{"id":41614,"date":"2020-02-13T20:48:26","date_gmt":"2020-02-13T17:48:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov"},"modified":"2020-02-13T20:48:26","modified_gmt":"2020-02-13T17:48:26","slug":"ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","title":{"rendered":"K\u00fcti pealt r\u00fcnnakute tehnikate ja taktikate kasutamist Prefetch-failide abil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"K\u00fcti
\n
\nJ\u00e4ljendatud failid ehk Prefetch-failid on Windowsis olemas juba Windows XP ajast. Sellest ajast alates on need aidanud digitaalsetel kriminaaluurijatel ja arvutikuritegudele reageerijatel leida j\u00e4lgi programmide k\u00e4ivitamisest, sealhulgas pahavara. Group-IB juhtiv arvutikriminalistika spetsialist Oleg Skulkin<\/b> r\u00e4\u00e4gib, mida saab Prefetch-failide abil leida ja kuidas seda teha.<\/a><\/noindex><\/p>\n

Prefetch-failid salvestatakse katalooge %SystemRoot%Prefetch<\/b> ja need aitavad kiirendada programmide k\u00e4ivitamisprotsessi. Kui vaatame m\u00f5nda neist failidest, n\u00e4eme, et selle nimi koosneb kahest osast: t\u00e4idetava faili nimest ja teekonna kontrollsummast, mis koosneb kaheksast s\u00fcmbolist.<\/p>\n

Prefetch-failid sisaldavad rohkesti kasulikku kriminaaluuringute seisukohalt teavet: t\u00e4idetava faili nimi, k\u00e4ivituste arv, failide ja kataloogide loendid, millega t\u00e4idetav fail suhtles, ja loomulikult ajatemplid. Tavaliselt kasutavad kriminaaluurijad Prefetch-faili loomise kuup\u00e4eva, et m\u00e4\u00e4rata programmi esimese k\u00e4ivitamise kuup\u00e4eva. Lisaks sisaldavad need failid kuup\u00e4eva viimase k\u00e4ivitamise kohta ning alates versioonist 26 (Windows 8.1) - seitsme viimase k\u00e4ivitamise ajatempleid.<\/p>\n

V\u00f5tame \u00fche Prefetch-faili, ekstraheerime selle andmed Eric Zimmermani PECmd abil ja vaatame iga selle osa. N\u00e4itamiseks ekstraheerin ma andmed failist CCLEANER64.EXE-DE05DBE1.pf<\/b>.<\/p>\n

Nii, alustame \u00fclevalt. Loomulikult on meil failide loomise, muutmise ja juurde p\u00e4\u00e4semise ajatemplid:<\/p>\n

\"K\u00fcti
\nNende j\u00e4rel j\u00e4rgneb t\u00e4idetava faili nimi, teekonna kontrollsumma, t\u00e4idetava faili suurus ning Prefetch-faili versioon:<\/p>\n

\"K\u00fcti
\nKuna tegeleme Windows 10-ga, n\u00e4eme edasi k\u00e4ivituste arvu, viimase k\u00e4ivitamise kuup\u00e4eva ja kellaaega ning veel seitsme ajatempli, mis n\u00e4itavad eelmise k\u00e4ivitamise kuup\u00e4evi:<\/p>\n

\"K\u00fcti
\nNende j\u00e4rel on teave eriti mahuti, sealhulgas selle seerianumber ja loomise kuup\u00e4ev:<\/p>\n

\"K\u00fcti
\nJa viimane, kuid mitte v\u00e4hem oluline \u2014 loetelu kataloogidest ja failidest, millega t\u00e4idetav fail suhtles: <\/p>\n

\"K\u00fcti
\nNii et, kataloogid ja failid, millega t\u00e4itmisfail suhtleb, on just need, millele t\u00e4na keskenduda soovin. Need andmed v\u00f5imaldavad digitaalsete kriminaalsete spetsialistide, arvutih\u00e4irete reageerimise v\u00f5i proaktiivsete ohuhindajate teada mitte ainult seda, kas fail on k\u00e4ivitatud, vaid m\u00f5nel juhul isegi rekonstrueerida konkreetseid r\u00fcnnakutaktikaid ja -tehnikaid. T\u00e4nap\u00e4eval kasutavad kurjategijad \u00fcsna sageli andmete p\u00f6\u00f6rdumatuks kustutamiseks m\u00f5eldud t\u00f6\u00f6riistu, n\u00e4iteks SDelete, seet\u00f5ttu on iga kaasaegse kaitsja \u2014 arvutite kriminaalinspektori, h\u00e4irete reageerimise spetsialisti v\u00f5i ThreatHunter-i eksperdi \u2014 jaoks \u00e4\u00e4rmiselt vajalik v\u00e4hemalt m\u00f5ningaid j\u00e4lgi nende taktika ja tehnikate kasutamise taastamiseks.<\/p>\n

