transfer Service
   Base Filtering Engine
   COM+ Event System

We can also user another tool called SvcUtil

http://www.joeware.net/freetools/tools/svcutil/index.htm

c:\Tools>svcutil.exe "Application Experience"

SvcUtil V02.04.00cpp  Joe Richards (joe@joeware.net) June 2005

SERVICE_NAME: AeLookupSvc
DISPLAY NAME: Application Experience
        TYPE                 : 32  WIN32_SHARE_PROCESS
        STATE                : 4  RUNNING
                                  (STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE      : 0  (0x0)
        SERVICE_EXIT_CODE    : 0  (0x0)
        CHECKPOINT           : 0x0
        WAIT_HINT            : 0x0

c:\Tools>


We can find details about common Services and functions in the link

http://msdn2.microsoft.com/en-us/library/ms681921
http://www.theeldergeek.com/services_guide.htm#Services
http://msdn2.microsoft.com/en-us/library/ms685942


Drivers
we can see the drives on the system with the help of DriverView from http://www.nirsoft.net/utils/driverview.html

Here all Non-Microsoft Drivers will be highlighted.

This tool does the same thing over Command Line.

http://download.microsoft.com/download/win2000platform/drivers/1.0/NT5/EN-US/drivers.exe

c:\Tools>drivers.exe
  ModuleName    Code    Data     Bss   Paged    Init          LinkDate
------------------------------------------------------------------------------
ntoskrnl.exe  942080  290816       0 1966080  262144  Thu Oct 14 20:08:16 2010
     hal.dll   73728   16384       0   36864   16384  Sat Jan 19 10:57:20 2008
   kdcom.dll    4096    4096       0    4096    4096  Sat Jan 19 13:01:53 2008
mcupdate_GenuineIntel.dll    4096    4096       0  364544    4096  Sat Jan 19 12:59:43 2008
   PSHED.dll   12288   12288       0    8192    8192  Sat Jan 19 13:01:21 2008
 BOOTVID.dll    8192    4096       0       0    4096  Sat Jan 19 12:57:15 2008
    CLFS.SYS   77824   12288       0  131072    8192  Sat Jan 19 10:58:01 2008
      CI.dll  520192  303104       0   61440    4096  Fri Feb 22 10:30:56 2008

Associating Running processes and programs with open ports.

We can find a list of open ports on our machine with the command

c:\Tools>netstat -aon

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       856
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       500
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       1012
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       1072
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       600
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       584
  TCP    10.0.2.15:139          0.0.0.0:0              LISTENING       4
  TCP    [::]:135               [::]:0                 LISTENING       856
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:5357              [::]:0                 LISTENING       4
  TCP    [::]:49152             [::]:0                 LISTENING       500
  TCP    [::]:49153             [::]:0                 LISTENING       1012
  TCP    [::]:49154             [::]:0                 LISTENING       1072
  TCP    [::]:49155             [::]:0                 LISTENING       600
  TCP    [::]:49156             [::]:0                 LISTENING       584
  UDP    0.0.0.0:123            *:*                                    1208
  UDP    0.0.0.0:500            *:*                                    1072
  UDP    0.0.0.0:4500           *:*                                    1072
  UDP    0.0.0.0:5355           *:*                                    1364
  UDP    10.0.2.15:137          *:*                                    4
  UDP    10.0.2.15:138          *:*                                    4
  UDP    10.0.2.15:1900         *:*                                    1208
  UDP    127.0.0.1:1900         *:*                                    1208
  UDP    127.0.0.1:64594        *:*                                    1208
  UDP    [::]:123               *:*                                    1208
  UDP    [::]:500               *:*                                    1072
  UDP    [::1]:1900             *:*                                    1208
  UDP    [::1]:64593            *:*                                    1208
  UDP    [fe80::100:7f:fffe%11]:1900  *:*                                    1208
  UDP    [fe80::2031:52a2:cbee:b0b3%17]:1900  *:*                                    1208

We can find the executable associated with the ports number with the command

c:\Tools>netstat -anb

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  RpcSs
 [svchost.exe]
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING
 [wininit.exe]
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING
  Eventlog
 [svchost.exe]
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING
  Schedule
 [svchost.exe]
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING
 [lsass.exe]
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING
 [services.exe]
  TCP    10.0.2.15:139          0.0.0.0:0              LISTENING

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    [::]:135               [::]:0                 LISTENING
  RpcSs
 [svchost.exe]
  TCP    [::]:445               [::]:0                 LISTENING

