Clicking buttons for a living
With the huge and ever-growing volume of malicious samples we see today, automation has become increasingly important. Security vendors and companies with an interest in securing their networks expend more and more resources analyzing files and network traffic looking for malware, targeted attacks and other threats. To assist this process, solutions like Network Threat Discovery (NTD) and Malware Analyzer G2 (MAG2) from Norman Shark are often used. This article describes a common challenge with dynamic analysis systems like MAG2, and how we are addressing this challenge.
The technology behind sandboxes and dynamic analysis systems like MAG2 is quite complex, but the principle is simple. You send it a file, and it tells you what the file would do if you executed it on your computer. But what if the file requires user interaction to run? Traditionally, dynamic analysis systems have had no idea how to deal with interactive malware, leading to at least three (3) problems which are described in detail below.
Execution-blocking popups
Dialog boxes and popups commonly prevent further execution of a file until the message box is closed by the user. Such popups may be generated by the file itself, or they could be error messages from Windows. Analyzing such a file in a dynamic analysis system may reveal little or no information about what the file would do on a live system because the popup is never closed, and therefore the execution never continues.
Often times a malicious file will present the user with a popup to conceal itself. Imagine for example a targeted attack where your CEO is sent an innocent-looking PDF document. Upon opening the PDF, he or she is presented with a fake error message indicating that the file is corrupt, that a newer version of your PDF reader is required, or that you are missing a runtime component required to open the file. Most users would be fooled by this notification and think nothing more of it, but as soon as the popup is closed a backdoor is installed on the system giving the attacker full access.
In my experience the more innocent looking the popup, the more suspicious it is.
This application looks like a simple hello world test application and doesn’t seem to do anything special at first glance, but when the popup is closed it proves to be malicious.
An error message like this may trick the user into believing that the file was corrupt, but as soon as the notification is closed, the system gets infected.
Malicious files are often encrypted. This file was encrypted by an unregistered version of ASProtect, and execution of the file doesn’t actually start until the popup is closed.
Installers
Another shortcoming of traditional sandboxes is their inability to deal with installers. Sadly, installers are often bundled with potentially unwanted applications (PUAs), or they may in fact be the guise of a Trojan. We also often see installers for popular applications being rebundled in another layer of wrapping that installs something else along with the legitimate application. While simple popups typically don’t have more than one or two buttons to click, installers are usually much more complex, and sometimes require user input or decisions. Is this a legitimate program, a potentially unwanted application, or a Trojan? You will have to install it to find out, because your sandbox can’t help you if it can’t click through the installer!
A waste of time (and cycles)!
The third and final problem described in this article is really a side effect of the first two.
Automated dynamic analysis systems will generally run a file until execution terminates naturally (the file completes its behavior), or until a predefined timeout value is reached (some number of seconds or cycles). Naturally, installers and popups that are blocking further execution of a file will keep the process running until this timeout value is reached, while yielding little or no analysis information of value. This is both inefficient and unproductive.
Where a simple click on a button may have terminated execution of an application after just a few seconds, your analysis system may instead be doing nothing for an extended time period while waiting for the timeout.
Our approach
Thanks to the powerful plugin architecture of MAG2, users can create or download IntelliVM plugins that can interact with the running malware, influence the analysis process, perform additional deep analysis, or gather additional intelligence.
Norman Shark has approached the challenges above by developing a plugin called Ghost User. While the Norman SandBox®, a component within MAG2, emulates the entire computer, local network and everything around it, the Ghost User plugin attempts to emulate the behavior of the computer user. The plugin will click buttons, close dialogue boxes, and run through installers like a real user would, thus greatly enhancing the analysis results of such files.
The Ghost User is freely available to all MAG2 customers and can be downloaded from GitHub.