Alustame taktika Initial Access (TA0001) ja k\u00f5ige populaarsema tehnika \u2014 Spearphishing Attachment (T1193) \u2014 uurimist. M\u00f5ned k\u00fcberkuritegelikud grupid l\u00e4henesid sellistele manustele \u00fcsna loominguliselt. N\u00e4iteks kasutas grupp Silence selleks CHM (Microsoft Compiled HTML Help) formaadi faile. Seega on meie ees veel \u00fcks tehnika \u2014 Compiled HTML File (T1223). Sellised failid k\u00e4ivitatakse hh.exe<\/b>, seega, kui me ekstraktime andmed selle eelneva faili kohta, siis saame teada, millisest failist ohver avas:<\/p>\n

\"K\u00fcti
\nJ\u00e4tkame t\u00f5eliste juhtumite n\u00e4idetega ja liigume j\u00e4rgmise taktika Execution (TA0002) ja tehnika CSMTP (T1191) juurde. Microsoft Connection Manager Profile Installer (CMSTP.exe) v\u00f5ib r\u00fcndajate poolt kasutada pahatahtlike skriptide k\u00e4ivitamiseks. Hea n\u00e4ide on grupp Cobalt. Kui me ekstraktime andmed eelneva faili kohta cmstp.exe<\/b>, siis saame j\u00e4lle teada, mis k\u00e4ivitati:<\/p>\n

\"K\u00fcti
\nTeine populaarne tehnika on Regsvr32 (T1117). Regsvr32.exe<\/b> kasutatakse ka r\u00fcndajate poolt k\u00e4ivitamiseks. Siin on veel \u00fcks n\u00e4ide grupilt Cobalt: kui me ekstraktime andmed eelneva faili kohta, regsvr32.exe<\/b>siis n\u00e4eme j\u00e4lle, mis k\u00e4ivitati:<\/p>\n

\"K\u00fcti
\nJ\u00e4rgmiseks taktikatena on Persistence (TA0003) ja Privilege Escalation (TA0004), samuti Application Shimming (T1138) tehnika. Seda tehnikat kasutas Carbanak\/FIN7 s\u00fcsteemis kinnitamiseks. Tavaliselt kasutatakse andmebaasidega, mis sisaldavad programmide \u00fchilduvusinfot (.sdb), t\u00f6\u00f6ks sdbinst.exe<\/b>. Seet\u00f5ttu v\u00f5ib selle t\u00e4itmisfaili eelneva fail aidata meil teada saada selliste andmebaaside nimesid ja nende asukohta:<\/p>\n

\"K\u00fcti
\nNagu n\u00e4ha illustratsioonilt, on meil mitte ainult installimiseks kasutatud faili nimi, vaid ka installitud andmebaasi nimi.<\/p>\n

Vaatame \u00fchte t\u00fc\u00fcpilisemat n\u00e4idet v\u00f5rgu edendamisest (TA0008) \u2014 PsExec, mis kasutab administraatori \u00fchiseid ressursse (T1077). Teenus nimega PSEXECSVC (loomulikult v\u00f5ib kasutada ka m\u00f5nda muud nime, kui r\u00fcndajad kasutasid parameetrit -r<\/b>) luuakse sihtris\u00fcsteemis, seega kui me ekstraktime andmed Prefetch-failist, n\u00e4eme, et k\u00e4ivitatud oli:<\/p>\n

\"K\u00fcti
\nL\u00f5petan ma, ilmselt, sellega, millega alustasin \u2014 failide kustutamine (T1107). Nagu juba m\u00e4rkisin, kasutab paljusid r\u00fcndajaid SDelete'd failide p\u00f6\u00f6rdumatuks kustutamiseks erinevates r\u00fcnnaku eluts\u00fckli etappides. Kui vaatame andmeid Prefetch-failist sdelete.exe<\/b>, n\u00e4eme, mis t\u00e4pselt kustutati:<\/p>\n

\"K\u00fcti<\/p>\n

Muidugi ei ole see ammendav loetelu tehnikatest, mida saab Prefetch-failide anal\u00fc\u00fcsi k\u00e4igus tuvastada, kuid sellest piisab, et m\u00f5ista, et sellised failid aitavad mitte ainult k\u00e4ivituste j\u00e4lgi leida, vaid ka rekonstrueerida r\u00fcndajate spetsiifilisi taktikaid ja tehnikaid.
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41615,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41614","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00fc\u00fcame r\u00fcndajate tehnikaid ja taktikaid Prefetch-failide abil | ProHoster","description":"Failid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0445\u043e\u0442\u0438\u043c\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0424\u0430\u0439\u043b\u044b.","og:url":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-13T17:48:26+00:00","article:modified_time":"2020-02-13T17:48:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41614","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:13:40","updated":"2022-09-28 14:43:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41614"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41614\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/41615"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}