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    [::]:5357              [::]:0                 LISTENING

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    [::]:49152             [::]:0                 LISTENING
 [wininit.exe]
  TCP    [::]:49153             [::]:0                 LISTENING
  Eventlog
 [svchost.exe]
  TCP    [::]:49154             [::]:0                 LISTENING
  Schedule
 [svchost.exe]
  TCP    [::]:49155             [::]:0                 LISTENING
 [lsass.exe]
  TCP    [::]:49156             [::]:0                 LISTENING
 [services.exe]
  UDP    0.0.0.0:123            *:*
  W32Time
 [svchost.exe]
  UDP    0.0.0.0:500            *:*
  IKEEXT
 [svchost.exe]
  UDP    0.0.0.0:4500           *:*
  IKEEXT
 [svchost.exe]
  UDP    0.0.0.0:5355           *:*
  Dnscache
 [svchost.exe]
  UDP    10.0.2.15:137          *:*

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  UDP    10.0.2.15:138          *:*

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  UDP    10.0.2.15:1900         *:*
  SSDPSRV
 [svchost.exe]
  UDP    127.0.0.1:1900         *:*
  SSDPSRV
 [svchost.exe]
  UDP    127.0.0.1:64594        *:*
  SSDPSRV
 [svchost.exe]
  UDP    [::]:123               *:*
  W32Time
 [svchost.exe]
  UDP    [::]:500               *:*
  IKEEXT
 [svchost.exe]
  UDP    [::1]:1900             *:*
  SSDPSRV
 [svchost.exe]
  UDP    [::1]:64593            *:*
  SSDPSRV
 [svchost.exe]
  UDP    [fe80::100:7f:fffe%11]:1900  *:*
  SSDPSRV
 [svchost.exe]
  UDP    [fe80::2031:52a2:cbee:b0b3%17]:1900  *:*
  SSDPSRV
 [svchost.exe]

c:\Tools>

We can obtain a similar information from openports http://www.diamondcs.com.au/openports/

c:\Tools>openports.exe -list -path
DiamondCS OpenPorts v1.0  (-? for help)
Copyright (C) 2003, DiamondCS - http://www.diamondcs.com.au/openports/
Free for personal and educational use only. See openports.txt for more details.
_______________________________________________________________________________

SYSTEM [0]
  TCP  0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP  10.0.2.15:139          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:49152          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:49153          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:49154          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:49155          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:49156          0.0.0.0:0              LISTENING
  TCP  0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP  0.0.0.0:5357           0.0.0.0:0              LISTENING
  UDP  0.0.0.0:68             0.0.0.0:0              LISTENING
  UDP  0.0.0.0:123            0.0.0.0:0              LISTENING
  UDP  10.0.2.15:137          0.0.0.0:0              LISTENING
  UDP  10.0.2.15:138          0.0.0.0:0              LISTENING
  UDP  0.0.0.0:500            0.0.0.0:0              LISTENING
  UDP  10.0.2.15:1900         0.0.0.0:0              LISTENING
  UDP  127.0.0.1:1900         0.0.0.0:0              LISTENING
  UDP  0.0.0.0:4500           0.0.0.0:0              LISTENING
  UDP  0.0.0.0:5355           0.0.0.0:0              LISTENING
  UDP  127.0.0.1:64594        0.0.0.0:0              LISTENING

c:\Tools>

http://www.iana.org/assignments/port-numbers

We can obtain a detailed information with CurrPorts from this following link

http://www.nirsoft.net/utils/cports.html

The TCPView utility can also provide the same kind of output.
http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

Collecting Details on Processes running on the system

PID & Process Name

We can use a tool from PStool Suite called as pslist.exe to obtain CPU Time and the amount of time since the process has started.

c:\Tools>PsList.exe

pslist v1.29 - Sysinternals PsList
Copyright (C) 2000-2009 Mark Russinovich
Sysinternals

Process information for BALA-PC:

Name                Pid Pri Thd  Hnd   Priv        CPU Time    Elapsed Time
Idle                  0   0   1    0      0     0:44:19.103     0:00:00.000
System                4   8  92  380      0     0:01:06.645     0:52:29.643
smss                384  11   4   28    248     0:00:00.250     0:52:29.633
csrss               452  13  11  487   1528     0:00:01.772     0:52:25.607
wininit             496  13   3   97   1064     0:00:00.530     0:52:23.394
csrss               504  13   9  242   2472     0:00:25.857     0:52:23.374
winlogon            532  13   3  133   1976     0:00:01.141     0:52:22.532
services            568   9   5  225   1880     0:00:03.485     0:52:21.471
lsass               580   9  10  569   2916     0:00:02.824     0:52:21.321

We can also user PrcView from the following link to get similar information.

http://www.teamcti.com/pview/prcview.htm

c:\Tools>pv

taskeng.exe         2556
Dwm.exe              728
Explorer.EXE        2840
MSASCui.exe         2956
VBoxTray.exe        2960
sidebar.exe         2792
wuauclt.exe         2872
cmd.exe             3660
wsqmcons.exe        3312
PrcView.exe         3652
pv.exe              3960

c:\Tools>PrcView.exe

Memory Usage

We can see the memory usage of the system by using the tasklist command.

c:\Tools>tasklist

pstat can also give a similar information in a more detailed manner.

http://support.microsoft.com/kb/927229

Linking running Processes with Executables.
This is very well accomplished with the PRCView with the -e switch.  We can also do the same with CurrProcess tool.

  http://www.nirsoft.net/utils/cprocess.html

 Linking Process on computer with User's on computer


We can use a simple little command such as tasklist -V or pulist to accomplish this.
c:\Tools>tasklist -V > c:\Tools\out.txt


We can alternatively use pulist from http://207.46.19.190/downloads/details.aspx?FamilyID=9b9da78d-f7d1-4b8a-8a31-3bb725c7a069&displaylang=en

c:\Tools>pulist.exe
Process           PID  User
Idle              0
System            4
smss.exe          384
csrss.exe         452
wininit.exe       496
csrss.exe         504
winlogon.exe      532
services.exe      568
lsass.exe         580
SearchIndexer.exe 208
eeyeevnt.exe      2296
taskeng.exe       2556 Bala-PC\Bala
dwm.exe           728  Bala-PC\Bala
explorer.exe      2840 Bala-PC\Bala
MSASCui.exe       2956 Bala-PC\Bala
VBoxTray.exe      2960 Bala-PC\Bala
sidebar.exe       2792 Bala-PC\Bala
wuauclt.exe       2872 Bala-PC\Bala
cmd.exe           3660 Bala-PC\Bala
cmd.exe           2596
wsqmcons.exe      3312 Bala-PC\Bala
PrcView.exe       3652 Bala-PC\Bala
WmiPrvSE.exe      2604
pulist.exe        3136 Bala-PC\Bala

c:\Tools>


Child Processes

If we need to see all the child processes spawned by another process we can use the pslist with the -t switch.

Command Line Switches to an executable

If we want to see the command line switches provided to an executable we can use the tools such as PRCView with -l as a switch or cmdline tool developed by diamondcs.com.au

Dependencies Loaded by Running Processes.

We can make use of a tool called as listdlls.exe from Microsoft to accomplish the same.
http://technet.microsoft.com/en-us/sysinternals/bb896656.aspx./

Even pv command can pull out the same details with a -m switch.

c:\Tools>pv -m cmd.exe
  Module information for  'cmd.exe'(3660)
  MODULE          BASE     SIZE     PATH
cmd.exe         4a750000   327680 C:\Windows\System32\cmd.exe
ntdll.dll       76f80000  1212416 C:\Windows\system32\ntdll.dll
kernel32.dll    76cd0000   897024 C:\Windows\system32\kernel32.dll
ADVAPI32.dll    76b60000   811008 C:\Windows\system32\ADVAPI32.dll
RPCRT4.dll      76220000   794624 C:\Windows\system32\RPCRT4.dll
msvcrt.dll      76760000   696320 C:\Windows\system32\msvcrt.dll
apphelp.dll     75430000   180224 C:\Windows\system32\apphelp.dll
USER32.dll      76c30000   643072 C:\Windows\system32\USER32.dll
GDI32.dll       770e0000   307200 C:\Windows\system32\GDI32.dll
IMM32.DLL       770b0000   122880 C:\Windows\system32\IMM32.DLL
MSCTF.dll       76810000   819200 C:\Windows\system32\MSCTF.dll
LPK.DLL         76440000    36864 C:\Windows\system32\LPK.DLL
USP10.dll       76540000   512000 C:\Windows\system32\USP10.dll

Recent and Current Network Connections

Active Connections

We can see the currently active connections with the help of netstat command.

C:\Users\Bala>netstat -aon

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       856
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       496
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       1024
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       1072
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       580
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       568
  TCP    [::]:135               [::]:0                 LISTENING       856
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:5357              [::]:0                 LISTENING       4
  TCP    [::]:49152             [::]:0                 LISTENING       496
  TCP    [::]:49153             [::]:0                 LISTENING       1024
  TCP    [::]:49154             [::]:0                 LISTENING       1072
  TCP    [::]:49155             [::]:0                 LISTENING       580
  TCP    [::]:49156             [::]:0                 LISTENING       568
  UDP    0.0.0.0:123            *:*                                    1224
  UDP    0.0.0.0:500            *:*                                    1072
  UDP    0.0.0.0:4500           *:*                                    1072
  UDP    127.0.0.1:1900         *:*                                    1224
  UDP    127.0.0.1:49153        *:*                                    1224
  UDP    [::]:123               *:*                                    1224
  UDP    [::]:500               *:*                                    1072
  UDP    [::1]:1900             *:*                                    1224
  UDP    [::1]:49152            *:*                                    1224
  UDP    [fe80::100:7f:fffe%11]:1900  *:*                                    1224


DNS queries made from infected system.
We can see the recent DNS queries with the command

C:\Users\Bala>ipconfig /displaydns

Windows IP Configuration

    1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    1.0.0.127.in-addr.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.127.in-addr.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 1
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 127.0.0.1


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 28
    Time To Live  . . . . : 86400
    Data Length . . . . . : 16
    Section . . . . . . . : Answer
    AAAA Record . . . . . : ::1


NetBIOS Connections


we can use

nbtstat -c the cached connections.
nbtstat -S (or) net sessions To see the current sessions.

If any files were transmitted over this network we can use the

net file command to display them.


ARP Cache

we can see the ARP cache of the machine under question with the command

arp -a

Collecting Infected system details

System Date and Time

C:\WINDOWS\system32>date /t
Sun 07/31/2011

C:\WINDOWS\system32>time /t
03:06 AM

http://support.microsoft.com/kb/927229
C:\Tools>now

Sun Jul 31 03:07:22 2011

C:\Tools>

System Identifiers

C:\Tools>hostname
Bala-PC

C:\Tools>whoami
bala-pc\bala

C:\Tools>ver

Microsoft Windows [Version 6.0.6001]

C:\Tools>

If we want to know if a particular interface is in Promiscuous mode or not go to the following link and run promiscdetect.exe

http://www.ntsecurity.nu/toolbox/promiscdetect/

System Uptime

We can see how long the system is running by using the uptime command from the URL 
http://support.microsoft.com/kb/232243

C:\Tools>uptime
\\BALA-PC has been up for: 0 day(s), 0 hour(s), 16 minute(s), 26 second(s)


http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx

C:\Tools>PsInfo.exe

PsInfo v1.77 - Local and remote system information viewer
Copyright (C) 2001-2009 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\BALA-PC:
Uptime:                    0 days 0 hours 18 minutes 52 seconds
Kernel version:            Windows Vista
Product type:              Professional
Product version:           6.0
Service pack:              1
Kernel build number:       6001
Registered organization:
Registered owner:          Bala
IE version:                7.0000
System root:               C:\Windows
Processors:                1
Processor speed:           1 GHz
Processor type:            Intel(R) Core(TM) CPU     T6600 
Physical memory:           256 MB
Video driver:              VirtualBox Graphics Adapter

C:\Tools>

http://www.niiconsulting.com/innovation/tools.html.


C:\Tools>DumpWin.exe
DumpWin v2.00 (Windows NT/2K)
Network Intelligence India Pvt. Ltd.
http://www.nii.co.in
Arjun Pednekar (arjunp@nii.co.in)

Parameters :
         -i : List installed Programs.          -d : Drive Information.
         -s : System Information.               -m : Check for Modem Drivers.
         -h : List shares present.              -t : List Startup Programs.
         -p : List active Processes.            -v : List of Services.
         -g : List Local Group Accounts         -u : List User Accounts.
         -l : dumpACL                           -n : Account Lockout Policy              -a : All of a
bove.

 Dont forget to check the new releases of DumpWin.

C:\Tools>DumpWin.exe -d
DumpWin v2.00 (Windows NT/2K)
Network Intelligence India Pvt. Ltd.
http://www.nii.co.in
Arjun Pednekar (arjunp@nii.co.in)


=====================
Drive Information

=====================

Drive C:\ :  Fixed
Drive D:\ :  CD-ROM
Drive E:\ :  Network drive
Drive Z:\ :  Network drive
C:\Tools>

Identifying Users Logged into the System.

We can find which user has currently logged on to the system with the help of psloggedon.exe which is part of the sysinternals tool suite.

C:\Tools>PsLoggedon.exe

PsLoggedon v1.34 - See who's logged on
Copyright (C) 2000-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

Users logged on locally:
     31-07-2011 16:17:40        Bala-PC\Bala

No one is logged on via resource shares.

C:\Tools>


We can also user Netusers to find out the last logon date of each users.

http://www.systemtools.com/free.htm

We can also user logonsessions.exe -p tool to see all the processes which are running in the logged-on sessions.

http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx

c:\Tools>logonsessions.exe -p

Logonsesions v1.21
Copyright (C) 2004-2010 Bryce Cogswell and Mark Russinovich
Sysinternals - wwww.sysinternals.com


[0] Logon session 00000000:000003e7:
    User name:    WORKGROUP\BALA-PC$
    Auth package: NTLM
    Logon type:   (none)
    Session:      0
    Sid:          S-1-5-18
    Logon time:   31-07-2011 16:17:14
    Logon server:
    DNS Domain:
    UPN:
      380: smss.exe
      456: csrss.exe
      500: wininit.exe
      508: csrss.exe
      536: winlogon.exe
      576: services.exe
      588: lsass.exe
      596: lsm.exe
      764: svchost.exe
      812: VBoxService.exe
      896: svchost.exe
     1052: svchost.exe
     1068: svchost.exe
     1160: svchost.exe
     1492: spoolsv.exe
     1724: eEyeUpdateSvc.exe
     1896: RetinaEngine.exe
     2016: svchost.exe
      256: SearchIndexer.exe
     3676: eeyeevnt.exe
     3196: WmiPrvSE.exe

[1] Logon session 00000000:000090ea:
    User name:
    Auth package: NTLM
    Logon type:   (none)
    Session:      0
    Sid:          (none)
    Logon time:   31-07-2011 16:17:15
    Logon server:
    DNS Domain:
    UPN:

[2] Logon session 00000000:000003e4:
    User name:    WORKGROUP\BALA-PC$
    Auth package: Negotiate
    Logon type:   Service
    Session:      0
    Sid:          S-1-5-20
    Logon time:   31-07-2011 16:17:16
    Logon server:
    DNS Domain:
    UPN:
      860: svchost.exe
     1176: SLsvc.exe
     1364: svchost.exe
     1872: svchost.exe

[3] Logon session 00000000:000003e5:
    User name:    NT AUTHORITY\LOCAL SERVICE
    Auth package: Negotiate
    Logon type:   Service
    Session:      0
    Sid:          S-1-5-19
    Logon time:   31-07-2011 16:17:18
    Logon server:
    DNS Domain:
    UPN:
     1024: svchost.exe
     1208: svchost.exe
     1516: svchost.exe
     1984: svchost.exe

[4] Logon session 00000000:00015279:
    User name:    NT AUTHORITY\ANONYMOUS LOGON
    Auth package: NTLM
    Logon type:   Network
    Session:      0
    Sid:          S-1-5-7
    Logon time:   31-07-2011 16:17:25
    Logon server:
    DNS Domain:
    UPN:

[5] Logon session 00000000:0001cbb7:
    User name:    Bala-PC\Bala
    Auth package: NTLM
    Logon type:   Interactive
    Session:      1
    Sid:          S-1-5-21-2753564925-3547717165-4264054735-1000
    Logon time:   31-07-2011 16:17:38
    Logon server: BALA-PC
    DNS Domain:
    UPN:
     3488: cmd.exe
     1868: logonsessions.exe

[6] Logon session 00000000:0001cbcc:
    User name:    Bala-PC\Bala
    Auth package: NTLM
    Logon type:   Interactive
    Session:      0
    Sid:          S-1-5-21-2753564925-3547717165-4264054735-1000
    Logon time:   31-07-2011 16:17:38
    Logon server: BALA-PC
    DNS Domain:
    UPN:
     2336: taskeng.exe
     2480: dwm.exe
     2516: explorer.exe
     2592: MSASCui.exe
     2600: VBoxTray.exe
     2620: sidebar.exe
     2820: cmd.exe
     2704: wuauclt.exe
     1572: wsqmcons.exe

[7] Logon session 00000000:00038117:
    User name:    Bala-PC\IUSER_RETINA
    Auth package: NTLM
    Logon type:   Interactive
    Session:      0
    Sid:          S-1-5-21-2753564925-3547717165-4264054735-1001
    Logon time:   31-07-2011 16:19:02
    Logon server: BALA-PC
    DNS Domain:
    UPN:

c:\Tools>